Building a Secure Membership, Paywall & LMS Platform on Blogger

Technology Project Case Study

Modernizing Blogger into a Secure Membership and Learning Platform

A practical implementation of authenticated membership, paid Premium content, online courses, local and international payments, protected content delivery, administration, and external data integration while retaining Blogger as the publishing platform.

Platform: Blogger + Supabase Payments: PayPal, eSewa, Khalti Year: 2026 Scope: Membership, LMS, Payments, Security

Executive Summary

The project began with a simple requirement: introduce paid Premium content on an existing Blogger website. The scope evolved into a broader digital platform covering user authentication, recurring and local payments, course enrollment, protected lessons, progress tracking, administration, and secure Premium article delivery.

The final architecture keeps Blogger as the public publishing and presentation layer while Supabase provides identity, application state, authorization, server-side business logic, and protected data access. This approach avoided a complete CMS migration while addressing the security and operational limitations of a client-side paywall.

Business Requirement and Constraints

The website was already established on Blogger. Rebuilding the site on another platform would introduce migration effort, content-management changes, and additional operational overhead. The preferred solution therefore needed to extend the existing platform rather than replace it.

Architecture Decision Blogger remains responsible for publishing, SEO and presentation. Supabase is used for functions that require identity, authorization, protected state and trusted backend processing.

Publishing continuityExisting Blogger article and page workflow retained.

MembershipAuthenticated paid access to Premium content.

Learning platformCourse catalog, enrollment, protected lessons and progress tracking.

PaymentsPayPal for international users and eSewa/Khalti workflows for Nepal.

AdministrationOperational controls for courses, payments and protected article preparation.

SecurityServer-side authorization and encrypted Premium content delivery.

Solution Architecture

The solution separates the presentation layer from the trust-sensitive application layer. Browser code is used for interface and session interaction, while privileged operations are handled through authenticated backend functions.

Figure 1. Blogger provides publishing and user-facing interfaces. Supabase provides authentication, authorization, database state, protected content access and server-side integrations.

BloggerArticles, pages, navigation, SEO, course interfaces and Premium presentation.

Supabase AuthUser identity, Google OAuth and email/password authentication.

PostgreSQLMemberships, courses, enrollments, payment records and lesson progress.

Edge FunctionsAuthorization, checkout, manual-payment processing, article encryption/decryption and API proxying.

Implementation Overview

Development was introduced incrementally so that each capability could be tested before the next dependency was added.

1

Authentication and Membership

Introduced Supabase authentication, account state and Premium membership validation.

2

Course Delivery

Added course catalog, modules, enrollment and server-authorized protected lessons.

3

Payment Processing

Added PayPal checkout and later local eSewa/Khalti manual payment workflows.

4

User Account and Learning Progress

Created a central account dashboard and lesson-progress tracking.

5

Administration

Added authenticated course administration and manual-payment review.

6

Secure Premium Publishing

Replaced source-visible Premium content with server-authorized AES-GCM encrypted article delivery.

7

External Data Integration

Added Nepal Rastra Bank exchange-rate data through a controlled backend proxy.

Secure Premium Content Model

A major design issue was that a conventional JavaScript paywall only hides content visually. If the complete Premium article is already present in the page source, a technical visitor can retrieve it regardless of the overlay shown on screen.

Security Improvement Premium article content is encrypted before publication. Blogger stores the public section and encrypted payload, while the article encryption key remains on the backend.

When an authenticated reader opens a Premium article, the backend independently verifies the current membership. Only an entitled user can request server-side decryption. The returned Premium HTML is then inserted into the article for that authorized session.

This does not attempt to prevent a legitimate subscriber from copying material that they are authorized to read. The security objective is to prevent unauthenticated or non-entitled visitors from receiving Premium plaintext in the original Blogger source.

Payment Model

Channel	Purpose	Control
PayPal	International Premium subscriptions and course purchases.	Checkout and payment state handled through backend functions and provider events.
eSewa	Nepal Premium membership and course payments.	Payment remains pending until transaction reference is reviewed and verified.
Khalti	Nepal Premium membership and course payments.	Same controlled manual-verification workflow as eSewa.

Manual payment submission does not automatically grant access. The implementation includes transaction-reference checks, pending-request controls, expiry handling, identity binding, expected amount validation and administrator approval.

Key Issues Resolved During Implementation

Issue	Root Cause	Resolution
Active member remained behind paywall	Membership validation succeeded, but the original Premium article endpoint had no content record.	Changed to encrypted Blogger payloads and removed duplicate article-content management.
Encrypted article failed after publishing	Blogger permalink differed from the encrypted article identifier.	Separated the cryptographic article identifier from the Blogger permalink.
Manual payment associated with incorrect account during testing	Payment identity binding required stronger controls.	Hardened authenticated user association and enrollment/payment transitions.
Existing student still saw purchase option	Storefront did not initially check active enrollment before rendering checkout.	Made the storefront enrollment-aware and changed the action to Continue Course.
Exchange-rate widget stopped loading	Direct browser request to the NRB API was unreliable.	Introduced a Supabase proxy with recent-date fallback and controlled CORS.

Security and Governance Controls

Privileged credentialsNo service-role credential is exposed in Blogger or browser code.

AuthorizationProtected functions independently validate authenticated identity and entitlement.

Pricing integrityAuthoritative pricing is derived or verified by backend logic rather than trusted from the browser.

Manual paymentsQR transaction submission does not grant access until review and verification.

Premium articlesProtected text is encrypted and decrypted only after membership authorization.

Course lessonsPrivate lesson content is returned only after enrollment checks.

Membership lifecycleExpiry and revocation are evaluated before Premium content is released.

Business and Operational Value

Preserved the existing publishing platformNo full CMS migration was required to introduce membership and learning capabilities.

Created a unified platformPremium articles, online courses, user accounts and payments operate from the same public website.

Supported both international and Nepal payment scenariosPayPal and local QR workflows provide different access paths for different markets.

Reduced operational dependency on backend administrationCourse administration, manual payments and article protection can be managed through site-facing tools.

Improved content securityPremium content is no longer protected only by a visual browser-side paywall.

Next Steps

The current platform is functional and continues to evolve. Planned improvements include authentication hardening, additional administrative auditing, database performance optimization, automated workflow testing, improved monitoring for external services, and stronger lifecycle notifications for payments and memberships.

Current Status

Active development. The platform currently supports authenticated Premium membership, course delivery, local and international payment workflows, protected article delivery, account management, administration and exchange-rate integration.

Public case study prepared for professional review. API secrets, service-role credentials, private identifiers and sensitive payment information are intentionally excluded.