Case study/SaaS platform/2026
SeloraX Messages
A multi-tenant SMS gateway for Bangladesh where every message is paid for exactly once.
- Next.js
- TypeScript
- Prisma
- MariaDB
- Better Auth
- Vitest
01The problem
Businesses in Bangladesh needed one place to send SMS through their own accounts: separate teams, separate API keys, separate balances, all on a shared platform.
Because every message costs money, the hard part wasn't sending. It was making sure credit is never lost, never double-charged, and always explainable when a customer asks where it went.
02How it fits together
Money only moves through the ledger: top-ups credit it, sends debit it first, rejected sends refund it.
03Decisions
- 01
An append-only ledger, not a balance column
Every top-up, debit, and refund is its own row; the balance is the sum. Nothing is ever overwritten, so two requests can't silently clobber each other, and any balance can be explained line by line.
- 02
Debit before dispatch, refund on rejection
Credit is taken atomically before a message leaves, so nothing is sent unpaid even if two sends race. When the operator rejects a message, the refund is another ledger row, so the customer is made whole and the history stays honest.
- 03
Verify top-ups server-to-server
A top-up only counts after the EPS payment gateway confirms it directly to the server, never on the strength of a browser redirect that a user could fake or replay.
- 04
Idempotent retries in a versioned API
Clients can safely retry a request after a timeout without sending (or paying for) the message twice. Versioning (/v1) lets the API evolve without breaking integrations already in production.
04Trade-offs
- Delivery reports are polled rather than pushed, which keeps the gateway in control of timing; the cost is that a status updates on the polling interval, not instantly.
- An append-only ledger grows forever and reading a balance means summing rows; that's paid for with indexes (and snapshots once volume needs them) in exchange for a complete audit trail.
05Results
- Live at sms.selorax.io, with self-service top-ups verified through EPS.
- A versioned public REST API with idempotent retries and rate limiting for integrations.
- Per-recipient link tracking and an audited admin panel for support and operations.