PazaLink Trade Desk

Inspiration

Changed beneficiary details and ambiguous invoice references deserve a second look before payment. PazaLink brings those checks into a small workspace for East African cross-border trade teams.

What it does

Google sign-in protects an owner-scoped Firestore invoice workflow. Gemini 3.8 Flash, through Firebase AI Logic with enforced App Check, returns reconciliation checklists. AI cannot authorize payment. A separate PayPal sandbox flow creates an order, requires generated-buyer approval, verifies the exact amount and signed user-bound receipt, and confirms only a matching completed capture.

How it was built

Python/FastAPI handles Firebase token verification, invoice operations and PayPal Orders API calls. The browser uses a unified Firebase SDK bundle. Model responses are validated and the action is fixed to human review. Server secrets and the private local App Check debug token are excluded from the public source.

Significant hackathon updates

The existing prototype gained genuine Firebase sign-in and invoice storage, structured Gemini review, guarded PayPal order approval/capture, signed one-hour receipts, retry reconciliation, tests and an actual walkthrough.

Validation

55 offline tests pass. Separate live browser checks verified sign-in, invoice creation/read-back, complete Gemini checklists, rejected capture before approval, fictional USD 1.00 order 74N421906U918074A, completed capture 798282074M801545V, repeat reconciliation and sign-out. No real funds moved. All transaction data and overview metrics are explicitly synthetic.

Challenges and limits

A unified SDK bundle resolved Firebase component registration. A later Gemini request returned a temporary high-demand error; failure stayed visible. The local build is runnable with complete judging instructions. No hosted production service, bank, FX, M-Pesa, blockchain or Nebius inference is claimed. Live two-user and revoked-token exercises remain pending.

Run the demonstrated build

Use branch codex/validated-review-demo, not the older main branch. Public MIT-licensed source: https://github.com/chrisndirangu54/pazalink-trade-desk/tree/codex/validated-review-demo Complete setup and test workflow: https://github.com/chrisndirangu54/pazalink-trade-desk/blob/codex/validated-review-demo/docs/JUDGES.md Use your own free Firebase project and PayPal sandbox credentials. Never publish Admin credentials or local debug tokens. Public hosting is optional under the official rules.

What was learned and what comes next

Configured credentials are not proof of working integrations. Processor confirmation, strict output checks and explicit failure states matter. Next steps are production attestation, scoped deployment credentials, live multi-user security exercises and durable webhook/fulfillment validation.

Built With

• css
• fastapi
• html
• javascript
• python