TattooGen

AI Tattoo Design Generator — Flutter + Node.js + OpenAI gpt-image-1

Role: Full-stack mobile engineer
Year: 2026
Status: In Development
Stack: Flutter · Riverpod · GoRouter · Dio · Node.js · Express · OpenAI SDK · PostgreSQL · Firebase Auth · App Check · In-App Purchases · Sentry · Pino · Multer · Helmet · CORS · Rate Limiting
Client: Flutter
AI: gpt-image-1
Auth: Firebase + App Check
Hardening: Rate limit + Helmet

Overview

TattooGen is a cross-platform Flutter app that turns a guided quiz and a design form (style, placement, size, complexity) into AI-generated tattoo concepts. The Flutter client uses Riverpod, GoRouter and Dio; the Node.js/Express backend rewrites each spec with gpt-4o-mini before generating with gpt-image-1, runs jobs asynchronously on Postgres, and gates every call behind Firebase auth + App Check, per-user rate limits and a server-verified credits system.

Problem

Building a consumer-facing AI generator means the cute frontend is the easy half — the real work is making sure the OpenAI-backed endpoint cannot be abused, drained, or accidentally exposed to unbounded cost.

What I built

Flutter client architected around Riverpod state + GoRouter navigation
Dio API layer for typed requests and consistent error handling
Express backend wraps the OpenAI Images API behind auth-aware endpoints
Two-stage AI pipeline: gpt-4o-mini rewrites the spec, gpt-image-1 generates, jobs run async on Postgres
Firebase Anonymous Auth + App Check on every call; credits bought through server-verified Google Play / App Store purchases
Multer uploads capped at 10 MB and restricted to image MIME types
Atomic credit decrement before every paid OpenAI call, with automatic refund on failure
Defense-in-depth on the AI endpoint: rate limiting + Helmet + CORS

Key decisions

Client: Flutter
AI: gpt-image-1
Auth: Firebase + App Check
Hardening: Rate limit + Helmet

Stack

Flutter · Riverpod · GoRouter · Dio · Node.js · Express · OpenAI SDK · PostgreSQL · Firebase Auth · App Check · In-App Purchases · Sentry · Pino · Multer · Helmet · CORS · Rate Limiting

Outcome

In Development · 2026. On AI products the perimeter matters more than the prompt — rate limiting and tight upload validation are what keep the demo cheap to run and the production version safe to ship.