Agrovio
AgTech produce marketplace
Live in production at agrovio.io, running the client's entire public presence, lead intake, and member access on infrastructure the client owns; the site's published network spans 150+ growers and processors across 20+ regions.
Crate 1 of 10. Sort the Wheat.
Opens the public agrovio.io marketing site. The marketplace itself is invite-only.
Open public site ↗︎Built for the client as an invite-only marketplace, so source and the marketplace app stay private; agrovio.io is the public site. Glad to give a walkthrough.
Request accessAgrovio is an invite-only B2B marketplace connecting growers and acopio (processing) operations with verified produce buyers across Peru and Latin America. This build is its entire public platform, shipped for the client and live at agrovio.io on the client's own Vercel and Supabase accounts: marketing site, lead pipeline, invite-only auth, and a hidden admin portal.
The marketing site (home, producer, and buyer pages) was rebuilt by hand from the client's Framer designs on Next.js 16, TypeScript, and Tailwind v4, including the responsive mobile layout the desktop-only design lacked.
Behind it sits real infrastructure: invite requests are Zod-validated and stored in Supabase under insert-only RLS with a honeypot and per-IP rate limiting, and a failed Resend notification flags the row instead of losing the lead; auth is invite-only with public signups disabled; and a hidden admin portal, a 404 for anyone but allowlisted admins, lets the client review leads, issue invites, and reversibly ban or restore members. The marketplace screens themselves (bid and counter-bid negotiation, WhatsApp alerts, price trends) are the client's product, presented across these pages.
- Next.js
- React
- TypeScript
- Supabase
- Resend
- Zod
Architecture · public site → lead pipeline → invite-only access → hidden admin
Marketing site
Home, producer, and buyer pages rebuilt by hand from the client's Framer designs on Next.js 16 + Tailwind v4, with the responsive mobile layout the desktop-only design lacked.
Lead pipeline
Invite requests validate with Zod, insert into Supabase under insert-only RLS with a honeypot and per-IP rate limiting (hashed IPs), then notify the team via Resend. A failed email flags the row, so no lead is lost.
Invite-only auth
Public signups are disabled: accounts exist only when the admin invites them. Self-contained verifyOtp links drive the invite and password-reset flows.
Hidden admin portal
/admin returns a 404 for anyone but allowlisted admins. Inside: review and accept leads, generate invite and reset links, and reversibly ban, restore, or delete members via the service-role Auth Admin API.
Hardening + deploy
CSP, HSTS, and frame-deny headers, version-controlled Supabase migrations, a one-page recovery runbook, deployed on the client's Vercel at agrovio.io.
- Regions
- 20+
- Produce varieties
- 22+
- Network
- 150+ growers & processors
What I'd improve
Two gaps are known and queued: invite and reset emails need a verified sending domain, so the admin still shares copy-able links instead of the system emailing them, and the rate-limit table has no scheduled cleanup yet (a pg_cron sweep is the plan). The bigger one is language: the product is marketed bilingual but the site ships English-only today, so a real EN/ES locale layer is the next feature worth building.