DEV3 Technologies home

DEV3 Kitlane – Digital Products Marketplace Laravel Script with Licences, Author Payouts & Review Queue

A self-hosted marketplace for themes, code, fonts, audio and ebooks on Laravel 12 and Filament 4: purchase-code licences, signed single-use downloads, a review queue, author KYC and levels, wallet ledger, VAT, refunds, fraud flags and a verification API.

by DEV3 TechnologiesVerified Author(0) 0 sales 0 viewsUpdated 04 Nov 2026

Video tour. Pick a section below to browse 117 screenshots in 6 sections.

Kitlane is a self-hosted marketplace for digital products, built by DEV3 Technologies on Laravel 12, Filament 4 and Livewire 3. Authors sell themes, code, graphics, fonts, audio, ebooks and templates; buyers pick a regular or extended licence, pay, and download through short-lived signed links. Every sale becomes a licence with a purchase code, and every cent moves through a wallet ledger. Three panels share one installation: /admin for the marketplace team, /studio for authors and /account for buyers. It is a web product only: there are no mobile apps.

No live demo: the 117 grouped screenshots and the two video tours (about two minutes on desktop, about 70 seconds on a phone) show the storefront, checkout, vault, Studio and admin. Install it with the bundled demo data (the fictional Kitlane catalogue) to try each role on your own server.

Catalogue and discovery

  • Seven kinds of product with a category tree: themes, code, graphics, fonts, audio, ebooks and templates, plus sub-categories, tags, compatibility and file-type attributes.
  • Faceted browse and search: category, price range, rating, licence, tags, compatibility and on-sale filters, with counts that take every other active filter into account. Instant search suggestions, a mega menu and sorting.
  • Item pages with a gallery and lightbox, a regular and extended licence picker, a sale countdown, tabs for overview, reviews, comments, changelog and support, and a live-preview frame with a device switcher.
  • Author storefronts, an authors directory, public collections, favourites, following, weekly and featured picks that staff schedule.
  • Cover art, screenshots and avatars are drawn in code per product kind, so a fresh catalogue looks finished without stock photos.
  • A 3D crystal hero on the home page: product cards orbit a glass crystal and, as you scroll, fan out, flip to a licence face and dock into a vault grid. Smaller 3D accents sit on browse, the author storefront and the sell page, and in the admin and Studio dashboards. Each has a still poster, a reduced-motion frame and a lazy-loaded three.js chunk.

Licences and downloads

  • Each paid order line creates a licence with a purchase code in the form KL-XXXX-XXXX-XXXX-XXXX, a download limit (10 for regular and 25 for extended by default, both configurable) and a support period.
  • A download issues a single-use token (only its SHA-256 hash is stored) inside a temporary signed URL that lasts 15 minutes by default. Files live on a private disk, never under public/, and every download is logged.
  • Buyers get a downloads vault, a printable licence certificate and an invoice. Staff can reset download counts, extend support, and revoke or reactivate a licence.
  • A public /verify page checks a purchase code. Authors get a verification API with a token ability scoped to their own items, so a theme or plugin can check a buyer's code.

Authors, review and quality control

  • Anyone can start author onboarding: profile, identity verification (legal name, ID type, the last four characters of the ID number and a private document upload), then an encrypted payout method.
  • Every new item and every new version enters a review queue with waiting-time and SLA flags. Reviewers inspect the listing, the live preview and the package, then approve, soft-reject with a preset reason (the author fixes and resubmits) or hard-reject.
  • Approving an update notifies every buyer with an active licence by bell and email; a new item notifies the author's followers.
  • Author levels set the commission by lifetime sales and are re-evaluated after every sale. Authors can also issue coupons for their own items.

Money

  • A pricing engine applies sale prices, the licence type, coupons scoped to the whole cart, a category, an author or one item, and VAT by buyer country. EU business buyers with a VAT number from another member state get the reverse charge.
  • When an order is paid, one ledger operation credits the author's earnings wallet, the platform's commission wallet and the platform's tax wallet; an affiliate commission moves out of the commission as a transfer. It is idempotent, so a repeated payment event cannot pay twice.
  • Refunds go back through the gateway and post reversing entries on every wallet, then revoke the licence. Author earnings and affiliate wallets may go negative, so a refund after a payout cannot break the ledger.
  • Authors request payouts from their earnings wallet once identity is verified; finance approves and marks them paid. Buyers can earn from a referral link (30-day cookie by default).
  • Admin reports cover revenue, commission and tax per day, refund rate, VAT by country, top items and authors by level, with CSV export.

Community, support and fraud flags

  • One rating per licence (1 to 5 stars with a reason), public author replies, threaded Q&A with author badges and pins, buyer-to-author support threads, and refund requests that the author comments on before staff decide.
  • Fraud flags for order velocity, billing or IP country mismatch, refund-heavy buyers, downloads from many IP addresses and self-purchases, which staff clear or confirm.

Platform

  • English plus a partial Arabic translation with right-to-left layout, light and dark mode, roles with a permission editor, an audit log with before and after values, backups that include private files, system health, SEO settings, sitemap and product structured data, and CMS pages in Markdown.
  • A REST API under /api/v1 with interactive docs at /api/docs and an OpenAPI file: item search, item detail, categories, the buyer's vault, signed downloads and licence checks.
  • A web installer and a command-line installer. Compiled assets and Composer packages are included, so Node.js is not needed. It runs on MySQL 8, MariaDB, PostgreSQL or SQLite.

Good to know

  • Payments were not tested with live accounts. Stripe, PayPal and Razorpay drivers are included, but they were never called. The simulated gateway is the default, and every screenshot and tour used it. Test your gateway in its sandbox before you take real money.
  • SMS and push were not tested with live accounts. The drivers are present; the defaults are a log and a simulated driver.
  • Arabic is partial. The translation file covers the storefront home, browse and page chrome. Item, cart and checkout pages, and the Studio and Account panels, are mostly English inside the right-to-left layout.
  • Home page speed is borderline. In Lighthouse mobile runs with simulated throttling, the 3D home page scored between 72 and 97 across single runs (83 to 85 on the plain PHP server, 77 on a cold cache), against a target of 85. Browse scored 89 and the item page 94 in single runs. Re-measure on your own server behind a real web server; the 3D scene is the main cost.
  • Fraud country check needs a CDN. The country-mismatch rule reads the CF-IPCountry header, so without a CDN that sends it, it never fires on live orders.
  • 3D accents are on the home, browse, author storefront and sell pages only; item, cart, checkout and CMS pages have none. Page content has no custom loading skeletons.
  • Empty installs need VAT rates: add them in Admin or run the included TaxRatesSeeder.
  • The demo catalogue has 102 items, and none is seeded as disabled (the status works from Admin).
  • Web only: there is no native app. Tested in headless desktop and phone-sized browsers, not on physical devices.
  • Tests: 75 Pest tests with 571 assertions, plus static analysis (Larastan level 6, no errors), a 78-page browser smoke test and an installer run from the packaged zip on MySQL with demo data.
#digital-products#marketplace#licence-keys#author-payouts#file-downloads#themes-marketplace#vat#affiliate#laravel#filament#php-script#kyc

How it's built

Architecture, stack, key decisions and the quality gates DEV3 Kitlane passed before release.

The engineering behind Kitlane: Laravel 12 and Filament 4 on a shared core, a pricing engine for licences and VAT, an idempotent ledger that splits every sale, single-use signed downloads and a review queue for items and versions.

The problem it solves

A marketplace for digital goods sells something that can be copied. That changes what has to be right. A file must reach the person who paid, but a link that works twice is a leak, so downloads need to be tied to a licence, counted and expire. Authors upload software that other people will run, so nothing should go on sale before a human has looked at it, and every update needs the same check. The money has three destinations at once: the author, the platform's commission and the tax authority. A refund can arrive after the author has been paid out, and a payment event can arrive twice. Buyers in different countries owe different VAT, and a company with a valid VAT number elsewhere in the EU owes none. Authors also need to be verified before they can withdraw anything, without the marketplace keeping a full copy of their ID number.

Architecture and approach

Kitlane is a Laravel 12 application with three Filament 4 panels on one user table: /admin for staff, /studio for authors and /account for buyers. The storefront is Blade on the shared UI kit. The author panel lives at /studio because /author/{slug} is the public storefront.

A ledger, not balances

  • One settlement call. OrderService::markPaid runs a single idempotent ledger operation. The author's earnings wallet gets the net, the platform's commission wallet gets its cut by the author's level, VAT goes to a tax wallet, and an affiliate commission is a transfer out of the commission wallet. Licences are created in the same step.
  • Refunds reverse, never edit. RefundService asks the gateway for the refund, posts a reversing entry on every wallet it touched and revokes the licence. Author and affiliate wallets are allowed to go negative so a refund after a payout cannot break the books; the payout path checks the available balance first instead.
  • Integer minor units everywhere, so totals always add up.

Delivering files safely

  • Private disk. Item packages sit under storage/app/private, never in public/.
  • Token inside a signed URL. DownloadService creates a single-use token (its SHA-256 is stored, not the token), wraps it in a temporary signed URL, enforces the per-licence download limit and writes a log row with the IP. The log feeds a fraud rule for downloads from many addresses.
  • Purchase codes in the form KL-XXXX-XXXX-XXXX-XXXX can be checked on a public page, or through the API by an author token that only sees that author's own items.

Pricing and review

  • PricingEngine applies sale prices, the extended licence, coupons scoped to a cart, category, author or item, and VAT per line with EU reverse charge.
  • Submissions. A new item and every new version enter the same review queue. Approval of an update notifies licence holders; approval of a new item notifies followers.
  • Author onboarding keeps only the last four characters of the ID number and an encrypted payout method; the identity document goes to a private upload.

Search and 3D

  • SearchService computes facet counts that respect every other active filter, and runs on MySQL and SQLite.
  • The home hero is a sticky scroll stage driving a three.js scene (an octahedron crystal and eight glass cards). Posters, a reduced-motion frame and lazy loading keep the public bundle at 36.5 KB gzipped, with the 187 KB three.js chunk loaded on demand. On phones the scene waits for the first interaction.

Quality gates and results

Kitlane 1.0.0 passed all seven release gates of the DEV3 Laravel suite on the packaged build:

  • Static analysis: composer validate, Pint clean, Larastan level 6 with 0 errors, php -l on 371 files.
  • Tests: 75 Pest tests with 571 assertions. The money paths have their own suites: the core wallet ledger, money-path checks, gateway-confirmed perks, abandoned payments, discounted refunds and downloads.
  • Front-end budget: 13.1 KB of JS and 23.3 KB of CSS gzipped on the public page, against a 180 KB budget.
  • Database: demo and empty seeders run on MySQL 8 and SQLite.
  • Browser smoke test: 78 pages (admin 32, studio 15, account 13 navigation entries) plus a checkout to vault flow, an author upload and a reviewer approval.
  • Installer: the packaged zip installs through the /install wizard on MySQL with demo data.
  • Secret scan: clean.

Known limits: the payment drivers were not run against live accounts, Arabic is partial, and the 3D home page scored borderline on mobile Lighthouse in single runs (72 to 97 across single runs, 77 on a cold cache).

Tech stack

Area Technologies
Backend Laravel 12, Filament 4 panels per role, Livewire 3, Sanctum API tokens, Scheduler and queue, Role permission editor
Marketplace engine Pricing engine, Idempotent sale settlement, Refund service, Download service, Review submissions, Faceted search service, Fraud rules
Frontend Blade UI kit, Tailwind CSS, Vite, three.js asset-prism scene, Code-drawn SVG cover art
Data MySQL 8 / MariaDB, PostgreSQL / SQLite, Double-entry wallet ledger, Integer minor units, Private file disk
Integrations Stripe, PayPal, Razorpay drivers, Simulated gateway default, S3-compatible private disk, OpenAPI REST docs

Inside the build

Signature 3D hero: Floating product cards orbit a glass crystal under studio lights and follow the cursor, with search, popular tags and live counters. Signature 3D hero — Floating product cards orbit a glass crystal under studio lights and follow the cursor, with search, popular tags and live counters.

Scroll story: License: As you scroll, the cards fan out and flip to their licence face with a purchase code, while the chapter rail tracks progress. Scroll story: License — As you scroll, the cards fan out and flip to their licence face with a purchase code, while the chapter rail tracks progress.

Guides & articles

Practical guides and engineering write-ups for DEV3 Kitlane.

Selling digital files online: licences, downloads and payouts to plan first

Last updated
Selling digital files online: licences, downloads and payouts to plan first: DEV3 Kitlane

Selling files is different from selling shoes. A buyer can copy what they download, an author can upload something broken, and a refund can land after the money has already been paid out. Before choosing a script, or starting to write one, it helps to settle six questions. This guide walks through them in the order a file takes through a marketplace, using Kitlane, built on Laravel 12 and Filament 4, as the worked example.

The Kitlane home page: product cards orbit a glass crystal above the marketplace search

The life of one file

  1. An author uploads a package and a changelog.
  2. A reviewer approves it.
  3. A buyer pays for a licence.
  4. The system issues a purchase code and a download link.
  5. Money is split between the author, the platform and the tax account.
  6. Later, a refund, an update or a complaint arrives.

Each step has a decision hidden in it.

Who looks at an upload before it goes on sale?

If authors publish straight to the shop, the first buyer is the tester. In Kitlane every new item and every new version goes through a review queue. Reviewers see the listing, the live preview, the changelog and the package, then approve, soft-reject with a preset reason (the author fixes it and resubmits) or hard-reject. Waiting time is shown so old submissions stand out. When an update is approved, everyone holding an active licence is notified by bell and email.

The review queue lists new items and updates with waiting time and one-click approve

Authors are also verified before they can withdraw anything: a profile, an identity step with a private document upload and only the last four characters of the ID number kept, then an encrypted payout method.

What does a buyer actually get?

A licence, not just a file. Each paid order line creates a purchase code in the form KL-XXXX-XXXX-XXXX-XXXX, a download limit (10 for a regular licence and 25 for an extended one by default) and a support period. The buyer sees all of it in a downloads vault and can print a licence certificate. Staff can reset the download count, extend support or revoke a licence.

The downloads vault lists every licence with its code, version, download count and support period

How is the file delivered without leaking it?

Files sit on a private disk, never under the public folder. A download request creates a single-use token (only its hash is stored) and wraps it in a temporary signed URL that lasts 15 minutes. Every download is logged with the IP address, and the log feeds a fraud rule that flags one licence downloaded from many addresses.

How do you prove a code is genuine?

Authors selling software often need to check a buyer's code from inside their own product. Kitlane has a public page that says whether a code is valid, and a REST endpoint that returns the item, licence and support expiry for an author's token. That token only sees the author's own items. The interactive API docs also cover item search, the buyer's vault and signed downloads.

The Studio verification API page shows the token and a ready-to-run example

Where does each payment go?

A single paid order has up to four recipients: the author, the platform's commission, the tax account and, if a referral link was used, an affiliate. Kitlane records this as ledger entries in wallets, not as a balance that gets edited. Commission depends on the author's level, which rises with lifetime sales. VAT is charged by the buyer's country, and an EU business with a VAT number from another member state gets the reverse charge. Settlement is idempotent, so a payment event that arrives twice cannot pay twice.

What happens on a refund?

The refund goes back through the gateway, reversing entries are posted on every wallet touched, and the licence is revoked. Author and affiliate wallets are allowed to go negative, so a refund after a payout leaves a visible debt instead of a broken ledger. Buyers ask for a refund inside a window, the author adds their side, and staff decide.

Fraud flags sit next to this. Rules look at order velocity, billing and IP country mismatch, refund-heavy buyers, many-address downloads and self-purchases. Staff clear or confirm a flag, and confirming can revoke the licences involved.

See it in action

The desktop tour follows a purchase from search to vault, then the author's Studio and the admin review queue.

Video tour of Kitlane

What to check before you rely on it

  • Payments: Stripe, PayPal and Razorpay drivers are included but were never run against live accounts. The simulated gateway is the default, so test your own gateway in its sandbox first.
  • Languages: Arabic covers the storefront home, browse and page chrome, not the item, cart and checkout pages or the author and buyer panels.
  • Speed: the 3D home page scored 72 to 97 in single mobile Lighthouse runs, so measure it on your own server.
  • Country check: the country-mismatch fraud rule needs a CDN that sends a country header.
  • Tests: 75 Pest tests with 571 assertions cover the ledger, refunds and downloads.

Frequently asked questions

The complete source code (version 1.0.0) as a download from your account, with the setup and usage guides shown on this page. You can modify the code to suit your product.

Buying guides: Laravel scripts with Filament panels and a web installer · Next.js or Laravel for a SaaS script?

More from this author

View all

Related in Web Scripts & Software

View all