Inspiration Honestly, most creator tools out there just give you a basic link-in-bio or take a massive cut of your sales without offering any real commerce features. We wanted to build a unified storefront where creators actually own the checkout experience and can negotiate private, expiring offers directly with their audience, turning casual fans into a real revenue channel.
What it does Zyrelyx is a full-stack digital marketplace where creators can link their Google/YouTube accounts, upload digital assets, and sell them through a custom public profile. The coolest part is the private offer system—buyers can negotiate a price through a chat interface. If our backend rules engine accepts it, the system generates a time-bound Razorpay checkout at that exact price, keeping all the pricing logic safely on the server instead of trusting the browser.
How we built it We built the client using Next.js 16 App Router and Tailwind CSS, keeping the UI snappy while handling session checks server-side. The brains of the operation is a NestJS 11 API backed by PostgreSQL (via Prisma) and Redis for session management. For the private offers, we set up a same-origin BFF route (/api/negotiate) in Next.js to proxy requests to the backend, ensuring HttpOnly session cookies are forwarded without ever being exposed to client-side JavaScript. We also integrated UploadThing for asset delivery and Resend for email receipts.
Challenges we ran into Figuring out the Razorpay Route onboarding and signed webhooks was a huge headache because testing local webhooks against the API required a lot of trial and error with tunnel configurations. We also spent a ton of time locking down the trust boundaries—making sure that a user couldn't just spoof a successful payment or change a product's price from the browser required us to build a strictly deterministic rules engine and HMAC verification flow in NestJS.
Accomplishments that we're proud of I'm really proud of how robust the backend security turned out. Instead of just blindly trusting the frontend, the API actually binds UploadThing image proofs to the authenticated creator before publishing a product, and the entire 90/10 revenue split calculation happens atomically in Postgres only after we cryptographically verify Razorpay's transaction signatures.
What we learned We learned the hard way that managing state between a Redis-backed Passport session and Next.js server components is tricky, especially when you factor in cross-origin Google OAuth callbacks and strict CORS allowlists. We definitely leveled up our understanding of how to build secure trust boundaries between a decoupled frontend and backend.
What's next for Zyrelyx Creator Storefront & Asset Monetization Ecosystem Right now, stuff like pending-order cleanup, offer expiration, and analytics flushing runs in-process on the API. Our next big move is extracting all that into a distributed Redis worker queue so we can safely scale the Nest backend horizontally. We also want to implement a global rate limiter and proper CSRF protections before opening it up to real production traffic.
Built With
- codex
- gpt5.6
- neondb
- nestjs
- nextjs
- razorpay
- redis
- uploadthing
- youtube-data-v3-api
Log in or sign up for Devpost to join the conversation.