Secret Key Mint mints custom physical coins — "Keys" — that carry a QR code pointing at infrastructure we operate. That single layer of indirection is the entire product. A printed QR code is a promise you cannot keep: the link dies, the campaign ends, the company rebrands, and the object becomes litter. A Key's destination is a row in a database, so the coin in someone's hand can be repointed years after it was struck.

Works forever, by design

The hard part of selling a permanent object is what happens when the customer relationship ends. The answer here is a deliberate one: a slug marked minted — meaning a physical coin exists that carries it — can never hard-404. Forwarding is free and permanent. The monthly fee buys powers: scan metrics, self-serve repointing, custom branding on the resting page. Let it lapse and the coin degrades gracefully to a branded resting page that still logs the scan; it never becomes a dead link. The whole decision is a single pure function with unit tests around it, because it is the one behaviour that would betray a customer holding metal.

The QR designer that refuses to lie

• A scan-verify gate. Export is blocked until the rendered code is decoded back — BarcodeDetector where the browser has it, a jsQR fallback where it does not. A styled QR that renders beautifully and does not scan is the single most expensive mistake available in this business, because you only discover it after a thousand coins are struck.
• Engrave and print modes — different module shapes, gradients, and quiet-zone handling for laser-engraved metal versus ink on paper.
• Forced error correction H whenever a logo is embedded, so the mark cannot eat the payload.
• SVG plus 2048px PNG export, archived to object storage as the artefact of record for that coin run.

A business, not a link shortener

• Scan analytics per slug — asynchronous logging off the redirect hot path, bots and dry-run test scans excluded from the counts, CSV export.
• Funnel to customer to invoice. Quote requests arrive with attachments (sniffed server-side, disk authoritative, mirrored to object storage), thread themselves by email address, and promote into customer records that carry their whole history.
• Products and invoices with cents-based pricing and frozen unit prices on issued lines, so editing a price list never rewrites history.
• A client portal where a customer sees their own Keys, repoints them, and reads their own scan metrics — gated by entitlement, with no self-registration anywhere in the system. Access is granted, never claimed.
• Email both directions — Postmark outbound, plus a token-gated inbound webhook that files replies into the admin inbox.

How it's built

One Go binary and one SQLite file in WAL mode. Rendering is html/template; the front end is hand-written CSS and JavaScript with no framework, no bundler and no node_modules in the serving path. Migrations are additive-only — columns are never rewritten or dropped, because a coin struck last year still has to resolve. Deployment is a systemd unit behind Apache on a single host; just ship runs the tests, builds, restarts and health-checks it.

The codebase enforces its own conventions in CI: files stay under 150 lines and functions under 30, a headless browser harness probes every admin page for console errors and axe-core accessibility failures, and a static gate scans the whole tree for words that must never appear in anything a client could see.