Green Mounts Ventures

Overview

Green Mounts Ventures is a dry-fruits and superfoods brand. This project is their complete customer platform: a React Native shopping app, a custom PHP/MySQL REST API, and the payment and shipping integrations behind both. It was designed and built end-to-end by our founder, Mukesh Kumar, who continues to maintain and extend it.

The Problem

The brand already had a PHP website and admin panel. It needed a mobile app that could sell from the same catalogue and drop orders into the same order-management system, without a separate sync step or a second admin panel to run.

What We Built

• React Native shopping app with a live catalogue, cart, checkout, order tracking, wishlist, reviews, addresses and notifications
• Custom REST API with 50+ endpoints covering auth, catalogue, cart, checkout, orders, coupons, gift cards, wallet, referrals, subscriptions, recipes and support chat
• One shared database. Every app order is written to the same orders table the existing admin panel already uses, so it appears there instantly.
• Payments: Razorpay in the app and CCAvenue on the website, both with server-side verification
• Shipping: Shiprocket integration for live tracking inside the app

Engineering Highlights

• Secure phone login. Firebase Phone OTP signs the user in. The backend then verifies the Firebase ID token (audience, issuer and sign-in provider) before issuing its own app token.
• Server-authoritative loyalty points. An earlier client-side points system was rebuilt so balances, redemptions and awards are all calculated and stored by the API, closing a "free points" exploit.
• Fast checkout despite slow work. Finalising an order (invoice, Shiprocket call and two emails) could exceed PHP's time limit. The API now confirms the order to the app immediately and finishes the slow work in the background.
• Security audit. Fixes included a signed access token on invoice downloads, a server-side amount check against Razorpay before confirming payment, coupons scoped to their owner, and rate limits on login, coupon and order endpoints.
• Hosting quirk handled. Some shared hosts strip the Authorization header before PHP sees it, so the API also accepts a custom X-App-Token header as a fallback.

Tech Stack

React Native (Expo), Zustand, Firebase Phone Auth, PHP, MySQL, Razorpay, CCAvenue and Shiprocket.

Status

Live and in daily use. The source code is private business code; a public write-up is at github.com/mukeshkumar356/green-mounts-ventures-case-study.