How Adswish works
A complete look at the backend architecture — from campaign creation to creator payout, every step is explained below.
Watch a campaign move from brief to payout
See how a business and creator collaborate on Adswish, step by step. This demo never charges a card or writes to the database.
Interactive demo · simulated only
Watch a campaign move from brief to payout.
See how a business and creator collaborate on Adswish. This demo never charges a card or writes to the database.
Now: Campaign brief and terms are published.
See the fee on a real sale
Drag the amount — the numbers come from the same payout maths the platform runs on every order.
What each payment costs
Choose how the campaign is paid. The creator fee and Stripe processing estimate use the same formulas as live payments.
Your card is charged when a verified sale arrives.
Business pays
- Campaign amount
- £50.00
- Stripe processing estimate
- £2.78
- Card total estimate
- £52.78
Processing is recharged at cost — reconciled monthly at Stripe’s actual cost, with no platform markup.
Creator receives
- Creator share
- £40.00
- Platform fee
- £10.00
- Minimum-fee rule
- Applied
The creator’s share is held for 7 days, then included in the next payout.
The platform fee is 10% with a £10 minimum on smaller orders, capped at the order value. Separated changes when the card is charged, not the 90/10 split.
Tech stack
Next.js 16
App Router + Turbopack
Server components, API routes, middleware
Supabase
Postgres + Auth + Storage
Database, authentication, file storage, realtime
Stripe Connect
Payments + Payouts
Destination charges, transfers, onboarding
Upstash Redis
Rate Limiting
Serverless Redis for rate limit counters
Route Handlers
Tracking Redirects
/t/{slug} redirects with JWT verification
Playwright
E2E Testing
Full browser automation for integration tests
Research & briefs: the Intelligence suite
The other half of Adswish — everything that happens before a campaign exists: find winning ads, keep them, brief creators, and plug in the tools you already use.
Discovery
A free, opt-in community ad library: keyword search, plus smart search that finds ads by meaning on your own AI key. AI grades any creative's scroll-stopping power and response clarity with one actionable note — and saved searches alert you when new ads match.
Swipe file & share pages
Save winning ads into your private library, organize them into boards, and share boards or briefs on public read-only pages at /b/<token> with view counts. Unshare and the link dies instantly.
Two-sided briefs
Businesses write briefs from goal templates or draft them with AI; creators browse open briefs and pitch their deliverable plan. Approving a pitch creates a normal pending application — no money moves at pitch time.
BYOK AI keys
Every AI feature runs on the key you connect — OpenAI, Anthropic or Google for text, Deepgram for transcription: stored AES-256-GCM encrypted and write-only, so the platform never pays per call and no key can ever be read back.
Chrome ad-saver
A zero-dependency extension saves ads from the Meta, TikTok, LinkedIn and Google ad libraries straight into your swipe file, source URL and copy included.
Integrations hub
One page for everything that plugs in: AI keys, the ad-saver extension, social accounts and Google Ads.
Payment flow
From business card to creator payout — fixed fees are reserved on the card up front and captured only on approval. Earnings sit behind a payment hold with a hold window before payout.
Payment summary: card saved, then reserve or charge, then capture, then ledger hold, then a 7-day hold, then payout.
Step 1 of 6: Business saves card
Stripe Customer created with a saved default payment method. Card details never touch Adswish servers.
Step 2 of 6: Funds reserved or conversion fires
Fixed-fee campaigns reserve the full amount on the business card at acceptance via Stripe manual-capture pre-authorization. Affiliate & hybrid campaigns charge per conversion instead, when the conversion webhook fires. Grouped campaigns draw from a pre-funded pot (the card is charged at top-up, never per conversion), and upfront-budget campaigns authorise the full budget cap at publish, capturing exactly what was earned when the campaign ends.
Step 3 of 6: Capture at approval
Fixed fees are captured only when the business approves the deliverable — unapproved portions are released back to the card. Affiliate & hybrid charges run off-session against the saved default payment method: 90% to the creator, 10% platform fee (flat 10%, minimum £10 on small orders). A charge that needs 3-D Secure is queued in charge_retries for completion, never instantly reversed. Dispute-granted refunds return 100% of the order to the business in cash; the party responsible for the refund pays a 10% processing fee (min £2.50, cap £50).
Step 4 of 6: Ledger entry created
Hold entry (+creator cut) recorded in the ledger with status pending_hold. The money sits in the platform balance under a payment hold — not escrow — until the hold window ends.
Step 5 of 6: Hold period
The release-holds job runs hourly and releases holds once their uniform 7-day window ends. Released earnings go out in the weekly payout run to the creator's Connect account once their balance clears the £25 minimum. Unused pre-authorizations auto-void within 7 days.
Step 6 of 6: Creator payout
Creator onboarding via the Connect Accounts v2 path, then transfers to the creator's bank. Weekly payouts gated by a minimum balance and an approved tax form; payout invoices generated monthly.
Key records: charge_retries queues 3-D Secure charges awaiting completion · pending_hold marks earnings waiting out the hold window · payout_invoices records monthly payouts.
Charging modes in detail
Your card behaves differently depending on the charging mode you pick when creating a campaign. Expand a mode to see its exact lifecycle.
Separated (pay per post / per sale)All campaign types — the default
Fixed fees reserve on your card at acceptance and capture when you approve. Affiliate & hybrid charge your saved card per verified conversion.
- Creator accepted → the fixed fee is pre-authorised on your card (held, not charged).
- Deliverable approved → the fee captures; unapproved portions release back automatically.
- Affiliate/hybrid sale verified → an off-session charge fires on your saved card, 90% to the creator on standard orders (the platform fee is a flat 10%, with a £10-equivalent minimum on small orders — see the fee calculator for the exact split).
- A charge needing 3-D Secure queues in charge_retries and completes when you approve it — it never reverses the sale.
You are never charged for work you did not approve.
Grouped (pre-funded pot)All campaign types — multi-creator
Top up a campaign wallet up front; approved posts and verified sales draw from the pot. The card is charged at top-up only — never per conversion.
- You top up the pot → the card is charged once, at top-up.
- Creators are accepted → the pot is split between them (equal or custom weights, set in the wizard).
- Approvals / sales → each creator's share draws down from the pot, 90/10 as always.
- Pot empty → the campaign pauses automatically; it never overdraws.
- Campaign ends with money left → the remainder is refunded to your card.
Best for budget certainty: the card can never be charged beyond what you put in.
Upfront budget authorisationAffiliate & hybrid only
We authorise the full budget cap on your card when you publish — nothing is taken. At campaign end we capture exactly what was earned; Stripe releases the rest.
- Publish → the budget cap is pre-authorised on your card (held, not charged).
- Sales record against the held amount as they come in — the hold clock stays paused.
- Campaign ends → the total earned is captured in one charge.
- The unspent remainder releases back to your card automatically.
- The authorisation renews every 6 days via the maintenance sweep while the campaign runs (Stripe voids manual captures at 7 days).
Guarantees budget for bursty sales volume without per-sale charges.
Tracking & attribution
Redirect links carrying HMAC-signed JWTs. Single-use tokens tie each click to exactly one order. The paste-in pixel keeps the heartbeat alive.
Step 1 of 4: Tracking link created
The /t/{slug} route signs a JWT with HMAC and a 24h expiry. Its redirects carry the attribution token to the business site.
Step 2 of 4: Click captured
The /t/{slug} link 302-redirects to the business URL with the signed token appended. Revoked or expired links return 410 Gone instead of redirecting, so leaked links die cleanly.
Step 3 of 4: Heartbeat maintained
A one-line paste-in pixel on the business's site POSTs a heartbeat to /api/v1/pixel/ping, keeping affiliate & hybrid campaigns live (rate-limited per business). If it stays silent, the business is warned twice and the campaign auto-pauses — attribution can't silently rot.
Step 4 of 4: Conversion recorded
Business fires POST to /api/v1/webhooks/conversion with token + orderId + amount, signed with their own webhook secret (HMAC-SHA256 — enforced). Each token is single-use and each order converts once. One click on the Tracking page dry-runs the whole pipeline before the first real sale.
Key routes: /t/{slug} edge redirect · /api/v1/pixel/ping heartbeat · /api/v1/webhooks/conversion conversion webhook (per-business shared-secret HMAC, enforced).
Sequential deliverables
Lock-and-key system: Box 1 → Box 2 → Box 3. Database triggers enforce ordering. No slot advances until the previous one is approved.
Step 1 of 4: Sequential slots
Creators get Box 1 → Box 2 → Box 3. Each slot unlocks only after business approval. A database trigger enforces the ordering.
Step 2 of 4: Hashtag verification
Each deliverable needs a unique hashtag. Verified against real post metadata from the platforms' own APIs or oEmbed (Instagram, TikTok, YouTube) — misses go to manual review. Never scrapes pages.
Step 3 of 4: Business approval
Business reviews and approves each deliverable — one at a time, or approve all pending from a single creator in one click.
Step 4 of 4: Tracking link generated
Approved deliverable gets a unique tracking link. Creator shares it — sales attributed automatically.
Security & hardening
Every layer is hardened — Stripe safety, database RLS, rate limiting, SSRF protection, and single-session enforcement.
Stripe Connect v2
Creator onboarding uses the Connect Accounts v2 path with platform-controlled account creation.
HMAC JWT tokens
Every tracking link signed with HMAC-SHA256. 24-hour expiry prevents replay attacks.
Rate limiting
Upstash Redis rate limiting on the abuse-prone public endpoints — sign-ins, tracking redirects, the conversion webhook, AI calls. Prevents abuse without blocking legitimate traffic.
SSRF protection
URL validation blocks internal network requests. parsePublicHttpUrl validates all external URLs.
RLS policies
Every database table has Row Level Security — user data is scoped to its owner, and public catalogs are read-only.
Single-session
Each login stamps a random session ID. Newer logins supersede older ones across devices.
Sign-in + MFA
Google or password sign-in opens an AAL1 session; accounts with a verified TOTP factor complete the challenge on /mfa to reach AAL2. Admins must reach AAL2 before touching /admin, and /login stays reachable so MFA-pending users can switch accounts.
This architecture is running now
Everything described on this page is live code, not a spec. These aggregates come from the same health checks and job monitors the status page publishes.
Live right now
Checking…
Aggregated health checks + supervised cron freshnessFull status
Core database tables
Supabase Postgres with Row Level Security on every table. 120+ migrations covering the full schema.
campaigns
Campaign definitions, budget, deadlines
deliverables
Sequential slots, status, hashtags
conversions
Attributed sales, amounts, tokens
ledger_entries
Hold/release/refund/chargeback
charge_retries
Queued 3DS charges awaiting completion
payout_invoices
Monthly creator payout records
tracking_links
HMAC JWTs, clicks, attribution
applications
Creator campaign applications
messages
Real-time chat with PII filtering
reviews
Two-sided ratings, right-to-reply
business_profiles
Company info, verified domains
creator_profiles
Tiers, niches, social links
Straight answers
The questions businesses and creators actually ask about the money path, answered with the same numbers the code enforces.
When exactly is my card charged?
It depends on the campaign's charging mode. Fixed fees are pre-authorised (held, not charged) when a creator is accepted and captured only when you approve their deliverable. Affiliate and hybrid campaigns charge your saved card per verified conversion. Grouped campaigns charge the card once, at pot top-up. Upfront-budget campaigns authorise the full cap at publish and capture exactly what was earned at campaign end.
How much does Adswish take?
10% of every transaction, with a £10-equivalent minimum on smaller orders — the fee is never more than the order itself. The fee funds the platform; Stripe's processing costs (card fees, currency conversion) are charged to businesses separately, at cost with no markup, and reconciled monthly against Stripe's actual fees. Creators receive 90% on standard orders.
Why do creators wait 7 days for payouts?
Earnings sit in a uniform 7-day hold window before they are released and become payable. That window covers refunds, disputes, and chargeback clawbacks without Adswish ever chasing creators for money already paid out. Payouts then run weekly to the creator's Connect account, gated by a £25 minimum and an approved tax form.
What happens if a charge needs 3-D Secure?
The charge is queued in the charge_retries table and the hold clock pauses until it completes — never instantly reversed. The business completes the 3-D Secure step via their dashboard link within 7 days; when it completes, the hold clock starts and the creator is paid on the normal schedule. If the step never happens, the sale is reversed after the window lapses.
Can a tracking link be replayed or forged?
No. Every /t/{slug} redirect carries an HMAC-SHA256-signed JWT that expires after 24 hours. Each token is single-use (the jti is burned on first conversion) and each order can convert exactly once — a database-level unique index enforces it.
What happens if a refund is granted?
The business receives 100% of the order back in cash, and the creator's held earnings reverse proportionally (or a payout hold is placed if earnings already released). The party responsible for the refund pays a 10% processing fee (min £2.50, cap £50). Chargebacks are exempt from the fee.
Do you verify the posts creators submit?
Yes — each deliverable requires a unique hashtag, verified against real post metadata from the platforms' own APIs or public oEmbed (Instagram, TikTok, YouTube) rather than trusting the submitted URL. When neither can see the post, the deliverable goes to manual review instead of passing silently. The platform never scrapes social pages.
Is this page kept up to date with the actual system?
It is generated from the same source of truth as the code: the payment constants (hold window, fee floor, split) are pinned by an automated test that reads the page copy against the codebase, and the Live status card fetches real health-check aggregates. If a fact here drifts from the system, CI fails.
Do the AI features run on Adswish's own AI account?
No — every AI feature (smart search, creative scoring, brief drafting, script generation) runs on an API key you connect yourself — OpenAI, Anthropic or Google for text, Deepgram for transcription. Keys are stored AES-256-GCM encrypted and are write-only: nobody, including you later, can read one back — you can only replace or remove it. That keeps AI costs on your own account.
What happens when a creator pitches on my brief?
A pitch is just a proposal — one short free-text write-up of your plan (up to 2,000 characters). Reviewing and approving a pitch creates the same pending application a campaign invite creates, so the normal accept-and-pre-authorise flow still governs every pound. Nothing is charged, reserved, or released at pitch time; money only moves once you accept the application under a charging mode.
Ready to see it in action?
Create a free account, post your first campaign, and start tracking conversions today.