All work
01Case study

NFC-Enabled Artwork Platform

A multi-application platform connecting physical artworks to secure digital records through NFC, enabling authenticity checks, provenance, ownership, subscriptions, auctions and scan analytics.

  • Go
  • PostgreSQL
  • Nuxt
  • Vue
  • React Native
  • NTAG 424
  • AES/CMAC
  • Stripe
  • AWS S3
NFC-enabled artwork platform showing a verified physical artwork scan
02Challenge

The problem

Physical artwork carries identity, ownership, exhibition and sale history, but that context is often disconnected from the object. A trustworthy platform needed more than a static tag URL: it had to bind secure NFC hardware to the correct record, verify dynamic scan data and preserve the artwork lifecycle around it.

  • Bind each physical tag to the correct artwork or user record
  • Distinguish public, private, modifier and VIP interactions
  • Verify dynamic tag data instead of trusting a static identifier
  • Detect stale or replayed scan counters through backend state
  • Support tamper-capable tag variants and encrypted redirects
  • Give operators a practical, trusted provisioning workflow
  • Preserve artwork, collector, exhibition, scan and sale history
  • Keep payment credentials and media outside the application database
03Solution

How it was solved

The system separated trusted physical provisioning, focused cryptographic validation, business logic and presentation across four applications. An Android-focused reader/writer programmed tags; a stateless Go gateway verified scan data; the main Go backend owned users, artwork, scan state and commerce; and a Nuxt/Vue web app delivered public discovery and role-aware administration.

04Evolution

Delivery path

  1. 01 · Create the record

    An artwork and its ownership record are established in the backend before physical provisioning begins.

  2. 02 · Provision tags

    An authorized operator uses the React Native app to program public/private NDEF data, Secure Dynamic Messaging configuration and key material.

  3. 03 · Bind identity

    Per-tag keys and the physical UID are associated with the artwork or eligible VIP user record.

  4. 04 · Tap artwork

    A collector or visitor taps the public tag, which emits dynamic PICC data, scan counter, CMAC and optional tamper state.

  5. 05 · Verify scan

    The verification gateway fetches tag keys and backend scan state, validates cryptographic data and rejects stale or replayed counters.

  6. 06 · Record activity

    The backend stores the validated scan with geographic and artwork context for history, dashboards and analytics.

  7. 07 · Route visitor

    An encrypted redirect sends the visitor to the appropriate mobile artwork, artist or scan-result experience.

  8. 08 · Manage lifecycle

    Authorized users manage ownership, exhibitions, auctions, subscriptions, tag requests, referrals and operational analytics.

05Architecture

Platform topology

The split keeps Android NFC transport and low-level cryptography out of the public web UI and broader business API. The verification gateway remains focused and stateless while the backend owns authorization, scan counters, commerce and persistence.

Authorized operator ──► React Native Reader/Writer
                           ├─ artwork + user APIs ──► Go Backend
                           └─ NDEF / SDM / keys ──► NXP NTAG 424

Collector / visitor ──tap──► NXP NTAG 424
                           └─ UID / PICC / counter / CMAC / tamper
                                └─► Go Verification Gateway
                                      ├─ tag keys + scan state ──► Backend
                                      └─ encrypted redirect ──► Web App

Nuxt/Vue Web App ──cookie-authenticated REST──► Go Backend
Go Backend ──► PostgreSQL / S3 / Stripe / SendGrid
           └─► Instagram Graph API / HubSpot
06Product

Product surface

  • Public visitor

    Discover artists and artworks, tap a public tag, see scan validity and view artwork, artist, collector, location and medium details

  • Artist or keyholder

    Manage profiles, artwork, collectors, modifiers and tags; review scans and control visibility under subscription permissions

  • Collector

    Receive ownership transfers before account creation, reconnect records by email and participate in auction/payment workflows

  • Administrator

    Manage users, roles, artworks, collectors, tags, subscriptions, permissions, auctions and audit logs

  • Provisioning operator

    Select environments, find artworks or VIP users, write public/private/VIP tags and inspect UID, NDEF, host and tamper state

  • Bidder

    Place and confirm bids by time-limited email, attach a Stripe payment method and pay only after a winning auction concludes

07Engineering

Technical highlights

  • Dynamic NFC verification

    The Go gateway validated NTAG 424 Secure Dynamic Messaging data using tag-specific keys, UID, dynamic PICC data, counters and CMAC rather than treating a static NFC URL as proof.

  • Replay-aware scan state

    Backend state tracked counters and public/private tag relationships so stale, duplicated or replayed scans could be identified alongside tamper-capable variants.

  • Trusted tag provisioning

    The Android React Native application gave authorized operators a practical interface for programming NDEF records, SDM settings and key material across public, private and VIP tag types.

  • Ownership & provenance

    Artwork, collectors, modifiers, exhibitions, transfers, scan history, sale history and audit logs formed a durable record around the physical object.

  • Commerce lifecycle

    Auctions, bid confirmation, payment authorization, settlement, royalties and sale history were integrated with Stripe and Stripe Connect workflows.

  • Role-aware platform

    Cookie-authenticated APIs and role handling supported superadmin, admin, keyholder and VIP experiences across public discovery and administration.

08Integrations

Connected systems

  • NXP NTAG 424

    Physical NFC identity with Secure Dynamic Messaging, per-tag key material, dynamic scan counters, CMAC validation and supported tamper state.

  • Stripe & Stripe Connect

    Hosted subscription checkout, signed webhooks, bidder payment methods, auction settlement, artist onboarding, balances, transfers and withdrawals.

  • AWS S3

    Artwork/profile media and database-backup storage remained outside the relational application database.

  • SendGrid

    Transactional email supported verification, ownership transfer, bid confirmation and other platform notifications.

  • Instagram Graph API

    OAuth, token refresh, media retrieval and profile information extended artist discovery and public profiles.

  • HubSpot

    Support contact and ticket integration connected platform users to operational support workflows.

09Scope

What the team delivered

  1. Designed the PostgreSQL data model

  2. Developed the Go business API and domain workflows

  3. Built a dedicated Go verification gateway using NTAG 424 DNA capabilities

  4. Created a React Native Android app for trusted NFC tag provisioning

  5. Connected public and administrative Nuxt/Vue experiences to the platform

  6. Supported ownership, auctions, subscriptions, payments and scan analytics

10Services

Repos & services

Anonymized service family across the platform.

ServiceResponsibilityStack
Core Platform APIUsers, artwork, ownership, authorization, scan state, auctions, subscriptions, payments and persistenceGo, Gin, GORM, PostgreSQL
Public & Admin Web AppPublic discovery, scan results and role-aware administrative experiencesNuxt, Vue, REST APIs
Tag Provisioning AppTrusted public/private/VIP tag provisioning and Android NFC communicationReact Native, Android NFC, NXP NTAG 424
Verification GatewayStateless cryptographic scan verification and encrypted visitor redirectsGo, AES/CMAC, backend API integration
11Outcomes

Results that matter

  • Connected physical artwork tags to cryptographically checked digital records

  • Delivered a complete flow from trusted provisioning through validation, scan history and mobile artwork experiences

  • Supported provenance, ownership transfer, exhibitions, auctions, subscriptions and payout workflows around each artwork

  • Equipped operators with Android NFC tooling and administrators with role-aware operational controls

  • Established scan analytics, dashboards, geographic context and most-scanned reporting

Audited local history spans June 2023–July 2026. Backend inspection found 99 active API routes, 17 router domains, 20 controllers, 24 migrated GORM models, 95 Go source files and 214 commits.

Secure physical-digital identity, NFC provisioning, cryptographic verification, provenance workflows, mobile development and commerce platforms.

12Boundaries

Scope & caveats

These implementation boundaries keep the public description technically honest.

  • A separate nearby NFC application repository was reviewed but excluded because the checked-out code did not provide enough evidence that it belonged to this product.
  • The checked-in Swagger document covered only a subset of active API routes and should not be presented as a complete contract.
  • The suggested Full-stack and NFC systems engineer title was not applied because exact role ownership still needs confirmation.
13Visuals

Product visuals

NFC tag provisioning and cryptographic verification workflow
Artwork provenance, ownership and scan-history experience
14More work

Related experience

View all work

Related Peerprise services

15Next step

Need similar technical experience applied to your requirement?

Discuss a Software ProjectDiscuss a Partnership