Eknas
A loyalty card and reward points app for cafés, salons, gyms and shops in Nepal.
Paper punch cards get lost and stamps get faked, and the big loyalty apps were made for chains that price in dollars and own a POS. Eknas is a loyalty program a small Nepali shop can set up the same day on a phone it already has.
The problem
Small cafés, restaurants, salons and gyms in Nepal want regulars to come back, but their options are poor. Stamp cards are easy to copy. International loyalty platforms charge in dollars and assume a point-of-sale system that a neighbourhood café does not have.
A shop also cannot afford fraud at the counter: staff giving points to friends, the same reward redeemed twice, or a bill recorded twice when the network drops.
What I built
Eknas has four parts. Customers get a free wallet that holds a card for every shop they visit. Staff get a counter app that finds a member by phone number and records a bill. Owners get a dashboard with offers, automatic messages and analytics by branch and staff. A super admin manages plans and billing.
Customers earn one point for every rupee. Rewards are claimed with a short one-time code, and every action at the counter is logged against the staff member who did it.
What it does
At the counter
- Find a member by mobile number or scan their rotating QR code
- Reward codes of 6 characters with no look-alike letters, valid for 15 minutes and usable once
- Bills above a shop's limit need a second confirmation
- Cashiers see masked phone numbers and no birthdays
For owners
- Points programs and stamp cards, with double-points days on higher plans
- Automatic birthday, almost-there, expiring-reward and win-back messages
- Analytics by branch and by staff member
- Managers can void a bill within 7 days, with a full log
For customers
- One free account holds every shop's card
- Points above the goal carry over
- Ready rewards stay valid for 90 days by default
- If a shop stops its program, customers get at least 30 days to redeem
Plans and billing
- Starter NPR 799, Growth NPR 1,999 and Pro NPR 4,999 per location per month
- 13% VAT included, with a VAT invoice carrying the shop's PAN
- A 3-day free trial on every plan
- Payment by eSewa, Khalti, Fonepay or bank QR
How it's built
| Framework | Next.js (App Router), React, TypeScript |
|---|---|
| Data | PostgreSQL with Prisma |
| API | REST, documented with OpenAPI 3.1; bearer secret keys stored only as keyed hashes |
| Webhooks | HMAC-SHA256 signatures, 5-minute tolerance, public HTTPS targets only |
| Security | Nonce-based CSP with strict-dynamic, HSTS with includeSubDomains, CSRF cookie, X-Frame-Options DENY |
| Edge | Served through Cloudflare |
Eknas is a Next.js application with PostgreSQL behind Prisma. The customer wallet, counter app, owner dashboard and super admin share one codebase and one permission model, so a cashier, a manager and an owner see different data from the same screens.
The public API lets a POS, an online checkout or a shop's own app record bills and redeem rewards. It is described in an OpenAPI 3.1 file that developers can import into Postman or a code generator.
Engineering highlights
A QR code that cannot be screenshotted and reused
The member QR in the app changes every 30 seconds and each code is valid for 60 seconds. The code carries a signature, so a forged or edited code is rejected. The API still accepts a scanned code for 10 more minutes, so a shop can scan first and take payment after.
Bills that are recorded exactly once
Recording a bill or a redemption requires an Idempotency-Key. If the network drops and the till retries, the second request returns the original result with duplicate: true. Reusing a key for a different bill returns a clear 409 error. Points cannot be doubled by a bad connection.
An API built to be safe by default
Keys have 7 permission scopes, voiding is off by default, and each key can have an IP allowlist and an expiry. Browser requests are refused outright, because secret keys belong on servers. Webhooks are signed with HMAC-SHA256 and are only delivered to public HTTPS addresses, never to private or local networks.
Privacy for customers
The API returns a customer's first name and initial, and only the last three digits of their phone. A phone lookup for a number outside the business returns 404, so nobody can test numbers to find out who uses Eknas.
SEO & performance
Every public page carries structured data: SoftwareApplication with offers on the home page, BusinessAudience on the business pages, TechArticle and WebAPI on the developer docs, and LocalBusiness on each shop's public page. A full Nepali version lives under /ne with hreflang for en-NP and ne-NP.
Screens
Where it stands
Eknas is live at eknas.com with public pricing, a Nepali version and published developer documentation. Shops can start a free trial without talking to anyone.
It is the clearest example of how I approach business software: model the real counter, make fraud expensive, make retries harmless, and document the API so other developers can build on it.
Planning a product like Eknas? I design, build and launch web apps for businesses in Nepal and abroad.