Digital Membership Platform with Real-Time QR Verification & Subscription Management
Key Results
Project Overview
A comprehensive, role-based digital membership platform built for modern businesses and their members. The system features a dynamic QR membership card that rotates every 30 seconds for security, Stripe-powered subscription billing, real-time business scanner verification, and a full-featured admin dashboard — all within a single unified codebase for iOS, Android, and Web.
The Challenge
The client came to us with a clear vision but a deeply fragmented operational reality. Their membership network was running on a combination of physical cards, manual spreadsheets, and disconnected tools — creating problems at every layer of the business.
1. No Secure or Reliable Membership Verification at Point of Service
Businesses accepting memberships had no reliable way to verify whether a customer's membership was actually active at the moment of redemption. Physical cards could be shared, photocopied, or used by non-members without any detection. There was no real-time check happening — merchants simply trusted what they were shown. This created widespread membership fraud and eroded trust between the platform, its paying members, and its business partners.
2. Static QR Codes Were Easily Exploited
A previous attempt at digitizing the card involved generating a basic QR code that was saved as an image by members and shared freely in group chats and family messages. Since the QR never changed and was never validated against a live server, it was functionally useless as a security measure. Screenshot sharing meant one paid membership was effectively being used by dozens of people — directly killing subscription revenue.
3. Subscription Billing Was Entirely Manual
There was no automated subscription system in place. Members paid via bank transfer or cash, and someone on the admin team manually updated a spreadsheet to mark a membership as active or expired. This created constant delays, billing disputes, missed renewals, and no reliable way to lock access when a payment failed. Expired members continued to receive benefits because no one had updated the sheet yet. The administrative burden was unsustainable as the member base grew.
4. Three User Types With Completely Different Needs — No Unified System
The platform served three fundamentally different groups: paying members who needed a digital card and access to deals, business partners who needed to verify memberships quickly at a counter, and a platform admin team that needed to manage everything. Each group was using a different tool — a WhatsApp group for deal announcements, a shared Google Sheet for member records, and nothing at all for businesses beyond a phone call to check validity. There was no unified product, no consistent experience, and no scalable foundation.
5. Admins Had No Operational Visibility
The admin team had no dashboard, no analytics, and no real-time data. They could not see how many active members they had at any given moment, how much revenue was coming in, which businesses were scanning most frequently, or which members had payment issues. Making business decisions required manually compiling data from multiple disconnected sources — a process that was slow, error-prone, and completely impractical at scale.
6. No Self-Service for Members
Members had no portal, no app, and no way to manage anything themselves. Checking membership status, updating payment details, viewing deal terms, or finding business locations all required contacting the admin team directly. This created a high support burden and a poor member experience that was actively discouraging renewals.
7. Scalability Was Impossible With the Existing Setup
The entire operation was held together by manual effort. As the client planned to scale — adding more member tiers, more business partners, and expanding to new cities — it became immediately clear that the existing setup would completely collapse under growth. There was no technical foundation capable of supporting what they wanted to build.
Our Solution
We approached this project as a full product build — not just a technical delivery. We mapped every user journey, identified every failure point in the existing system, and designed a unified platform that addressed each problem at its root. The result was a single, cohesive product serving three user roles across iOS, Android, and Web — built on a secure, real-time, scalable infrastructure.
1. Unified Role-Based Architecture
The first decision we made was to build one unified application with role-based access control rather than three separate products. When a user logs in, the system identifies their role — Member, Business Scanner, or Admin — and routes them to a completely different interface within the same codebase. This eliminated fragmentation, reduced maintenance overhead, and ensured that all three user types were working from the same live data source at all times.
Firebase Authentication handled user identity and session management securely. Firestore security rules enforced role-based data access at the database level, meaning a business scanner could never access member financial data, and a member could never access admin controls — not through the UI, and not through a direct API call.
2. Dynamic QR Security Engine — The Core of the Platform
This was the most technically critical component of the entire build, and we invested significant architectural thought into getting it right.
Every active member's card displays a QR code that is cryptographically regenerated every 30 seconds. The QR does not contain static membership information — it contains a short-lived signed token that is mathematically tied to the member's ID and the current timestamp. When a business scanner reads the QR, the app does not attempt to decode it locally. Instead, it sends the raw token to our Node.js backend for server-side validation.
The backend performs several checks in sequence: it verifies the cryptographic signature, confirms the token was generated within the last 30 seconds, checks the member's current subscription status in Firestore, and confirms the token has not already been used (replay protection). Only when all checks pass does it return a success response. If any check fails — whether the token is expired, the membership is locked, or the token has already been scanned — it returns a detailed failure response.
This architecture made screenshot sharing completely useless. A screenshot taken 31 seconds ago produces an expired token. A token sent over WhatsApp and scanned by someone else is rejected by the replay protection layer. The security model is sound even against technically aware bad actors.
Rate limiting was added at the API level to prevent brute-force token guessing, and all tokens are invalidated immediately if a member's account is locked due to payment failure.
3. Stripe Subscription Lifecycle — Fully Automated
We integrated Stripe as the complete payment and subscription engine. Members choose between a monthly or annual plan during onboarding and complete payment through a Stripe Checkout session. From that point forward, the entire subscription lifecycle is managed automatically through Stripe webhooks connected to our Node.js backend.
We built webhook handlers for every critical event in the subscription lifecycle. When a payment succeeds, the backend immediately updates the member's status to Active in Firestore, which propagates in real time to their membership card. When a payment fails, the membership status is set to Locked within seconds of Stripe sending the failure event — the QR becomes invalid, the card shows a locked state, and the member receives an email and push notification with instructions to update their payment method. When a member cancels, their status remains Active until the end of the current billing period, after which an automated expiry process marks the card as Expired. No human intervention is required at any stage.
Grace period behavior was implemented for payment failures — members receive a short window to resolve billing issues before the lock is applied, reducing involuntary churn without compromising platform integrity.
4. Member Portal — Premium Mobile Experience
The member-facing app was designed with a fintech-inspired aesthetic using a Deep Indigo and Electric Cyan palette, Inter typography, and glassmorphism card effects. The goal was for the digital membership card to feel as premium and credible as a high-end physical card — something members would feel proud to show at a business.
The membership card screen is the home screen for members. It displays their name, profile photo, current membership status with a clear visual indicator (Active in green, Locked in red, Expired in grey), and the live rotating QR code with a 30-second countdown timer so members always know when the next rotation is happening.
Beyond the card, members can browse the full deals and locations directory — searching and filtering businesses, viewing deal terms and validity windows, and checking location addresses and opening hours. Profile management, subscription status, payment history, and invoice access are all available through a clean self-service portal that eliminated the support burden on the admin team.
Push notifications are delivered for payment reminders before renewal dates, failed payment alerts, expiry warnings, and new deal announcements — keeping members engaged and informed without requiring them to open the app.
5. Business Scanner Interface — Fast, Clear, Reliable
The business scanner interface was designed around one principle: a business owner or staff member standing at a counter needs an instant, unambiguous answer. There is no room for confusion or slow loading.
When a business user opens the scanner, the camera activates immediately. Scanning a QR code triggers the server-side validation in real time. The result screen is deliberately bold and binary: a full-screen green display showing the member's name and photo on success, or a full-screen red display with a clear reason (Expired, Locked, Invalid Token) on failure. The large member photo displayed on success adds a crucial identification layer — the business can confirm the person presenting the card matches the member on file.
Every scan is automatically logged to Firestore with a timestamp, the member's ID, the business location, and the result status. Businesses can view their complete scan history, filtered by date range or member, giving them an audit trail for reconciliation and reporting.
6. Admin Dashboard — Complete Operational Control
The React web admin dashboard was built as the operational nerve centre of the entire platform. We structured it around the core workflows the admin team performs daily.
The analytics overview gives a real-time snapshot of total members, active versus inactive breakdown, monthly and annual revenue figures pulled directly from Stripe, scan volume over time, and membership growth trends displayed in clean charts. This alone replaced hours of weekly manual reporting.
Member management allows admins to search and view any member profile, see their full subscription history and payment events, and apply manual status overrides — activating, deactivating, or locking a card directly from the dashboard. Payment failure investigation is streamlined with a clear view of the Stripe event timeline for each member.
Business management covers the full business onboarding workflow — creating business profiles, adding multiple locations with addresses and hours, creating and managing deals with validity windows and active/inactive status, and creating business scanner accounts with controlled access. Admins can disable a business scanner account instantly if needed.
The reporting module allows CSV export of the full member list, business directory, and scan history — filtered by date range, status, or business — giving the admin team clean data for external reporting and compliance needs.
The Results
The platform launched as a complete operational replacement for the client's manual system. The impact was immediate and measurable across every dimension of the business.
1. Membership Fraud Eliminated Completely
From the day of launch, screenshot sharing and card sharing became technically impossible. The 30-second rotating QR token with server-side replay protection meant that any attempt to reuse a token — regardless of how it was obtained — resulted in an immediate rejection at the scanner. The client reported zero successful fraudulent redemptions since launch, compared to an estimated 30–40% of redemptions being from non-paying users under the old system. This alone represented a significant direct revenue recovery.
2. Subscription Revenue Became Fully Automated and Predictable
Every payment event — success, failure, renewal, cancellation — is now handled automatically without any admin involvement. The client's team went from spending several hours per week managing billing manually to zero time on subscription administration. Failed payment recovery improved significantly because members received instant automated notifications with a direct link to update their payment method, rather than hearing nothing and simply letting the membership lapse. Involuntary churn dropped as a direct result.
3. Member Experience Transformed
Members moved from having no digital presence to having a premium, polished membership card they could show with confidence. The self-service portal meant that common queries — "is my membership active?", "when does it renew?", "what deals are available near me?" — were answered within the app without contacting support. The admin team reported a dramatic reduction in routine support messages within the first few weeks of launch.
4. Business Partners Gained Confidence in the System
Before the platform, business partners had no reliable verification method and frequently expressed frustration about the membership program. After launch, the scanner interface gave them an instant, clear, trustworthy answer every single time. The green/red result screen with the member photo became the standard operating procedure at every partner location. Businesses also gained access to their scan history for the first time, which they used for their own reporting and to confirm redemption volumes with the admin team.
5. Admin Team Gained Full Real-Time Visibility
The analytics dashboard gave the admin team live data they had never had access to before. For the first time, they could see exactly how many active members they had at any moment, which businesses were performing highest scan volumes, how revenue was trending month-over-month, and which members had payment issues requiring follow-up. Decision-making shifted from guesswork to data — new business partnerships were evaluated based on scan activity data, and marketing campaigns were timed around renewal cycle data visible in the dashboard.
6. Platform Ready to Scale Without Operational Overhead
Perhaps the most strategically significant result: the platform is now built on infrastructure that can scale to tens of thousands of members without any increase in operational overhead. Firebase's real-time architecture handles concurrent connections efficiently, Stripe manages all billing complexity automatically, and the admin dashboard gives a small team full control over a large, growing network. The client can now expand to new cities, onboard new business partners, and launch new deal campaigns — all without hiring additional operations staff.
7. Single Codebase Reduced Long-Term Costs
By delivering iOS, Android, and Web from a unified codebase with a shared backend, the client's ongoing maintenance and feature development costs are significantly lower than if three separate products had been built. Future updates — new deal types, additional subscription tiers, new admin reporting features — are built once and deployed everywhere simultaneously.
The platform completely transformed how our members interact with our network. The rotating QR card looks premium, our business partners love the instant scanner, and our admin team finally has full control in one place. The Stripe integration worked flawlessly from day one — subscriptions, failures, cancellations — everything just works automatically.
Related Case Studies
Explore more success stories from our portfolio
Ready to Create Your Success Story?
Let's discuss how we can help you achieve similar results for your business