Every booking at Cove runs through an API I built. It checks which specialist is free, takes the deposit, saves the card, and pays self-employed staff directly. The salon team never has to do any of it by hand.

Cove is a luxury salon, academy and spa in Sunderland, UK. Clients book facials, massages, aesthetics and head spa treatments online, choosing a specialist, add-ons and a time slot, then pay a deposit or the full amount.

I was the backend developer. I built the API that powers the booking site, the client accounts and the salon's admin panel.

A salon looks simple from the outside. Behind it are a lot of moving parts:

Each specialist has their own shifts, breaks and holidays, so availability changes all the time

Some clients pay in full, some pay a deposit, and some pay on the day

Self-employed staff work alongside salon employees and need to be paid into their own accounts

Memberships, gift cards and discount codes all change the final price

As a UK business, Cove has to handle client data under GDPR

The goal was a backend that keeps all of this correct, so the salon never double-books a specialist or charges the wrong amount.

Booking and availability: A 6-step booking flow (treatment, specialist, add-ons, date and time, details, payment). Available times are worked out from each specialist's shifts, breaks and holidays. Overlapping shifts and breaks are blocked.

Payments: Stripe Checkout for deposits and full payments, with cards saved on file so the salon can charge the balance later. Bookings move through clear states: pending payment, confirmed, completed, cancelled or no-show.

Self-employed staff payouts: Self-employed providers are onboarded with Stripe Connect Express. One saved card can pay several businesses in a single booking, and each charge goes to the right payee's Stripe account.

Staff and scheduling: Staff profiles, working hours, shifts, breaks and holiday requests with admin approval. Self-employed staff get their own private client list and dashboard, kept separate from the salon's data.

Memberships, gift cards and discounts: Bronze, Silver and Gold memberships on Stripe subscriptions. Gift cards up to £10,000 and discount codes, including one-use-per-customer codes.

Admin panel API: Dashboard stats with revenue forecasts, a drag-and-drop calendar, walk-in bookings, CMS content, a gallery, reviews, and Excel exports of appointments and revenue.

Emails and reminders: Booking confirmations, split notifications for multi-business bookings, password resets and welcome emails through Resend. Scheduled jobs send appointment reminders.

Security and GDPR: JWT auth with hashed passwords, role-based access, rate limiting, secure headers and sanitised content. Admin actions are audit logged. Clients can export their data, manage consent and delete their account, and a scheduled job purges expired data.

Live in production for a real salon, with nearly 40 treatments across skin, body, head spa and aesthetics

203 API endpoints and 35 data models behind the booking site and admin panel

Salon and self-employed staff take bookings and payments in one system, each paid into their own account

Clients book and pay online in minutes, with no phone calls needed

Backend: Node.js, Express, TypeScript, PostgreSQL (Neon), Prisma

Payments: Stripe Checkout, Stripe Subscriptions, Stripe Connect Express

Validation and security: Zod, JWT, bcrypt, Helmet, rate limiting, sanitize-html

Email: Resend

Files and exports: S3-compatible storage with presigned uploads, Sharp, ExcelJS

👉 See it live: https://www.covesalon.co.uk/