Work

Age-verified unattended retail — BankID to hardware unlock

A platform that gates age-restricted vending machines behind Swedish BankID: the customer scans a QR code, verifies their age, and the machine physically unlocks. Admin console, kiosk fleet and mobile flow — one API.

.NET 8 · Blazor WebAssembly · Electron · Raspberry Pi · SignalR · Azure SQL

Context: Swedish law restricts who may buy certain goods. An unattended vending machine has no cashier to check ID — so selling age-restricted products through one requires verification at least as strong as a human check, with proof it happened.
Problem: Connect a legally valid identity check to a physical lock: from a QR scan on the customer’s phone, through BankID age verification, to a relay pulse that opens one specific machine — and nothing else.
Constraints: Hardware in the field on cellular networks: kiosks must be offline-first and remotely updatable without site visits. A QR code must be impossible to relay to someone standing elsewhere. Every unlock needs an audit trail.
Role: Sole developer across three major platform versions — API, admin console, kiosk client and mobile flow.
Architecture: One ASP.NET Core API serving three surfaces: a Blazor WebAssembly console where operators manage machines, GPIO configuration and fleet health; offline-first Electron kiosks on Raspberry Pi reacting to SignalR commands; and an anonymous, GPS-gated mobile unlock page. BankID verification runs through a certified identity gateway; on success the backend pushes an unlock command over SignalR that pulses a GPIO relay. Azure SQL keeps the audit trail; kiosk auto-updates ship from blob storage with SHA-256 integrity checks.
Key decisions: A GPS proximity gate — the phone must be within metres of the machine before a verification session starts, so QR codes cannot be shared remotely. Per-machine JWTs with silent renewal instead of shared device credentials. Signed, hash-verified auto-updates so the fleet is patched without site visits. Pulse patterns are configurable per machine, because real vending hardware disagrees about what an “unlock signal” is.
Outcome: Three major platform versions shipped; the third unified the admin console, kiosk fleet and mobile unlock under a single API. Fleet size and usage figures are the operator’s and are not published here.
Evidence: Private repositories; sole authorship verifiable from commit history across all versions. References available on request.
Confidentiality: Described at domain level only — the platform and its operator are not named here.