A marketplace where money can never move twice

Context

An NFL franchise wanted suite holders to buy, sell, and swap their seats in a flow that felt consumer simple, while carrying the full weight of a real marketplace underneath: seller KYC, payment capture, platform fees, ticket delivery, and compliant payouts.

Problem

The original plan was built on an escrow API that could not keep users inside the app for the payment flow, a hard product requirement it turned out nobody had validated. And beneath the product gap sat the harder engineering truth of marketplaces: webhooks arrive late or twice, retries happen, and any naive implementation eventually charges a buyer twice or pays a seller twice.

The decision

Replace the escrow provider with Stripe Connect, and structure the whole transaction as a state machine with idempotent transitions. Seller onboarding became a first class workflow (find or create the connected account, surface Stripe’s outstanding KYC requirements, block selling until compliant) rather than a one time checkbox. Payouts were gated: funds moved to the seller only after the ticket passed a verification step, with the platform retaining its fee.

REJECTED: two things. The escrow API, which broke the in app requirement outright; and durable workflow infrastructure (Temporal) in v1: real, but a scale problem the beta didn’t have. Moving it from P0 to P1 shipped the MVP on time and under budget.

Execution

Webhooks were treated as the source of truth for payment outcomes, with transitions safe under duplicate and out of order delivery. Tickets routed through a platform controlled relay and a verification check before release to the buyer; only then did the transfer to the seller fire, itself built with retries and enough observability to answer the operational question that actually matters in a marketplace: where is this money or ticket stuck, and why? I diagrammed the buyer and seller flows end to end to align internal and client stakeholders before the build, which is also what made the descoping conversation winnable.

Outcome

0 → 1

Marketplace shipped, onboarding through payout

Idempotent

Every payment and transfer transition

Verified

Tickets confirmed before funds release

Takeaway

In payments, design for the retry. Money that must never move twice beats a happy path that usually works.