Registered Authentic

The submission runs in six steps, from contact details to the deposit, and saves a draft as the customer goes. Contact details are validated on the form, on the server and once more right before the card is charged, and addresses autofill through Google Places.

The item's declared value picks the path. Remote items get a secure link for live capture on the owner's phone: gallery uploads aren't accepted for required shots, and each of 49 shot types comes with a written brief and an example photo. Everything else ships to an intake location the admin manages.

Deposits go through Authorize.Net Accept.js, so card data never touches the server. Balances are hosted invoices, signed webhooks reconcile every payment, and a payment that can't be matched to a submission is recorded for staff instead of being lost.

The dashboard has three roles: admin, authenticator and reviewer. New submissions can stay unassigned, go to one person or rotate round-robin between chosen staff, and each person chooses which email notifications they get.

Every submission follows one status lifecycle, from draft and deposit through review, intake and authentication to approval, the certificate and completion. The help page documents it for staff.

The ledger of issued certificates is write-once: the database itself refuses edits to its rows.

Specialists prove an item is the real race-used piece by ringing matching marks, such as scuffs, stickers, signatures and paint flaws, in the customer's photo and in historical race photography. Pairs are numbered and color-coded with undo and redo, and the tool has zoom, pan, a loupe, view-only brightness and contrast, and keyboard shortcuts throughout.

Overlay mode lays one photo over the other with a fade or a draggable swipe divider. Auto-align works out the move, scale and rotation from the matched points with a least-squares fit; the geometry is custom and unit-tested.

Each approved item gets a certificate number, a public verification page and a PDF rendered on the server with @react-pdf. The PDF carries the item photos, the photo-match evidence and a verification link, and is stored in Vercel Blob.

An optional record on Polygon puts the certificate on a public blockchain.

Settings are stored encrypted in the database, and a value entered in the admin overrides the server configuration, so the owner can rotate a payment key or swap the email provider without a redeploy.

Sandbox and production payment keys are kept side by side. Production can't be selected until all four live keys are in, and a health check covers the keys, the webhook and delivery. A setup checklist lists anything still missing and hides itself when everything is done.

The theme drives everything visual, down to the logo, which is rebuilt as a vector that recolors itself, and the browser and home-screen icons rendered from the same colors.

Going live is a one-time handover. Live payment keys are checked against the gateway, the webhook is registered in one click and confirmed with a test notification, and any launch items skipped are recorded. A flag then takes the site from coming soon to public within about 30 seconds and switches card payments to production.

Every public page is translated into 15 languages, including right-to-left Arabic. Admins can edit marketing text and legal pages in place on the live page, with some legally sensitive text locked.