MarketplaceBuddy | Launch Your Own Digital Products Marketplace

Run your own CodeCanyon. MarketplaceBuddy is a complete multi-vendor marketplace for templates, UI kits, plugins and scripts: authors apply, submit products, get reviewed and get paid, while buyers browse, purchase and download. You host it, you set the commission, you keep the platform.

It is one Next.js application and one PostgreSQL database. There is no second service to run, and we take no revenue share and charge no recurring fee for the software. docker compose up and you have a marketplace. It is self-hosted, so the server, domain, email and any payment gateway you connect are yours to arrange and pay for — see What this costs to run below.

What this costs to run (please read before buying)

This purchase covers the software only. MarketplaceBuddy is self-hosted, so you provide and pay for everything it runs on and connects to. None of the following is included in the purchase price, and none of it is billed by us.

• Server / VPS hosting — required. Roughly $12–24 per month is enough to launch.
• A domain name — required. Roughly $10–15 a year from your registrar.
• An SMTP email service (Postmark, Resend, Mailgun, Amazon SES, Gmail and similar) — required, because verification links, receipts and password resets all send mail. Free tiers exist; paid plans typically start around $15 a month.
• Payment gateways — Stripe, PayPal, Razorpay — optional. Each charges its own per-transaction fees, set by them and billed by them, under their terms and subject to their country availability. You will need an approved merchant account with whichever you choose.
• S3-compatible storage — Amazon S3, Cloudflare R2, MinIO — optional, and billed by usage.
• Redis and Meilisearch — optional accelerators only, and only if you choose to run them.

Two of those deserve to be precise, because they are the ones people assume are mandatory. You do not need a payment gateway to launch: a bank-transfer gateway is built in and takes orders with no third-party account at all. You do not need S3: storage defaults to the server’s own disk and works fully that way. Either can be added later without reinstalling.

Taxes and compliance obligations in your jurisdiction, any company or merchant account you need, and any custom development you commission are likewise yours.

Why this one

Money is a ledger, not a number. Author balances are never stored and edited. Every sale, refund, adjustment and payout is an immutable row, and balances are derived from them. Refunds are compensating entries, never edits. The database itself rejects updates and deletes on those tables, so the books cannot be quietly rewritten — by a bug, or by anyone with database access.

Payments that already work. Stripe, PayPal, Razorpay and manual bank transfer. Enable any combination, let the buyer choose at checkout, and optionally preselect a gateway by country. All four have been driven end to end against live sandbox accounts, not just unit tested.

One completion path. Card, wallet or bank transfer, every order is fulfilled by the same code under the same row lock, with the same licences, ledger entries, receipts and replay protection. There is no second-best path to reason about.

Tested where it counts. 534 unit tests and 88 browser tests, with the money paths — checkout, refund, payout, download — covered end to end in a real browser against a real database.

Runs as one vendor or a hundred. A single setting switches the whole product between multi-vendor and single-vendor. In single-vendor mode every author-facing surface disappears and the code behind it short-circuits, so you can sell your own catalogue today and open it to other authors later without migrating anything.

For buyers of your marketplace

• Catalogue with search, category browsing and filtering by technology stack, all reflected in the URL so any view can be linked and shared
• Product pages showing what a buyer actually wants before clicking: last updated, sales count, support window, version and framework
• Multiple licence tiers per product, defined by you — regular, extended, or any tiers you invent
• Cart and checkout for members and guests, with the guest cart preserved through sign-up
• Coupons, country tax rates and an optional buyer fee
• Instant delivery: licence codes, sequential invoices and signed, expiring, revocable download links
• Verified-purchase reviews with author replies, and a public question-and-answer thread per product
• Purchase history, re-downloads, licence codes and support windows in one account area

For your authors

• Public pitch page, application form and a review queue — you decide who sells
• Guided submission wizard: details, pricing tiers, versions, cover art and preview images
• Versioned releases with changelogs; a pending update never replaces the live file until it is approved
• Earnings dashboard with cleared, pending and reserved balances explained rather than asserted
• Withdrawal requests with a configurable minimum and clearing period
• Buyer messaging and support tickets, scoped to the products a buyer actually owns
• Author profile pages, follower counts and an author directory

For you, the owner

• Moderation queue with diffs between submitted versions, plus soft rejection with feedback
• Orders, refunds with automatic commission clawback, and a payout queue
• Commission rules globally, per category or per author
• Category management with nesting, ordering and technology-stack marks
• Homepage curation, a blog and CMS pages, with legal templates seeded to edit
• Newsletter with double opt-in and one-click unsubscribe
• SEO layer: canonical URLs, sitemap, structured data and social images
• Everything configurable from admin settings rather than environment files, including mail, storage, payments, tax, uploads and branding
• Immutable audit log of administrative and financial actions

Security

Security is built in rather than added later, and the specifics are written down so you can check them:

• Uploads pass one validation path: extension and MIME allowlists, magic-number checks, size limits from settings
• Images are decoded and re-encoded rather than stored as received, which strips anything hidden in them
• Product archives are never extracted on the server. They are inspected from the archive index and refused if any entry would escape its folder
• Product files are reachable only through signed, expiring, revocable tokens — never a public URL
• Stored HTML is sanitised through an allowlist wherever it renders
• Email and password authentication with verification, password reset, two-factor authentication and social sign-in
• Rate limiting and account lockout on authentication, webhook signature verification, and strict validation at every boundary

Installation

One command installs it. A first-boot wizard then checks your environment — database, schema, storage, and the authentication origin that catches the most common misconfiguration — before you create the first administrator. Outbound mail is tested by sending a real message rather than by checking that a form saved.

An in-app updater tells you when a new release exists and shows its changelog. Migrations are transactional, locked so two instances cannot collide, and safe to re-run.