If I set up a webform with one component "authrization code", which is predefined by my side. People can access the form only when they get the authorized unique code from me. Is there any way to realize this? I tried a module "webform invitation", but have the same problem as described "any code is accepted"(my system is D8.64,php7.0). If I add a text field for code validation, I don't know where to predefine those codes and how to check. Another question is how can I produce those unique codes and transfer them to QR codes so that people can scan them to automatically fill in the form? Appreciate for any help in advance!

1 Answer 1


You can create a custom module with a hook_webform_access() callback that looks for authorizations codes.

The below hook grants access to the default Contact form via /form/contact?code=secretcode. Make sure to go to /admin/structure/webform/manage/contact/access and remove 'Create submissions' access to the Contact form.

 * Implements hook_webform_access().
function CUSTOM_MODULE_webform_access(\Drupal\Core\Entity\EntityInterface $entity, $operation, \Drupal\Core\Session\AccountInterface $account) {
  // List of webform ids and authorization codes.
  $webform_authorization_codes = [
    'contact' => 'secretcode',

  // Get the current webform.
  /** @var \Drupal\webform\WebformRequestInterface $request_handler */
  $request_handler = \Drupal::service('webform.request');
  $webform = $request_handler->getCurrentWebform();
  if (!$webform) {
    return \Drupal\Core\Access\AccessResult::neutral();

  // Get the webform id.
  $webform_id = $webform->id();
  if (!isset($webform_authorization_codes[$webform_id])) {
    return \Drupal\Core\Access\AccessResult::neutral();

  // Get get the code.
  $code = \Drupal::request()->get('code');
  if (empty($code)) {
    return \Drupal\Core\Access\AccessResult::neutral();

  // If 'submission_page' (aka create) and authorization code is correct,
  // then grant access.
  if ($operation === 'submission_page' && $code === $webform_authorization_codes[$webform_id]) {
    return \Drupal\Core\Access\AccessResult::allowed();
  else {
    return \Drupal\Core\Access\AccessResult::neutral();
  • yep what @jrockowiz said ^
    – taggartJ
    Jan 10, 2019 at 0:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.