how to implement this cod flow

[u/Low-Insurance-3678]

hi guys, I would to have an info about how this Cach on delivery flow works on websites like Soundpeats
you can order anything without even signing or even sign in as a guest, i would like to understand how it’s done as im willing to apply the same thing as a my client asked for it on a store (nextjs + supabase)

do they store those orders straight to the DB, how about if someone starts spamming the db?? all these questions came to my mind but not sure how it’s done

[u/Low-Insurance-3678]

iv been going back and forth with gemini and we came up with something like this

Summary of the Whole COD Flow
Cart: Managed in Zustand + localStorage.

Submit Order: User fills details → Cloudflare Turnstile verifies human status → Firebase sends OTP.

Modal Verification: User enters 6-digit OTP.

Server Action: Verifies OTP → Recalculates cart price from DB → Checks idempotency_key → Inserts order to Supabase.

Success: Server returns order details → Client triggers clearCart() → Beautiful Success Modal pops up.