Denthinkers
A live nonprofit platform built with the team across backend and frontend. The donation module and admin authentication were my main pieces.
Money and access, on a platform a charity has to trust
Two parts of this carry real consequence. Donations move actual money, so the site has to be certain a payment succeeded before it records one — and a client can claim anything. The admin side controls what the public sees, so the authentication behind it has to hold up without a dedicated ops team maintaining it.
the calls that mattered
Decisions
- 01
Confirm payments on cryptographic proof, not the client's word
Razorpay orders are created server-side, and the callback signature is verified with HMAC on the server before a donation is written. That means a donation record exists only when the payment gateway's own signature proves it happened. A forged success response from the browser changes nothing.
- 02
Cookie-based JWT admin auth behind middleware
Admin sessions use httpOnly cookies on a 7-day expiry, with the admin routes gated in middleware rather than checked per page. Putting the check at the edge means a new admin route is protected by default instead of protected only if someone remembers to add the guard.
- 03
A draft and publish workflow that survives collisions
The CMS lets the team write without publishing, and handles slug collisions explicitly rather than letting a second article with the same title quietly overwrite the first or fail at the database layer.
what came out
Outcome
- ₹1.5L+ in verified donations processed to date
- 2.5K+ monthly visits sustained on the live site
- 15 API route handlers across 23 endpoints, built with the team
Built with
- Next.js
- React
- TypeScript
- MongoDB
- Razorpay
- JWT