19.09.2026

Case Studies

Case Study :: Story Gym – 24/7 Gym Access App with QR Turnstile and Card Payments

Case Study :: Story Gym – 24/7 Gym Access App with QR Turnstile and Card Payments

READING TIME: MIN

Table of Content

Not every project we ship lives in a browser tab. For Story Gym – a 24/7 fitness club in Pazardzhik, Bulgaria – we built the software that lets a member buy a pass with a bank card and walk through a physical turnstile with nothing but their phone.

No reception desk, no plastic cards, no opening hours. The member opens the Story Gym app, taps “Show code”, holds a rotating QR code to the reader, and the turnstile opens – if, and only if, that person has a valid pass at that moment.

This case study covers the whole system: the member portal and mobile app, the card payment flow, the access-control service that talks to the turnstile hardware, and the engineering decisions that keep a door working when things go wrong.

Project Overview

Story Gym wanted to run an unstaffed gym. That means every step a receptionist would normally handle – selling a pass, checking it, letting the person in, logging the visit – had to become software, and the software had to be reliable enough to stand between a paying customer and a locked door at 2 a.m.

We delivered three connected pieces: a public website (story-gym.org), a member portal and mobile app (my.story-gym.org, also on Google Play and submitted to the App Store), and a dedicated access-control service that validates QR codes for the turnstile controller in real time.

Objectives

Sell single workouts and monthly passes online with Bulgarian bank card payments (Visa, Mastercard, B-card) and 3-D Secure
Open an existing tripod turnstile from a phone, with a code that cannot be screenshotted and shared
Enforce business rules at the door: active pass, one entry per day for single workouts, device binding, staff with permanent access
Log actual passages (not just scans) for the owner’s reports
Keep the door service independent from the portal, so a portal deploy or outage never locks members out
Run everything on serverless infrastructure with no servers to maintain

Case Study :: Custom Financial Education Platform with Multi-Level Learning System

Key Features

Member portal and mobile app

Registration and login (email/password or Google), a dashboard with the active pass and its expiry, purchase of single workouts or monthly cards, payment and subscription history, a visit log and a support form. The interface is bilingual (Bulgarian and English) with light and dark themes matching the club’s brand.

Story Gym app - dashboard, passes and QR access screens

Card payments through DSK Bank

Checkout is integrated with DSK Bank’s virtual POS: the order is registered, the member completes 3-D Secure on the bank page, and the callback confirms the payment before an entitlement is issued. No card data ever touches our systems. Promo codes and staff roles cover the non-paying cases.

Rotating QR code

The code shown in the app is a short-lived, HMAC-signed token that carries a pointer to the entitlement, an issue time and a 30-second expiry. It refreshes automatically, so a screenshot is useless within seconds. On the mobile app the screen brightness is pushed to maximum while the code is on screen, so the reader scans on the first try.

Access-control service for the turnstile

The turnstile is driven by a Soneco network controller that calls our service over HTTPS on every scan and on every physical turn. The service verifies the signature and expiry, asks the portal whether this member may enter right now, and answers “allow” or “deny” with LED colour, buzzer and display message – within milliseconds. A passage is consumed and logged only when the turnstile actually turns.

Case Study :: CRM for Freight Forwarding and Logistics Operations

Admin panel

The owner sees members, passes, orders, passages and support requests with pagination, bulk actions and role management (member, staff with permanent access, super admin) – without needing us for daily operations.

Story Gym access architecture - app, portal, lock service, turnstile controller and bank

Technology Stack

Portal & API: Cloudflare Workers with the Hono framework, server-rendered TypeScript views
Database: Cloudflare D1 (SQLite at the edge) for users, entitlements, orders, passages and devices; KV for sessions
Access service: a separate, stateless Cloudflare Worker implementing the controller’s SCAN / TURN protocol
Mobile: Capacitor apps for Android and iOS with deep links and native screen-brightness control
Payments: DSK Bank virtual POS (register / status API, 3-D Secure)
Security: PBKDF2 password hashing, HMAC-signed sessions and tokens, Cloudflare Turnstile, device binding
Hardware: IESTO tripod turnstile with a Soneco TC-1U-R07 controller and QR reader
Website: Astro static site on Cloudflare

Architecture Highlights

Two independent services by design: the portal owns accounts, payments and entitlements; the lock service only answers allow/deny to the hardware and keeps no database of its own
The QR token is a pointer plus anti-forgery, never the entitlement itself – rights are always checked live against the database
Replay protection per token, daily reset for single-workout passes, and a “permanent access” path for staff that bypasses limits without touching the hardware integration
Device-side TLS: the controller pins a CA and supports a limited set of signature algorithms, so the edge certificate chain was configured to serve an RSA chain the reader can verify – a detail that decided the hosting
Passage logging on the physical turn, not on scan, so reports reflect who actually entered
Zero servers: the whole system is Workers, D1 and KV, deployed with a single command

Case Study :: Childcare Marketplace Platform

Results

Story Gym opened as a fully self-service club. Members buy passes online, the turnstile opens from the phone, staff enter with a permanent code, and the owner has a live picture of sales and visits. The Android app is in production on Google Play and the iOS app has been submitted to the App Store.

Website: story-gym.org · Member portal: my.story-gym.org

Why Partner With Vipe Studio

This project combined web, mobile, payments and hardware integration in one delivery – and each part had to be right, because a bug here means a customer standing in front of a closed door. We design for that: isolated services, signed tokens, live checks and hardware-level testing before go-live.

If your business needs software that touches the physical world – access control, ticketing, kiosks, IoT devices – or simply a serverless platform with card payments and mobile apps, talk to us. We will build it the same way.