diff --git a/backend/time_tracking/views.py b/backend/time_tracking/views.py
index 6cedf9c..c49510c 100644
--- a/backend/time_tracking/views.py
+++ b/backend/time_tracking/views.py
@@ -37,10 +37,12 @@ class TimeEntryScanView(APIView):
     permission_classes = [IsAuthenticated]
 
     def post(self, request):
-        code = request.data.get('code')
-        if code == config('SECRET_POINTAGE_ENTER', default=''):
+        code = str(request.data.get('code') or '').strip()
+        enter_code = config('SECRET_POINTAGE_ENTER', default='').strip()
+        exit_code = config('SECRET_POINTAGE_EXIT', default='').strip()
+        if code == enter_code:
             action = 'enter'
-        elif code == config('SECRET_POINTAGE_EXIT', default=''):
+        elif code == exit_code:
             action = 'exit'
         else:
             return Response({'error': 'QR code de pointage invalide.'}, status=status.HTTP_400_BAD_REQUEST)