Skip to content
Moeijiro
← All projects

Case study · Automation platform · marketing site

NexaFlow

Automation platform: a webhook starts a workflow that reshapes the data and notifies Discord, Telegram or any URL.

A visual builder, templated steps and a readable log of every run, plus the product's marketing site.

AutomationAPIs & IntegrationsFull-Stack Apps
Type
Personal open-source project
Automated tests
30 (pytest)
Built with
Python · FastAPI · SQLAlchemy
Live demo
Runs locally — not hosted
Execution detail with trigger payload, transformed payload and action result

Overview

What it does

NexaFlow is a full-stack automation platform: a marketing site, a developer dashboard and a Python backend that genuinely runs workflows. A workflow is one trigger, an optional JSON transform and one action. Three integrations exist and work; the rest of the effort went into credential handling, retries, an SSRF guard, ownership boundaries and an execution log.

Problem

Glue between services — “when the shop sends an order, post it to Discord” — tends to be a script nobody can inspect. When it fails, there's no record of the payload, the attempt or the answer.

Solution

An incoming webhook creates an execution row immediately and returns 202; the engine runs in the background, applies the transform, calls the destination with up to three attempts, and stores the trigger payload, transformed payload, attempts, duration and result.

Screenshots

From the running application

  • Execution detail with trigger payload, transformed payload and action result
    Execution detail with trigger payload, transformed payload and action result
  • Five-step workflow builder with a live pipeline summary
    Five-step workflow builder with a live pipeline summary
  • Marketing site hero with an interactive pipeline diagram
    Marketing site hero with an interactive pipeline diagram
  • Developer dashboard with executions and success rate
    Developer dashboard with executions and success rate
  • Workflow detail with its webhook URL and recent runs
    Workflow detail with its webhook URL and recent runs
  • API walkthrough in the dashboard
    API walkthrough in the dashboard

Captured from the app running locally with its seeded demo data. Select an image to open it full size.

Architecture

How the pieces fit

External serviceshop · form · CIDashboardcookie · API keyPOST /hooks/{token}size · HMAC · 202Management API/api/*Workflow enginebackground · 3 attemptsTransform{{dotted.paths}}DiscordTelegramHTTP APIExecutions
  • External service → POST /hooks/{token}
  • Dashboard → Management API
  • POST /hooks/{token} → Workflow engine
  • Management API → Workflow engine
  • Workflow engine → Transform
  • Transform → Discord
  • Transform → Telegram
  • Transform → HTTP API
  • Transform → Executions
  • Core service
  • External system
  • Storage / entry point

Core features

What's in it

  • Webhook triggers

    POST /hooks/{token} with a size limit, JSON parsing, token lookup and optional HMAC verification.

  • JSON transforms

    Reshape payloads with {{dotted.paths}}; templates substitute values and never evaluate anything.

  • Three real actions

    Discord webhook, Telegram Bot API and any-method HTTP calls, behind one adapter interface.

  • Background execution

    Up to three attempts with exponential backoff, only for failures a retry can fix (timeouts, 429, 5xx).

  • Execution history

    Payload at every stage, attempts, duration and error per run, filterable by workflow and status.

  • API keys

    nxf_live_… keys stored as SHA-256 digests, shown once and revocable, for scripts and CI.

Technical decisions

Interesting problems, and how they're solved

  1. 01

    A template language that can't run code

    Payloads are untrusted input, so the transform engine only resolves paths; missing paths are reported in the log instead of rendering “None”.

  2. 02

    The execution row exists before the first attempt

    The caller is never held open while a third party is contacted, and nothing is lost if the process dies mid-run.

  3. 03

    Two credentials, two jobs

    A workflow token can trigger its own workflow and nothing else; an API key can manage the account but is never used by the browser.

backend/app/services/templating.py · L26–44View on GitHub ↗
def resolve_path(payload: Any, path: str) -> Any:
    """Walk ``a.b.0.c`` through dicts and lists; return None when it breaks."""
    current = payload
    for part in path.replace("[", ".").replace("]", "").split("."):
        if part == "":
            continue
        if isinstance(current, dict):
            if part not in current:
                return None
            current = current[part]
        elif isinstance(current, list):
            try:
                current = current[int(part)]
            except (ValueError, IndexError):
                return None
        else:
            return None
    return current

Stack & skills

Built with

Technology

  • Python
  • FastAPI
  • SQLAlchemy
  • httpx
  • cryptography
  • Next.js
  • TypeScript
  • Tailwind CSS
  • Motion

What this project demonstrates

  • Workflow automation
  • Webhooks & HMAC
  • Background jobs & retries
  • Discord & Telegram APIs
  • Full-stack product

Repository & demo

Run it yourself

Seeded demo account: demo@nexaflow.dev / nexaflow-demo-1234.

No public live demo is hosted. Everything below runs locally with Python 3.12+ and Node 20+.

$ git clone https://github.com/Moeijiro/nexaflow.git
$ cd nexaflow
$ make install
$ make seed
$ make api
$ make web

Have a project in mind?

I build APIs, automation systems, Discord integrations and full-stack applications. Tell me what it should do and I'll tell you how I'd build it.