A members-only catalog of AI automation tools that members run on their own provider API keys, built for a solo builder shipping one new tool a week.
From empty repo to live billing in six weeks: 141 commits, 39 migrations, seven tools, and a $10 a month subscription taking real payments.
stack
The brief
The user is a solo builder who ships AI automation tools in public, one a week, and the audience who wants to run them. The spec states the problem as a cadence problem: at that rate the thing that stops you shipping is never the tool's own logic. It is the page, the form, the validation and the access rule around it.
Two constraints came fixed. Shipping tool twelve must not mean building screen twelve, so a tool is a database row and everything a member sees is edited from a dashboard. And members run tools on their own provider keys, so a key must never reach software the platform does not run.
gallery
The tool catalog
Every tool carries the providers it needs, so a member knows before they open it.
1 / 2
key decisions
01
Tools are rows, not pages
The form, validation, output rendering, access rule and rate limit are columns on a tools row. Shipping a new tool is one handler file and one function deploy; everything a member sees is then edited in the dashboard with no deploy at all.
02
The encryption key is not on Vercel
The browser posts a plaintext key straight to a Supabase edge function, which encrypts it there. Vercel holds nothing capable of decrypting a member's key, so a total compromise of the Vercel project yields ciphertext. This is why there is no external execution backend.
03
One access function, four clients
The web runner, the iframe embed, the desktop app and the Chrome extension all resolve entitlement through the same call and share one gate file. A licence endpoint saying active while a key endpoint says no access is a class of bug that only shows up in a user's hands.
how it went
14 July 2026
Spec and design system
The brief and the design document written and revised through an architecture review before the first line of code.
14 to 17 July 2026
Phases 0 to 10
Auth, catalog, application funnel, access engine, key vault, runner, admin editor, notifications, codes, community loop.
19 July to 25 August 2026
Visual system and external clients
Shared UI primitives, iframe embed tokens, the desktop app and Chrome extension backends, consent and key-release log.
26 August 2026
Live billing
Creem live at $10 a month, taking real payments.
27 to 29 August 2026
Credits and AI gateway
Prepaid ledger, provider-metered gateway, top-up checkout, legal pages.
results
6 weeks
first commit 14 July 2026, billing live 26 August 2026
the build, measured by git history
22
automated verification suites
run against the live database: row-level security, admin guards, the access engine, the vault, the runner, billing and legal copy
at launch, measured by repository
since launch Work continued past the billing go-live into prepaid credits, a metered AI gateway and top-up checkout, with the most recent commit on 29 August 2026.