XcroPay Technical Case Study

Tech At A Glance

Why It Matters To Recruiters

• Owned a multi-surface fintech build across web, mobile, admin, API, database, and shared packages.
• Modeled escrow as a state machine instead of scattering transaction rules across UI handlers.
• Kept money movement server-side with payment verification, webhook reconciliation, and admin-gated exceptions.
• Used shared TypeScript/Zod contracts so API, admin, and mobile surfaces agree on request shapes and domain enums.
• Designed operational tooling for launch readiness: audit trails, exports, admin actions, queues, and provider health checks.

Platform Surfaces

Problem

Informal online commerce creates risk on both sides: buyers worry about paying before delivery, sellers worry about releasing goods before funds are secured, and operators need a defensible way to settle disputes. XcroPay solves that with an escrow workflow that holds funds, records evidence, verifies identity, and keeps every sensitive transition auditable.

Architecture

• pnpm/Turborepo workspace separates `apps/web`, `apps/admin`, `apps/api`, `apps/mobile`, and `packages/shared` while sharing strict TypeScript contracts.
• API routes stay thin: middleware handles auth/rate limits/validation, controllers translate HTTP requests, and services own escrow business logic.
• Supabase stores users, KYC records, bank accounts, transactions, disputes, evidence, messages, ratings, notifications, admin actions, and operational queues.
• The transaction lifecycle is represented as allowed transitions: created, accepted, funded, delivered, inspection, completed, disputed, resolved, cancelled, and refunded.
• Webhook events are queued with idempotency keys, claimed by workers, retried with backoff, and dispatched to provider-specific handlers.
• Notifications are written in-app immediately and fanned out through an outbox for push, email, and SMS delivery without blocking the main request path.

Escrow Workflow

Key Engineering Highlights

• Implemented kobo-only money math and fee helpers to avoid floating-point currency errors.
• Added conditional transaction updates so stale clients or competing webhooks cannot silently overwrite state.
• Built Paystack charge, transfer, refund, bank, and webhook wrappers behind service-layer orchestration.
• Added QoreID identity checks for BVN/NIN verification while storing only hashed identity references in app tables.
• Created file upload and signed URL flows for delivery proof, dispute evidence, profile assets, and private storage buckets.
• Added export paths, pagination helpers, reference generation, structured API responses, and typed error classes for a consistent backend contract.

Security & Privacy

• Row Level Security policies protect participant-scoped records at the database layer.
• Supabase JWT verification is paired with app-level profile checks, session revocation, and protected admin cookies.
• Admin-sensitive actions require role/permission checks, fresh MFA step-up, CSRF protection for cookie sessions, and audit logging.
• Rate limits are backed by database counters so throttling works across multiple API instances.
• Webhook handlers verify provider signatures before queueing work and ignore duplicate deliveries through idempotency keys.
• Portfolio copy intentionally omits repository access, credentials, provider configuration, customer data, and internal handoff details.

Product Evidence

The public-facing website is shown here because the source repository is closed. Screenshots are safe to share and demonstrate the product positioning, visual system, and escrow-first user education.

Trade-offs

• Chose a modular monorepo over separate repositories so shared domain contracts could evolve quickly during buildout.
• Used Supabase for database, auth, realtime, and storage to reduce early operational burden while still enforcing RLS and migrations.
• Kept the API as a well-layered service rather than splitting microservices before the transaction model stabilized.
• Introduced durable queue tables for webhook and notification processing instead of relying only on in-memory side effects.
• Separated the admin portal from the consumer app to keep operational controls behind stricter auth, permissions, and UI patterns.