PayLock AI

Inspiration

Small e-commerce teams and businesses hire freelancers and agencies for high-impact deliverables, like product launch pages, technical audits, and copywriting handoffs, but "done" is often undefined. Payment disputes usually start days earlier with an ambiguous brief or a deliverable that looks finished on the surface while a critical checkout link is broken underneath. We built Paylock AI so the agreement scope, the delivery evidence, and the PayPal delayed-capture payment decision live in one verifiable record.

What it does

Paylock AI is a milestone verification and PayPal delayed-capture workspace for freelance and agency work. It turns a project brief into structured milestones, verifies submitted deliverables against concrete acceptance criteria before money moves, and settles funds directly to the seller's connected PayPal account:

1. Define measurable milestones: The buyer enters a project brief and budget, and Paylock drafts milestones with clear acceptance criteria and an exact-cent payment split.
2. Onboard the seller and authorize funds on PayPal: Sellers connect their PayPal Business account via PayPal Partner Referrals v2, and buyers reserve funds per milestone using PayPal Orders v2 (intent: AUTHORIZE) without releasing payment upfront.
3. Verify delivery with AI and browser inspection: When the seller submits work, Paylock inspects the deliverable against the agreed checklist. For live websites, a Playwright Chromium and Amazon Nova 2 Lite agent tests the rendered page, mobile layout, and links, blocking release if a link returns HTTP 404 and requesting a specific fix. For written or HTML deliverables, Paylock checks structural rules and quotes supporting excerpts.
4. Release payment under buyer control: The AI never holds a payment tool. PayPal capture (Payments v2) only executes when the buyer approves release, or when a buyer-granted 24-hour exact-amount capture policy is active and every browser check passes. Every order, authorization, capture, and evidence packet is saved in one audit trail.

Example use cases

• E-commerce storefront launches: A brand hires a web studio to build a product page. Paylock's browser agent verifies the product heading, shipping promise, 390px mobile layout, and follows the Buy now button to confirm /checkout returns HTTP 200 before capturing the milestone payment.
• Copywriting, technical specs, and audits: A startup commissions a launch copy deck or SEO audit. Paylock evaluates the submitted draft line by line against the buyer's required sections, flags missing deliverables for revision, and generates a downloadable JSON dispute packet if contested.
• Multiparty agency projects: A digital agency delivers multi-stage client work where each milestone is authorized upfront via PayPal Orders v2 and captured directly to the agency's verified PayPal merchant account via PayPal-Auth-Assertion as each stage passes verification.

How we built it

• Frontend & Server: Next.js 16 App Router, React 19, TypeScript, Tailwind CSS, Better Auth (AUTH_MODE=accounts + one-click Judge Quick Access role switching).
• Database & Concurrency: Prisma 6.12 + SQLite using integer USD cents, an in-process serialized mutation lock (src/lib/locks.ts), and deterministic SHA-256 PayPal-Request-Id idempotency keys.
• PayPal Integration:
  • Orders v2 (AUTHORIZE) & Payments v2 (Capture): Strict verification of currency, cent amount, reference_id, and payee merchant_id, plus server-side lost-callback authorization recovery (POST /api/paypal/recover-authorization) and expired unapproved order reset.
  • Multiparty Seller Routing (Partner Referrals v2 & Merchant Integrations v1): Seller onboarding and readiness verification with unsigned JWT PayPal-Auth-Assertion and PayPal-Partner-Attribution-Id headers.
• AI & Browser Verification:
  • Amazon Bedrock Converse (us.amazon.nova-2-lite-v1:0): Structured JSON milestone planning, criterion-by-criterion text evaluation, and multi-step browser tool selection.
  • Playwright Chromium & SSRF Guardrails: Read-only browser context with JavaScript disabled, same-origin enforcement, public-IP DNS validation, and Chromium --host-resolver-rules DNS pinning (src/lib/agent-network.ts).

Challenges we ran into & What we learned

• Separating AI observation from payment authority: The LLM never holds a payment tool. It can only call inspection tools; deterministic server code checks the buyer's 24-hour, exact-amount permission before calling PayPal Capture.
• Resilient payment state machines: Real browser checkouts can lose popup callbacks or leave unapproved orders overnight. Adding server-side order reconciliation, expired-order recovery, and strict recipient pinning (payeeMerchantId + payeeUserId) made multiparty PayPal settlements reliable end to end.

What's next for Paylock AI

Our vision for Paylock AI is to become the trust and settlement layer for global digital work, making "evidence before payment" the standard for every freelance contract, agency engagement, and B2B deliverable:

• Every digital deliverable, verified automatically: Expand beyond storefronts and written specs into Figma design handoffs, GitHub pull-request & CI/CD milestones, video production deliverables, and SEO/analytics performance targets.
• Embedded "Verify & Pay with Paylock" for marketplaces and agencies: Launch a drop-in SDK and PayPal commerce plugin so freelance platforms, design studios, and dev agencies can offer milestone-backed PayPal delayed capture out of the box without building their own escrow or QA tooling.
• Instant AI-assisted dispute resolution: Turn Paylock's structured evidence packets into a fast, neutral arbitration workflow with partial-release and split-settlement options, eliminating weeks of chargeback friction for both buyers and sellers.
• Settlement rails for the agentic economy: As businesses increasingly hire both human specialists and autonomous AI agents to ship digital work, Paylock provides the bounded permissioning and independent verification layer required before real money moves.

Built With

• amazon-bedrock
• amazon-nova
• aws-lightsail
• better-auth
• caddy
• nextjs
• paypal
• paypal-orders-v2
• paypal-partner-referrals
• playwright
• prisma
• react
• sqlite
• tailwindcss
• typescript