A multi-tenant B2B platform for WhatsApp Business campaigns through Twilio: organizations, contacts and lists, message templates with WhatsApp approval, and bulk sending.
My role
Backend developer. Built the API, tenant credential storage, authentication and the sending pipeline.
Stack
Go
Echo
PostgreSQL
Supabase Auth
Twilio
GCP Secret Manager
The problem
Each customer brings their own Twilio account, so credentials must be stored safely per tenant, templates have to pass WhatsApp approval, and a campaign to thousands of contacts can't be sent one by one inside a request.
Architecture
An Echo API on PostgreSQL (GORM) authenticates users through Supabase or by API key. Tenant Twilio credentials live in GCP Secret Manager and are fetched at send time. Campaigns fan out to a worker pool that sends messages through Twilio and collects per-contact results; phone numbers are normalized to E.164.
Key decisions
01Tenant secrets outside the database
Why
Every customer's Twilio credentials are kept in GCP Secret Manager, not in PostgreSQL, so a database leak doesn't expose them and secrets can be versioned and rotated.
02A worker pool for sending
Why
A fixed pool of goroutines sends in parallel while keeping concurrency toward Twilio bounded.
Trade-off
Results arrive out of order and have to be matched back to contacts.
03Two ways to authenticate
Why
People use Supabase sessions in the web app, integrations use API keys. A key is stored twice: as a bcrypt hash to look it up and as AES-GCM ciphertext so its owner can reveal it again.
What I built
Organizations, users, contacts, contact lists and message templates
Template creation and WhatsApp approval requests through the Twilio Content API
Bulk sending through a pool of 10 goroutines with job and result channels
Per-tenant Twilio credentials stored in Google Cloud Secret Manager
Supabase Auth or API keys — bcrypt-hashed for lookup, AES-GCM-encrypted for reveal