WARM WHITE ENTERTAINMENT
NFC-Gated Unreleased Music Platform
Numbered Units
Tap to First Play
Signed Stream Window
Shared Audio File
Warm White Entertainment came to us with a release model, not a spec: a single unreleased HYKE track, pressed onto 200 physical objects, each carrying an NFC sticker. Tap the object, hear the song — before it exists anywhere else. The catch is the one every physical-meets-digital drop runs into: an NFC chip can only ever store a URL. Whatever protects the song, decides who is allowed to hear it, and tracks what happens next has to live entirely on a server, because the object itself can never be updated, revoked, or made smarter after it ships. This was not asked to be uncrackable — it was asked to be honest: a real deterrent, a real ledger, and a tap-to-play moment good enough to be filmed at the show.
A single FastAPI application serves both sides of the drop from one Postgres ledger. Fans get a server-rendered "unlock" flow styled like a stamped excise card — claim once, then tap-to-play forever on that device. The label gets a live operator console: claim rate, play counts, distinct-IP flags, one-click revoke, and audio upload, usable from a phone at the venue. Nothing on the fan path uses a framework bundle — it is server-rendered HTML, hand-tuned CSS, and just enough vanilla JavaScript to run the player, because the thing that has to feel premium on a phone, on camera, in under 60 seconds, is also the thing that has to load instantly on a poor signal at a live show.
Under the Hood
The Chip Stores a URL. Nothing Else.
Every unit's meaning lives in Postgres, not on the tag — so a unit can be revoked, reissued, or reset without touching the physical object.
The Song Is Never at a Public Address
Playback requests a fresh, HMAC-signed stream URL that expires in five minutes. A forged or stale link returns 403 — there is no permanent audio link to leak.
Claims Are a Race, and Only One Side Wins
Two phones tapping the same unclaimed unit at once resolve through a database-level constraint. Exactly one claim succeeds — never a duplicate holder.
Range Requests, Actually Correct
Scrubbing and fast starts on mobile depend on true 206 Partial Content handling — verified byte-for-byte against both the local disk and Cloud Storage backends.
- Unclaimed tap opens a one-time claim: name and phone or email, nothing more
- Claiming binds the unit for good — a second claim on the same unit is rejected, cleanly, every time
- A long-lived signed cookie means every tap after that goes straight to the player, no re-entry
- The ember is the play control — a pulsing, glowing orb that is the clear focal point of the page
- Every play streams through a five-minute signed URL; nothing is ever downloadable or permanently linked
- A new device asks a real owner to re-verify with their claim contact — never a hard lockout
- The holder's name and claim date are treated as design elements: "Held by [name] since [date]"
- 200 is the edition, not a countdown — the ledger is built to carry into future drops as a membership base
Why We Did What We Did
Every architectural decision has a reason. Here are the ones worth explaining.
Why "deterrence," not DRM?
Anything that plays in a browser can be captured — no login screen changes that. Rather than oversell the system, the copy and the UI say what it actually does: make sharing inconvenient, trackable, and revocable. The value is not the lock — it is the ledger that knows which unit leaked.
Why flag suspicious activity instead of auto-blocking it?
A token streamed from ten or more distinct IPs gets surfaced for a human to look at — not shut off automatically. A real fan replaying from home wifi, a phone hotspot, and a friend's car is not abuse. False positives punish the buyers this whole system exists to protect.
What happens if a fan loses their phone?
A claimed unit tapped on an unrecognized device does not dead-end — it asks for the contact used at claim, and a match re-issues access on the new device. No hard device lock, no support ticket required to prove you are the owner of your own object.
We didn't want a login wall — we wanted an object people would want to hold onto. What The Beyond Horizon built gets that: tap the tag, the song is yours, permanently, on your phone. No app, no account, no download link to leak. The moment someone taps in and hears HYKE for the first time — that's the whole point, and it works exactly the way we pictured it.
More Case Studies
Ready to Build Something Like This?
Let's talk about your project.