Al Hatab Rewards: from signing in to a card at the counter.
We built Al Hatab’s web member area so customers can sign in with a phone number and code, see their points and show a membership barcode at the counter. The Arabic and English experience connects directly to the brand’s existing customer system, keeping the member record where the business already manages it.
01Member experience
Members start with a mobile number. The same entry point supports sign-in and registration. 
A five-digit SMS code verifies the mobile number, with a countdown before another code can be requested. 
Members can complete their profile from the account area, with a points incentive shown alongside the form. 
The member overview brings together the points balance, its monetary value, barcode access and profile details.
- Organisation
- Al Hatab Foods, Saudi Arabia
- Role
- Design, architecture and engineering
- Stack
- Astro
- Cloudflare Pages
- Cloudflare Workers, KV
- Status
- In production
- Since
- 2024 to present
- Join register or sign in with a phone number and code
- View see available points and upcoming expiry
- Scan bring the membership card to the counter
02The brief
Give members access to the record the business already uses.
Al Hatab needed a member area connected to its existing customer system. Customers needed a straightforward way to join, sign in and retrieve their card in either language. We built that interface around the existing records, with temporary storage for the sign-in flow.
03The member journey
A phone number, a code and a membership card.
The service checks the phone number against the customer system and guides the visitor through verification and registration where needed. Once signed in, members can see their points, upcoming expiry and a barcode generated from their membership ID. Short-lived codes and the browser’s session timer support the sign-in journey.
OTP_TTL_SECONDS 180stored as session id → code, in KV, expiringverify compares with the stored codesession expiry configured in the frontendsession check browser timer and periodic checks code expiry and temporary phone storage have separate lifetimes
04Verification and testing
Check the flow at each step.
The Workers validate API keys and apply bot checks according to the operation and environment settings. Shared utilities handle those checks, request identifiers and calls to the customer system. Playwright tests exercise registration and sign-in in the testing environment, where configured bypasses allow automated runs. Production frontend builds remove console output.
◇ X-API-Key per worker, validated first◇ X-Turnstile-Token bot check; strict for sensitive operations◇ fallback a second bot check when the first is unavailable◇ session expiry checked in the browser◆ then the operationwith a request id through every log line automated tests use configured verification bypasses
05Behind the interface
Small services with clear responsibilities.
The Astro frontend handles the bilingual member experience. Four Cloudflare Workers handle customer lookup, verification codes, temporary phone storage and customer creation or updates. They share utilities for phone formatting, OAuth, request checks and logging, so common behaviour can be maintained in one place.
customer-verification is this phone a member? asks the client's customer systemcustomer-otp-store a one-time code, in KV, with a short lifecustomer-phone-store the phone, held only for the sessioncustomer-create-update a new member, or an updated one, written back _shared logging, CORS, API keys, phone formatting, OAuth tokens each worker checks an API key, a bot token, and a session before it does anything
06Recorded usage
A view of the work happening behind each visit.
The historical Cloudflare sample recorded here covers twelve weeks and approximately 1.59 million requests across the four Workers. Normalised to thirty days, it represents about 568,000 requests, 256,000 storage reads and 114,000 writes. These are infrastructure operations, so they should not be read as counts of members or successful sign-ins. The figures are rounded, sampled and exclude logging Workers.
metric 12 weeks per 30 daysfour workers, requests 1,589,510 568KOTP worker, requests 631,119 225KKV reads 717,813 256KKV writes 317,952 114K monthly range 497K to 607K requests twelve measured weeks of production analytics, normalised to 30-day averages; rounded; sampled; logging workers excluded
07Part of the platform
Connect membership to the wider customer experience.
Rewards sits alongside Al Hatab’s content platform and link service. Each has a focused job: publishing content, bringing visitors to the right destination or giving members access to their account. The rewards interface connects to the brand’s customer system rather than maintaining a separate permanent member database.