IQ Academy is a full-scale EdTech platform built for Saudi university students — covering course discovery, subscription, study, exams, payments, wallet, and post-purchase engagement. The backend is a Laravel API with Sanctum bearer tokens; the frontend is a Next.js 16 App Router application with RTL-first Arabic UX, server-side metadata, and a BFF layer for secure auth cookies.

The hardest problems were not CRUD screens — they were stateful learning flows: exams that survive page refresh, video lectures that report honest watch time via 15-second heartbeats, carts that merge guest and authenticated sessions, and checkout that routes to different success-metadata endpoints depending on whether the user paid via wallet, IQ Pay, or Moyasar gateway redirect. I architected modular domain layers (exam, cart, checkout, study, wallet, notifications) with Zustand persist for client-critical state and TanStack Query for server state, optimistic updates, and cache invalidation.

Auth uses HttpOnly cookies plus a session hint cookie, with Next.js 16's proxy.ts convention for route protection — explicitly handling opaque Sanctum tokens that are not JWTs. The platform enforces Arabic triple-name validation before any signup API call, watermarks protected PDFs with student identity via pdf-lib, and pushes Firebase notifications only after authenticated SDK initialization.