The key is only useful to the first device that gets it. It's generated for each transaction and only valid once. The devices (let's say two phones) communicate directly and once that's done, the connection closes. To add another device, the phone weill generate a new key and a new QR code.
