About BidKar
BidKar is an online auction marketplace for India. Sellers list items, administrators review them, buyers bid within a window the seller chooses, and the highest bidder has 24 hours to pay. If they do not, the lot walks down the bid list rather than simply failing.
It is a demonstration, and everything above is real except two things. Payments are simulated and identity checks are simulated. The database, the authentication, the bidding, the row locking, the settlement machine and the delivery app are all genuine. What you cannot do here is lose money.
What is actually different about it
The bill is a gate, not a badge. A seller may upload the original purchase bill and state what it says. Nothing renders until an administrator has checked the document and confirmed the numbers against it. No figure a seller types is ever shown to a buyer on the seller's word alone — which is the opposite of how “originally ₹40,000” usually works online.
The inspection happens against the seller's own declaration. A delivery partner arrives with the twelve statements that seller made about that specific item and checks it line by line. Other platforms inspect against a generic rubric, because a generic rubric is all they have. Here there is an itemised declaration to check against.
Buyers and sellers never see each other. Not as a setting that can be switched off, but because the columns do not exist. There is no phone number anywhere in this database.
How bidding works
Every bid is written by a single database function that takes a lock on the listing row first. Fifty people bidding the same amount in the same instant produces exactly one winner and forty-nine rejections, which is the behaviour a marketplace lives or dies on and the one most likely to be wrong.
Minimum increments scale with price, so a ₹400 lot moves in ₹10 steps and a ₹5,00,000 lot moves in ₹5,000 steps. The bid record is append-only: nothing is ever edited or deleted, because it is the evidence if a result is disputed.
What it is built with
A single Next.js application talking to Postgres through Supabase. Authorisation lives in the database as row-level security policies rather than in application code, so a bug in a page cannot leak something a policy forbids — there would be nothing for it to render.
The rules above are enforced, not aspirational, and the reasoning behind each is recorded in the repository's documentation. Terms and conditions