Your mobile app is live, users are registered — and suddenly you realize there's no way to block an account without a direct SQL query, change a banner without a deploy, or view statistics without Excel. Our team develops admin panels that solve these problems. With 5+ years of experience and over 20 completed projects, we create interfaces to manage users, content, push notifications, and analytics without a single SQL query. Here we break down the key components and technical solutions we apply.
Admin Panel Modules
Here are the typical modules we include:
| Component | Description |
|---|---|
| User Management | Search, filter, ban/unban, manual verification, action history |
| Content Management | CRUD for entities (products, posts, events), user content moderation |
| Push Notifications | Manual sending to segments, templates, history, delivery statistics |
| Analytics | DAU/MAU, retention, conversion funnels, crash rate, ANR rate |
| Feature Flags | Enable/disable features without deploy, A/B test configuration |
| Configuration | App parameters (limits, texts, URLs) without a release |
Technical Stack and Architecture
Backend API for Admin
The admin panel works with the same backend services as the mobile app, but via a separate set of endpoints with broader permissions. Important: do not grant mobile clients admin rights using the same token. The admin API requires separate authentication (separate OAuth2 client_id or separate service) and separate middleware with role checking.
On Laravel, we use spatie/laravel-permission for roles and permissions. Roles: super_admin, content_moderator, support. Every admin action is logged in activity_log (package spatie/laravel-activitylog): who, when, what changed, old and new values. Without this log, incident investigation is impossible.
On Node.js/NestJS — @nestjs/passport + casl for ABAC. For audit logging — middleware that writes to a separate table or sends events to Kafka/RabbitMQ.
Which Frontend to Choose for the Admin Panel?
We compare three main approaches:
| Approach | Flexibility | Development Speed | Limitations |
|---|---|---|---|
| Custom React (Tanstack Table, React Hook Form, Shadcn/ui) | High | Medium (2-3 weeks) | Requires experienced team |
| React Admin | Medium | High (1 week) | Hard to customize for non-standard logic |
| Low-code (Retool/AppSmith) | Low | Very high (days) | Vendor lock-in, limited customization |
For most mobile products, we recommend React + Tanstack Table + React Query + Shadcn/ui: a custom solution is 2-3 times more flexible than low-code, while development speed is comparable. Moreover, a custom solution pays off 2 times faster than low-code when there are more than 10 entities.
Configuring Push Notifications from the Panel
Integration with Firebase Cloud Messaging via Admin SDK. Firebase Admin SDK allows sending notifications in batches of up to 500 tokens. The panel lets you select a user segment (by registration date, platform, activity, custom tags), write text and title, schedule sending, or send immediately.
Recently on a project with 500k DAU, we implemented segment-based sending: we needed to send a promo only to iOS users who hadn't logged in for over 7 days. The panel built the segment in 2 clicks, batch sending via sendMulticast processed 200k tokens in 30 seconds. Result: 15% conversion to orders.
Implementation steps:
- Install Firebase Admin SDK on the backend.
- Implement send endpoint (use
sendMulticastwith batches of 500 tokens for large segments). - Process the result:
successCountandfailureCountsaved to history. - Automatically remove expired tokens (exception
UNREGISTERED).
On the backend: FirebaseAdmin.messaging().sendMulticast() for group sending. The send result — BatchResponse — is saved for history.
Why Feature Flags Save Time
The simplest implementation: a table feature_flags (key, enabled, rollout_percentage, updated_at). The mobile app requests flags on startup and caches them. The panel allows toggling flags and setting audience percentage. This cuts the time to roll out a new feature to minutes instead of a deploy — for example, A/B testing a new onboarding: 50% of users get the new version, we collect metrics, and decide in a day. Without flags, we'd need a separate build.
For more complex scenarios — Firebase Remote Config or LaunchDarkly. Remote Config is free and sufficient for 90% of tasks: panel in Firebase Console, SDK on mobile with fetch() + activate(), minimumFetchInterval in seconds to control request frequency.
How to Ensure Admin Panel Security
- Separate domain or subdomain (only
admin.yourapp.com, notyourapp.com/admin) - MFA mandatory for all admin accounts
- IP whitelist if the team works from fixed offices
- Rate limiting on all endpoints
- HTTPS only, HSTS
- Sessions with short TTL (8 hours), auto-logout on inactivity
- Content Security Policy headers
What's Included in the Work and Timelines
- API documentation: full description of endpoints, models, and access rights
- Source code: private repository with CI/CD
- Deployment instructions: step-by-step guide for DevOps
- Team training: webinar or personal consultation on administration
- Support: warranty maintenance for 3 months after delivery
Timelines: from 1 week to 3 months. A basic CRUD panel with user management and push — 1–2 weeks. A full system with analytics, feature flags, complex role model, and audit log — 1–3 months.
We guarantee stable operation and transparency at every stage. Interested? Contact us for a consultation — we'll evaluate your project and select the optimal solution for your tasks.