"case_study": "nejobi"
A Telegram casino the client can't cheat
A play-money casino running natively inside Telegram — roulette, plinko, sky-rush, wheel — where every outcome is decided by the server and the client only animates the result.
"role"
Frontend — Next.js Mini App (the API and game logic live in a companion Express + Prisma server)
"stack": [7]
- Next.js
- React
- TypeScript
- Tailwind CSS
- Telegram Mini Apps SDK
- Express.js
- Prisma
The problem
Casino games are the worst case for client trust: the code runs on the player's device, and any value the client computes, the player can manipulate. Even with play money, an exploitable economy kills the product.
Telegram Mini Apps add a second constraint — the whole experience runs inside Telegram's webview, authenticated by Telegram's own init data, and it has to feel like a native game, not a website.
The design
- Server-authoritative everything: the backend rolls every outcome and payout; the client receives a result and animates toward it. Nothing the player can tamper with changes what they win.
- Four games — roulette, plinko, sky-rush, wheel — each a thin animation layer over the same trusted round lifecycle: place bet, server resolves, animate, settle balance.
- Built on the official Telegram Mini Apps SDK for auth and native integration, with Next.js and Tailwind for the UI.
- The frontend repo is public — the separation is visible in the code: no game math on the client, anywhere.
Why it matters
This is the same trust architecture real-money gaming and fintech products use. Deciding early that the client is untrusted shaped every API: endpoints return results, never formulas, and balances only ever change server-side.