YoPekka — Multi-Vendor Marketplace With Access Control

The challenge

The client needed one platform to run two businesses at once: a multi-vendor marketplace and a set of private, vendor-branded storefronts sharing the same product catalog, order pipeline, and customer accounts. Template platforms force a choice between the two. We built from the ground up in Laravel instead — with vendor-level permission boundaries designed in before a single storefront feature was written.

The brief

Two businesses on one codebase: a multi-vendor marketplace and a set of private, vendor-branded storefronts sharing the same product catalog, order pipeline, and customer accounts. Off-the-shelf platforms force a choice between the two — a marketplace plugin here, a separate storefront theme there, with inventory synced by hand. We built from the ground up in Laravel instead, so one data model powers both.

What we built

Marketplace storefront with category, brand, and search filtering across every vendor’s catalog
Per-vendor branded storefronts that share inventory, orders, and accounts with the main marketplace — no duplicate data entry
Vendor onboarding flow gated by document-based KYC verification before a seller can list a single product
Five regional payment rails plus cash on delivery, so buyers pay however they already pay
Three courier-API integrations — automated label printing and real-time tracking from checkout to delivery
Inventory engine tracking per-vendor SKUs, low-stock alerts, and multi-warehouse stock levels
Admin dashboard built for a non-technical operations team, not developers

Security and access control

Every vendor gets the same storefront tools and none of the same visibility into each other’s data. Role-based permissions scope every query to the logged-in vendor’s own products, orders, and customers — the kind of boundary that, done wrong, turns into an IDOR vulnerability the moment vendor #2 changes an ID in the URL and sees vendor #1’s order history. We built the permission layer first and the features on top of it, then tested it by trying to break it: swapping IDs, replaying requests, probing admin routes from a vendor account. KYC verification gates onboarding before a new seller can publish a listing, and every admin action is scoped to least-privilege by role.

The stack

Laravel 12 with Livewire 4 and Alpine.js runs the admin; Tailwind 4 styles the storefronts. MySQL handles transactional data, Redis runs the queues and caching layer. TipTap powers the rich product-description editor vendors use to write their own listings.

Outcome

The marketplace went live nine weeks after kickoff. The first outside vendor onboarded in week ten. We’ve stayed on as the platform’s ongoing engineering team, shipping new features on a retainer basis since launch.