Secret Key Mint

Secret Key Mint mints custom physical coins — "Keys" — that carry a QR code pointing at infrastructure we operate. That single layer of indirection is the entire product. A printed QR code is a promise you cannot keep: the link dies, the campaign ends, the company rebrands, and the object becomes litter. A Key's destination is a row in a database, so the coin in someone's hand can be repointed years after it was struck.

Works forever, by design

The hard part of selling a permanent object is what happens when the customer relationship ends. The answer here is a deliberate one: a slug marked minted — meaning a physical coin exists that carries it — can never hard-404. Forwarding is free and permanent. The monthly fee buys powers: scan metrics, self-serve repointing, custom branding on the resting page. Let it lapse and the coin degrades gracefully to a branded resting page that still logs the scan; it never becomes a dead link. The whole decision is a single pure function with unit tests around it, because it is the one behaviour that would betray a customer holding metal.

The QR designer that refuses to lie

• A scan-verify gate. Export is blocked until the rendered code is decoded back — BarcodeDetector where the browser has it, a jsQR fallback where it does not. A styled QR that renders beautifully and does not scan is the single most expensive mistake available in this business, because you only discover it after a thousand coins are struck.
• Engrave and print modes — different module shapes, gradients, and quiet-zone handling for laser-engraved metal versus ink on paper.
• Forced error correction H whenever a logo is embedded, so the mark cannot eat the payload.
• SVG plus 2048px PNG export, archived to object storage as the artefact of record for that coin run.

Artwork a die sinker can cut

The browser designer shows an operator what a coin will look like; the file a bench actually works from is generated server-side and measured in millimetres. User units in the exported SVG are millimetres, so "how wide is a module" is answered by clicking it in a drawing program rather than by trusting us. Every module is a closed subpath, and horizontal runs are merged into single rectangles — identical geometry, roughly a tenth of the nodes, fewer places for a CAM import to round something off. Below 0.80 mm per module the panel is refused rather than flagged: enamel sitting in a struck recess is not ink on paper, and a code that passes on a proof sheet is a thousand unscannable coins in a box.

The payload comes from one builder — HTTPS:// plus the domain and slug in upper case, because a bare domain scans as search text on a real phone — with the domain threaded from config and hardcoded nowhere. Nothing leaves the toolchain undecoded: every ordered panel is read back at 3 px per module, and the composite build refuses to leave a file on disk it could not itself scan. The admin Key page renders the same payload as a coin that spins and dwells face-on so a phone can read it off the screen; clicking holds it still.

A business, not a link shortener

• Scan analytics per slug — asynchronous logging off the redirect hot path, bots and dry-run test scans excluded from the counts, CSV export.
• Funnel to customer to invoice. Quote requests arrive with attachments (sniffed server-side, disk authoritative, mirrored to object storage), thread themselves by email address, and promote into customer records that carry their whole history.
• Products and invoices with cents-based pricing and frozen unit prices on issued lines, so editing a price list never rewrites history.
• A client portal where a customer sees their own Keys, repoints them, and reads their own scan metrics — gated by entitlement, with no self-registration anywhere in the system. Access is granted, never claimed.
• An image studio behind a hard cap. Generation runs through a small registry of providers, and no paid call happens without checking the spend ledger against a budget ceiling — a malformed ceiling falls back to the default, never to unlimited; failed calls are recorded at zero; free models keep working after the cap is reached. Output is pulled off the provider's expiring CDN link immediately into a bucket with public access prevention enforced, addressed by a key derived from its ledger id so no request path ever lists the bucket.
• Email both directions — Postmark outbound, plus a token-gated inbound webhook that files replies into the admin inbox.

How it's built

One Go binary and one SQLite file in WAL mode. Rendering is html/template; the front end is hand-written CSS and JavaScript with no framework, no bundler and no node_modules in the serving path. Migrations are additive-only — columns are never rewritten or dropped, because a coin struck last year still has to resolve. Deployment is a systemd unit behind Apache on a single host; just ship runs the tests, builds, restarts and health-checks it. Client IP is read from the hop the proxy wrote — the last X-Forwarded-For entry — rather than the first, which a caller writes, so the rate limiters cannot be opted out of from outside.

The codebase enforces its own conventions in CI: files stay under 150 lines and functions under 30, a headless browser harness probes every admin page for console errors and axe-core accessibility failures, and a static gate scans the whole tree for words that must never appear in anything a client could see. A test reads the route table out of the entrypoint and fails the build if any admin route is missing its session check.