A complete look at the backend architecture — from campaign creation to creator payout, every system is explained below.
App Router + Turbopack
Server components, API routes, middleware
Postgres + Auth + Storage
Database, authentication, file storage, realtime
Payments + Payouts
Destination charges, transfers, onboarding
Rate Limiting
Serverless Redis for rate limit counters
Tracking Redirects
/t/{slug} redirects with JWT verification
E2E Testing
Full browser automation for integration tests
From business card charge to creator payout — every step is escrow-protected with a 7-day hold window.
Stripe Customer created with default payment method. Card details are never stored on Adswish servers.
POST /api/v1/webhooks/conversion receives token, orderId, amount, and attribution method from the tracking system.
createDestinationChargeForConversion charges the business card off-session using the saved default PM. 90% goes to creator, 10% platform fee.
Hold entry (+90% creator) recorded in the ledger as pending_hold. Funds held in Stripe Connect.
Release-holds cron runs daily. After 7 days with no dispute, funds transfer to the creator's Connect account.
Stripe Connect v2 onboarding → bank transfer. Payout invoices generated monthly.
Edge-redirected links with HMAC-signed JWTs. First-party cookies survive ad blockers. Chrome extension and desktop tracker keep the heartbeat alive.
Edge function generates HMAC-signed JWT with 24h expiry. /t/{slug} redirect captures the attribution token.
Edge-redirected link sets _adswish cookie with token. Chrome extension or desktop tracker keeps heartbeat alive via /api/v1/pixel/ping.
Extension sends periodic pings to maintain attribution window. Tab visibility changes trigger reconnects.
Business fires POST to /api/v1/webhooks/conversion with token + orderId + amount. Last-click attribution wins.
Lock-and-key system: Box 1 → Box 2 → Box 3. Database triggers enforce ordering. No slot advances until the previous one is approved.
Creators get Box 1 → Box 2 → Box 3. Each slot unlocks only after business approval. Database trigger enforces ordering.
Each deliverable needs a unique hashtag. Verified via platform oEmbed API (Instagram, TikTok). Never scrapes pages.
Business reviews and approves each deliverable. Bulk-approve removed — one at a time for quality control.
Approved deliverable gets a unique tracking link. Creator shares it — sales attributed automatically.
Every layer is hardened — Stripe safety, database RLS, rate limiting, SSRF protection, and single-session enforcement.
Creator onboarding uses the latest Connect v2 API with platform-controlled account creation.
Every tracking link signed with HMAC-SHA256. 24-hour expiry prevents replay attacks.
Upstash Redis rate limiting on all public endpoints. Prevents abuse without blocking legitimate traffic.
URL validation blocks internal network requests. parsePublicHttpUrl validates all external URLs.
Every database table has Row Level Security. Users can only access their own data.
Each login stamps a random session ID. Newer logins supersede older ones across devices.
Supabase Postgres with Row Level Security on every table. 68+ migrations covering the full schema.
campaigns
Campaign definitions, budget, deadlines
deliverables
Sequential slots, status, hashtags
conversions
Attributed sales, amounts, tokens
ledger_entries
Hold/release/refund/chargeback
charge_retries
3DS retry queue for failed charges
payout_invoices
Monthly creator payout records
tracking_links
HMAC JWTs, clicks, attribution
applications
Creator campaign applications
messages
Real-time chat with PII filtering
reviews
Two-sided ratings, right-to-reply
business_profiles
Company info, verified domains
creator_profiles
Tiers, niches, social links
Create a free account, post your first campaign, and start tracking conversions today.