Méthodo
A tutoring platform I develop end to end: web app, independent API and Expo mobile app. Bookings, payments and teacher transfers require traceable financial operations that can be retried without duplicate charges.
Connecting students, teachers and administrators while keeping data, money and permissions consistent.
The Next.js web app and Hono /api/v1 API run as separate Docker services. They share business services and a Prisma/PostgreSQL schema. The Expo app consumes the public API. On AWS, Traefik handles HTTPS, RDS hosts the database and S3 stores documents accessed through signed URLs.
Shared business logic, several interfaces and checks at every boundary.
The versioned API uses Zod contracts, OpenAPI documentation and JWT authentication with refresh tokens for mobile. The web retains NextAuth. All three roles are checked on the server. Database migrations run in a dedicated container.
Web · API · mobile
Next.js, Hono and Expo live in one repository. Web and API run as separate services; mobile consumes the same business resources.
PostgreSQL · Prisma
Bookings, availability, users, invoices and wallets are connected entities. WalletTransaction keeps an auditable ledger and balance after each entry.
API security
Identity comes from the session or JWT, with access controls, Zod validation, cursor pagination and idempotency keys for financial writes.
Stripe and Stripe Connect handle wallet top-ups, bookings, refunds and teacher transfers. Signed webhook events are checked so a replay cannot create a second ledger entry.
Top up
Parents fund their wallet; an automatic shortfall top-up can cover the balance missing from a booking.
Book
Database transactions protect the balance and time slot. Idempotency keys and locks prevent duplicate debits and bookings.
Reconcile
Signed webhooks finalize top-ups. The ledger supports auditing of payments, refunds, failures and adjustments.
Transfer
Stripe Connect handles teacher payouts; invoices and tax documents have a separate flow. Compliance work is ongoing.
A successful Stripe payment is only part of the story: the database entry, permissions and webhook replay must all be accountable.
The product is evolving. The mobile app and some compliance flows are still under review; built components are distinct from flows validated in real conditions.