Spring Boot Microservices: Banking & Payment System Design

In this lecture, we explain why microservices are a natural fit for building modern banking systems.

We cover how domain separation, failure isolation, security boundaries, and independent scaling influence real world banking architecture.

We also introduce the core microservices principles that will guide how services are designed, implemented, and evolved throughout this course.

In this lecture, we align on the technology stack used throughout the course and set expectations for how it will be applied.

We introduce the backend, data, messaging, and security tools that form the foundation of our digital bank, and explain how they fit together in a production style architecture.

This lecture also clarifies the level of familiarity expected with these tools as we move into implementation.

In this lecture, we introduce the Customer Onboarding use case, which serves as the foundation of our digital bank.

We walk through the happy path of onboarding as well as key edge cases, and explain how customer identity and trust are established before any banking activity can occur.

This use case defines the root entity that all accounts, payments, and transactions in the system are ultimately linked to.

In this lecture, we walk through the Customer service API endpoints used in our digital bank.

We explain how customer data is exposed safely through well defined create, read, and update operations, and how access to these endpoints is protected using scopes and permissions.

This lecture reinforces the importance of securing customer data and treating APIs as controlled entry points into the system.

In this lecture, we take a deep dive into the Create Customer API, the most critical endpoint in the Customer Service.

We explain how a new customer is safely created using production-grade API design practices, including validation, idempotency, traceability, and consistent error handling.

This lecture shows how a prospect is formally introduced into the banking system in a secure, reliable, and compliance friendly way.

In this lecture, we continue exploring the Customer API by covering its read and update operations.

We explain how customer data is safely retrieved and modified using secure endpoints, proper authorization, and production-grade patterns such as optimistic locking and partial updates.

This lecture highlights how customer state changes  especially KYC status updates  are handled in a controlled and auditable way within a real banking system.

In this lecture, we take a deep dive into the internal architecture of the Customer Service ,the first fully implemented service in our digital bank.

We walk through how requests flow through security, controllers, business logic, persistence, and the database, and how responsibilities are cleanly separated across layers.

This lecture also explains how the customer data model and database constraints enforce correctness, concurrency safety, and idempotency in a production-grade banking system.

Note: All SDLC artifacts have been backed up and are available in the Resources section in case Sodelic becomes unavailable in the future.

In this lecture, we step away from code to look at how requirements are tracked and managed using Sodelic.

We explain how banking use cases, APIs, and design decisions are captured as epics, features, and tasks, and how implementation stays traceable back to business requirements.

This lecture shows why disciplined traceability is essential when building real-world banking systems with multiple services and teams.

Note: All SDLC artifacts have been backed up and are available in the Resources section in case Sodelic becomes unavailable in the future.

In this lecture, we go hands-on with Sodelic to capture, structure, and trace requirements before any code is written.

We demonstrate how customer use cases are broken down into features and tasks, how acceptance criteria are defined, and how traceability is maintained from requirement to implementation.

This lecture shows how disciplined requirement tracking helps keep complex banking projects well-scoped, testable, and production-ready.

In this lecture, we start implementing our first real piece of functionality by building the Create Customer API in Spring Boot.

We walk through how a new customer is safely inserted into the system with proper validation, uniqueness guarantees, idempotent behavior, and production grade HTTP responses.

This lecture marks the transition from design to real code and sets the coding patterns that will be reused across other services in the bank.

In this video, we handle a key edge case in the Customer Service .  What happens when a client provides a duplicate externalId while registering a customer

In this lecture, we build a shared Commons DTO module to standardize request and response models across our microservices.

We explain how common data contracts and error structures help maintain consistency, reduce duplication, and simplify communication between services.

This module becomes a foundational building block that ensures all APIs in the system behave in a predictable and uniform way.

In this lecture, we add observability to our digital bank by introducing a shared commons observability module.

We explain how consistent logging, correlation IDs, and access logs make it possible to trace requests across multiple services and debug distributed systems effectively.

This lecture shows how to build microservices that are debuggable, auditable, and production-ready from day one.

In this lecture, we implement duplicate email validation in the Customer Service to prevent inconsistent or invalid customer data.

We explain how uniqueness is enforced at both the API and database levels, and how appropriate HTTP status codes are used to communicate conflicts clearly.

This lecture highlights real-world error handling practices that help keep microservices reliable and data integrity intact.

In this lecture, we implement two critical capabilities of the Customer Service: secure read APIs and controlled KYC status updates.

We explain how customer data is safely retrieved using protected GET endpoints, and how KYC state transitions are handled using optimistic locking to prevent concurrent updates.

This lecture shows how customer verification flows are enforced correctly and safely within a real digital banking system.

In this lecture, we complete the Customer Service by implementing update APIs with full support for optimistic locking.

We explain how versioning, ETags, and If Match headers work together to prevent lost updates and ensure safe concurrent modifications.

This lecture finalizes the Customer Service as a production-grade component that is secure, idempotent, and ready to operate in a real digital banking environment.

In this video, we’ll set up OAuth2 with JWT authentication in Spring Boot, using Auth0 as the identity provider.

In this lecture, we explain how the OAuth2 Authorization Code flow works and why PKCE is essential for securing SPAs and mobile applications.

We walk through the end-to-end token exchange process, how access tokens are used to call protected APIs, and what can go wrong in real-world attack scenarios.

By the end, you will understand how PKCE prevents authorization code interception and helps protect both users and APIs in production systems.

In this lecture, we break down how JSON Web Tokens (JWT) work and why they are a core building block of modern authentication and authorization.

We explain the structure of a JWT, how tokens are issued and validated, and how they are used to secure APIs and microservices.

This lecture provides the foundation needed to correctly apply JWT based security throughout the rest of the course.

In this lecture, we move from security theory to real-world implementation by walking through the security architecture of our digital banking APIs.

We explain how Zero Trust principles, OAuth2 flows, JWT based authentication, and machine-to-machine access work together to secure microservices in production.

This lecture also shows how security requirements are captured and traced as formal use cases and tasks, ensuring security is designed and implemented intentionally from day one.

In this lecture, we lay the security foundation for our digital bank by introducing Auth0 as the Identity Provider responsible for issuing and signing JWT access tokens.

We explain the separation of concerns between Identity Providers and Resource Servers, how APIs are defined and protected, and how permissions and roles are modeled for real banking use cases.

This lecture establishes a Zero Trust security model where every client and service must authenticate explicitly, forming the basis for secure microservices throughout the course.

In this lecture, we run a hands-on Postman demo to create a user in Auth0 using the Auth0 Management API.

We walk through the required request structure, headers, and fields, and interpret the response returned by Auth0 after user creation.

This lecture also explains where user provisioning fits into our digital bank security workflow, connecting customer onboarding to identity creation, token issuance, and secure API access.

In this lecture, we walk through the OAuth2 Authorization Code flow with PKCE end to end using Postman and Auth0.

We demonstrate how authorization codes are issued, how PKCE secures the exchange, and how access tokens are finally used to call protected APIs.

This hands-on walkthrough shows how modern SPAs and mobile applications authenticate securely using industry standard OAuth2 patterns.

In this lecture, we design and implement a shared security foundation that turns every microservice into an OAuth2 Resource Server.

We explain how a Zero Trust model is enforced through consistent JWT validation, how a common security module removes boilerplate, and how tokens safely propagate between services.

This lecture establishes a reusable, production-grade security backbone that can be applied across any Spring Boot microservices architecture.

In this lecture, we build a dedicated AuthUser microservice responsible for provisioning users in Auth0 after successful KYC approval.

We explain how this service fits into the overall customer onboarding and verification flow, how it is secured as a Zero Trust Resource Server, and how it interacts safely with the Auth0 Management API.

This lecture demonstrates how identity provisioning is handled programmatically in real banking systems, using proper roles, scopes, and authorization controls.

In this lecture, we configure and test public and protected endpoints in Spring Boot microservices using real JWT access tokens issued by Auth0.

We explain how endpoints are exposed or secured using shared security configuration and authorization rules, and how permissions from JWTs are enforced at runtime.

This hands on demo shows how secured services interact safely and how access control works end to end in a Zero Trust microservices architecture.

In this lecture, we explore how Spring Boot microservices communicate with each other using Feign, a declarative HTTP client.

We explain how service to service calls are modeled as simple Java interfaces, how requests are translated into real HTTP calls, and how security context is propagated between services.

This lecture demonstrates how inter-service communication fits into our digital banking architecture using a real customer verification and user provisioning flow.

In this lecture, we bring together everything built so far and walk through the complete customer onboarding flow of our digital bank.

We demonstrate how customer registration, KYC approval, identity provisioning, and secure access work together across multiple microservices.

This end to end walkthrough shows how customer data, security, and identity are orchestrated in a real banking system, and how the entire flow can be verified using Postman.

In this lecture, we complete the customer onboarding flow end to end using Postman, bringing together registration, verification, identity provisioning, and secure access.

We then introduce the Accounts microservice , a core component of any banking system  and walk through the key use cases it will support.

This lecture marks the transition from identity and onboarding into money movement and account management, setting the stage for all payment and transaction flows that follow.

In this lecture, we walk through the API specification for the Accounts microservice that was designed from the previously defined use case.

We explain how to read and navigate the OpenAPI contract using Swagger Editor, and how requirements are translated into a clean, well-structured API design.

To add a mocking server - https://github.com/raman83/ChapterResources/blob/master/lecture34.txt

API Spec  - https://github.com/BankStack09/APISpecs

In this lecture, we continue the Accounts Service API walkthrough by focusing on real money movement within the bank.

We explain how funds are reserved and released using holds, how credits and debits are applied safely using optimistic locking, and how internal account listings support administrative and operational use cases.

This lecture builds on the API contract and mock setup to demonstrate how balance integrity and concurrency safety are enforced in a real banking system.

API Spec - https://github.com/BankStack09/APISpecs

To add a mocking server - https://github.com/raman83/ChapterResources/blob/master/lecture34.txt

In this lecture, we take a deep dive into the database design of the Accounts microservice , the foundation for all money movement in a digital bank.

We explain how account and hold data are structured to support real-time balance calculation, safe concurrent updates, and idempotent operations.

This lecture shows how careful database modeling and constraints prevent race conditions, double spending, and data inconsistencies in real-world banking systems.

In this lecture, we implement the complete Account Creation flow in code using Spring Boot, translating the previously defined use case, API contract, and data model into a production-ready service.

We walk through how secure endpoints, business rules, idempotency, optimistic locking, and ownership validation work together to safely create accounts in a digital bank.

This lecture also demonstrates centralized security and error handling, and verifies the implementation end-to-end using Postman with real JWTs.

In this lecture, we implement and test the read and administrative APIs of the Accounts microservice.

We explain how account details and balances are safely retrieved using secured endpoints, how ETags support concurrency control, and how balances are calculated using ledger amounts and active holds.

This lecture clarifies how banks expose account information reliably to both customers and internal operations while preserving correctness and consistency.

In this lecture, we implement the core write operations of the Accounts microservice , the operations that actually move money inside a bank.

We explain how funds are reserved using holds, how balances are safely debited and credited, and how concurrency control and idempotency protect against race conditions and duplicate requests.

This lecture demonstrates how real banking systems ensure balance integrity and prevent double spending while handling concurrent updates at scale.

In this lecture, we introduce account transactions ,  the ledger that records every movement of money inside the bank.

We explain how balance updates and transaction records are written atomically using ACID transactions, and how Spring’s transactional boundaries ensure consistency across multiple database operations.

This lecture demonstrates how real banking systems guarantee that balances and ledger entries always stay in sync, even in the presence of failures or rollbacks.

In this lecture, we extend the Transactions capability by focusing on how large volumes of account activity are stored, queried, and exposed efficiently.

We explain why every financial operation results in a transaction record, and how server-side pagination and filtering are used to handle years of transaction history without performance issues.

This lecture demonstrates how real banking systems load transaction data safely and efficiently using dynamic queries, pagination, and sorting in Spring Boot.

In this lecture, we step outside application code and break down how bill payments actually move through real Canadian banking rails.

We explain what happens behind the scenes when a customer submits a bill payment, including clearing, settlement, prefunding, and the role of industry intermediaries.

This lecture provides the real world context needed to understand why payments move asynchronously, why statuses change over time, and how modern digital banks integrate with national payment systems.

In this lecture, we break down the complete event-driven architecture behind a real bill payment flow in a modern digital bank.

We explain how a single “Pay Bill” action is orchestrated across multiple services using reliable messaging, batching, and settlement workflows.

This lecture walks through how payment orchestration, event publishing, worker services, settlement processing, and failure handling work together to deliver resilient, production-grade bill payments.