A complete, production-ready FinTech ecosystem comprising a Python Flask API server, a Flutter admin management panel, and a Flutter user mobile application. This platform provides a comprehensive solution for digital wallet management, virtual card issuance, multi-currency support, cryptocurrency deposits, and full administrative control — all built with Clean Architecture principles and ready for commercial deployment.

The ecosystem is structured with complete separation between the backend API server and the frontend client applications. The server delivers over 100 REST API endpoints with WebSocket real-time communication, Celery-based background task processing, and a full RBAC permission system. The admin panel features 57 screens covering everything from user management and financial oversight to system configuration and analytics. The user mobile application delivers 30 screens for wallet operations, card management, deposits, transfers, and more.

Security is embedded at every layer: JWT authentication with token refresh and reuse detection, TOTP two-factor authentication, biometric login support, Fernet encryption for sensitive configuration data, rate limiting on all endpoints, strict Content Security Policy headers, HMAC-verified webhooks, and comprehensive audit logging with sensitive data redaction. The server includes automated database backup services and maintenance mode middleware for safe production deployments.

Server Architecture & Backend Features

The backend is built with Python 3.13+ using Flask 3.1, SQLAlchemy, PostgreSQL 15+, Redis 7+, and Celery for background task processing. It contains 55+ service modules, 25 database models, 65 API route files delivering 100+ endpoints, and comprehensive third-party integrations.

Flask 3.1 Backend: Production-ready Flask application with Gunicorn WSGI server, Nginx reverse proxy configuration included, Flask-Migrate (Alembic) for database migrations, and Flask-SocketIO for real-time WebSocket communication.
Authentication System: JWT-based authentication with 30-minute access tokens and 7-day refresh tokens. Token blocklist with Redis and reuse detection triggers full session revocation. Supports email/password login, biometric authentication, and TOTP two-factor authentication with QR code setup via pyotp.
Role-Based Access Control: Three-tier hierarchy of User, Admin, and Super Admin. Granular permission groups with 50+ permission checks covering individual screens, actions, UI elements, and navigation items. Maximum of 4 Super Admins enforced at the system level.
Multi-Currency Wallet System: User wallets with balance tracking across multiple currencies. Supports deposits, withdrawals, P2P transfers, currency exchange, and complete transaction history with filtering, search, and CSV/PDF export capabilities.
Virtual Card Management: Complete card lifecycle management including creation, funding, freezing/unfreezing, withdrawal, PIN setting, and auto-topup rules. Pre-integrated with StroWallet and Pentra Wallet providers. Full transaction history with spending limits and status tracking.
Stripe Payment Integration: Fiat deposits via Stripe payment intents with full webhook processing, automatic fee calculation, refund handling, and payment method details capture. Webhook signature verification for security.
Cryptocurrency Payments: Cryptomus integration for crypto deposits with deposit address generation and QR codes. Supports multiple currencies and networks with SHA256 webhook verification and automatic balance updates.
KYC Verification Workflow: Document upload and verification system supporting passport, national ID, and driver license. Admin review with approve/reject workflow including reason logging and staff member attribution. KYC level-based transaction limits.
Push & Email Notifications: Firebase Cloud Messaging (FCM) for push notifications on Android and iOS with single, multicast, and topic messaging. SendGrid and Flask-Mail SMTP for transactional emails with 11 HTML email templates with variable substitution. Scheduled notification support.
SMS Notifications: Twilio integration for SMS alerts on transactions and security events with 3 retries using exponential backoff and error code mapping to user-friendly messages.
Support Ticket System: Full ticketing system with categories (Technical, Accounting, Account, General, Other), priorities, file attachments, admin assignment and transfer, and chat-like messaging. Internal notes for staff communication.
Financial Reports: PDF, CSV, and XLSX report generation via ReportLab for transaction reports, card reports, user summaries, and activity logs. Weekly and monthly automated email summaries via Celery beat scheduler.
Referral System: Referral code generation with QR sharing, reward tracking, configurable reward amounts, batch payout processing, and reward history. Comprehensive referral analytics showing conversion rates, earnings, and reward distribution.
Security Architecture: Redis-backed rate limiting with per-route limits, account lockout after 5 failed login attempts, IP lockout after 10 failures in 24 hours. Strict Content Security Policy via Flask-Talisman, HSTS with preload, X-Frame-Options DENY. Fernet symmetric encryption for 2FA secrets, integration configurations, and setup data. HMAC signature verification on all webhooks with 5-minute timestamp replay protection and 24-hour Redis idempotency. PostgreSQL statement timeout at 30 seconds with query threshold logging for queries exceeding 5 seconds. File upload validation with MIME detection via python-magic, magic byte header verification, and optional ClamAV antivirus scanning.
Audit Logging: Rigorous action tracking engine recording every staff action with timestamps and user attribution. Passwords, tokens, API keys, CVV numbers, and card details are automatically redacted from all logs. Live error logging screen in the admin panel captures system errors for bug tracking.
Background Processing: Celery task queue with Redis broker handling async email delivery, PDF/CSV report generation, weekly user summaries (Mondays 00:00 UTC), monthly summaries (1st of month), phone verification cleanup (hourly), and orphan file cleanup (daily 02:00 UTC). Configuration: JSON serializer, at-least-once delivery with acks_late, prefetch count of 1, 300-second soft time limit, 600-second hard limit.
System Monitoring: Built-in system metrics showing CPU, memory, disk usage, and database size. Health check endpoint, maintenance mode middleware with custom messaging, automated database backup service accessible from admin panel, and comprehensive logging with rotation.

API Endpoint Overview

The server exposes 100+ REST API endpoints organized into four groups plus webhook handlers:

Authentication API (4 endpoints): Registration, login with 2FA support, email verification, 2FA secret generation with QR, biometric login, password reset, profile retrieval, and token refresh with reuse detection.
Client API (23 modules): Wallet balance and operations, transaction history with filters, P2P transfers, virtual card creation and funding, KYC document submission, crypto deposit requests, notifications management, support tickets, referral operations, profile management, security settings, and more.
Admin API (22 modules): User management (CRUD, suspend, verify, role change), financial report generation, transaction flagging for suspicious activity, analytics dashboard data, card management, deposit management, KYC review, ticket management, notification management, content management (FAQ, banners), and staff management.
Super Admin API (12 modules): System settings management, integration testing and configuration, transaction limit configuration, system health and metrics, bank management, email template management, referral configuration, account control (balance adjustments with 2FA), and system setup wizard.
Webhook Handlers (4): Stripe payment events, Cryptomus crypto payment updates, StroWallet card transaction events, and Pentra Wallet digital Mastercard events. All webhooks include HMAC signature verification.

Admin Panel Features — 57 Screens

The Flutter admin panel provides complete control over the entire FinTech platform with 57 screens covering all operational and administrative functions. Built with Riverpod state management and GoRouter navigation.

Authentication (2 screens): Login screen with JWT authentication, unauthorized access screen for users without proper permissions.
Dashboard & Analytics (3 screens): Overview dashboard showing revenue, wallets, transfers, cards, tickets, and KYC statistics. Advanced analytics with comparison mode, Excel data export, and AI-powered forecasts for 30/90-day projections. Comprehensive analytics tabs covering users, transactions, financial data, behavioral patterns, and geographic distribution. Metrics include churn rate, DAU/WAU, and retention rate.
User Management (9 screens): User list with search and filter, user detail view with activity logs, user creation and editing, freeze/unfreeze accounts, phone verification, password reset, account suspension and deletion, role changes. Staff account management with permission group assignments. Permission group creation with granular permissions (screen access, function access, UI elements, navigation).
Financial Management (16 screens): Finance overview with aggregated metrics. Transaction list and detail views with advanced filtering. Wallet list with balance tracking, wallet detail with transaction history. Card management with card list, detail, request list, funding requests, recharge requests, and card deposit transactions. Withdrawal management with list and detail views. Crypto deposit list with status tracking (pending, processing, confirmed, failed, refunded).
KYC & Compliance (2 screens): KYC request list with document images, approve/reject with reason, address validation tracking, and re-submission history.
Support Tickets (2 screens): Ticket list with search and filter by status (open, in-progress, closed) and category. Ticket detail with real-time chat, file attachments, admin assignment/transfer, internal notes, and close/resolve actions.
System Settings (19 screens): Settings overview with categorized access. Setup wizard for initial configuration. Bank management (CRUD with bilingual names, logos, account details, IBAN, SWIFT, wallet info). Limit configuration for deposits and withdrawals per currency with min/max amounts and daily/monthly limits. Fee configuration per method. Exchange rate management. Integration configuration and testing for all third-party services (database, Redis, email, SMS, Stripe, Cryptomus, StroWallet, FCM). Notification management with send/broadcast email, SMS, and push notifications, scheduled notifications, and notification templates with variables. Email template management with list, edit, preview, and test delivery. Internal staff chat with group creation, invitations, file sharing, and member management. Content management for FAQ (CRUD with categories) and banners (image upload, target URL, priority). Referral program management with analytics, code assignment/revocation, batch payouts, reward history, and configuration. System logs viewer, backup management, performance monitoring, system settings with feature toggles, currency list, and maintenance mode.

Mobile User App Features — 30 Screens

The Flutter user mobile application delivers a complete digital wallet experience with 30 screens. Built with Bloc state management, GoRouter navigation, and Clean Architecture with complete separation of data, domain, and presentation layers.

Authentication (6 screens): Login, registration, email verification, forgot password, reset password, and 2FA verification. Supports biometric authentication (fingerprint) for secure and fast access.
Dashboard (3 screens): Home dashboard with real-time wallet balance, recent transactions, and quick actions. Full transaction list with search and filter. Transaction detail view with complete information and status tracking.
Wallet Management (4 screens): Wallet overview with multi-currency balance display. Card management screen with card list, card details, card request screen for requesting new virtual cards, and card transaction history.
Deposits (3 screens): Deposit method selection showing available options (Stripe, cryptocurrency, manual). Deposit detail with payment instructions and QR codes. Deposit confirmation screen with status tracking.
Withdrawals (1 screen): Withdrawal screen for requesting fund withdrawals with amount input and method selection.
Currency Exchange (2 screens): Exchange screen for converting between currencies with live rate display. Exchange preview with fee breakdown and confirmation.
KYC Verification (1 screen): Document upload and submission screen for identity verification with support for multiple document types.
Notifications (1 screen): Push notification history with read/unread status and notification preferences management.
Support (2 screens): Support ticket creation and chat interface for communicating with support staff. Ticket history viewing.
Profile & Settings (5 screens): Profile screen with personal information editing. Security settings for password change, 2FA enable/disable, and biometric toggle. Notification preferences screen. Activity log viewing. Referral screen with referral code, sharing, and reward tracking.
Additional Screens (2 screens): FAQ screen with categorized questions and answers. Reports screen for viewing generated financial reports. Splash and maintenance screens for app startup handling.

Third-Party Integrations

Stripe: Card payments and deposits with full webhook processing, refund handling, and payment method details. Signature verification on all webhook events.
StroWallet: Virtual card issuance provider. NFC card support with create, fund, freeze, unfreeze, and PIN management operations. HMAC-signed webhook notifications.
Pentra Wallet: Digital Mastercard provider with 3DS validation, ID image support, and VIP key security. Full lifecycle management via API.
Cryptomus: Cryptocurrency payment gateway with multi-network deposit support, balance checking, and automated payouts. SHA256 webhook verification.
Twilio: SMS notification delivery with retry logic and exponential backoff for reliability.
SendGrid / Flask-Mail SMTP: Dual email delivery system with SendGrid as primary and Flask-Mail SMTP as automatic fallback for transactional emails.
Firebase Cloud Messaging: Push notification delivery for Android and iOS with support for single device, device group, and topic-based messaging.
Redis: Caching layer, rate limiting backend, Celery message broker, token blacklist storage, and WebSocket connection mapping.

Technical Requirements

Backend Environment: Python 3.13+ using Flask 3.1 Web Framework, Gunicorn WSGI server, and Nginx reverse proxy.
Database Systems: PostgreSQL 15+ for ACID-compliant structured financial logging, with Redis 7+ for caching, rate limiting, and Celery task queue broker.
Background Processing: Celery 5.6 with Redis broker for asynchronous task execution including report generation, email delivery, and scheduled maintenance.
Mobile Infrastructure: Flutter 3.38+ with Dart 3.10+ for both admin panel and user application.
Deployment Platforms: Android minimum SDK 22 (Android 6.0+), Apple iOS 11.0 or higher. Cross-platform support including Web, Linux, and Windows.
Minimum Server Requirements: 2 GB RAM, 10 GB storage plus upload storage allocation for production deployment.

Security Architecture

Authentication: JWT with 30-minute access tokens and 7-day refresh tokens. Redis-based token blocklist with automatic reuse detection triggering full session revocation.
Two-Factor Authentication: TOTP-based 2FA via pyotp with QR code setup and 5-attempt rate limiting.
Encryption at Rest: Fernet symmetric encryption for all sensitive configuration data including 2FA secrets, integration API keys, and setup configurations.
Rate Limiting: Redis-backed rate limiting on all endpoints. Account lockout after 5 failed login attempts within 24 hours. IP-level lockout after 10 failed attempts within 24 hours.
Web Security: Strict Content Security Policy via Flask-Talisman, HSTS with preload, X-Frame-Options DENY, and whitelist-based CORS policy.
File Validation: Multi-layer validation with extension whitelist, MIME type detection via python-magic, magic byte header verification for all image and document formats, and optional ClamAV antivirus scanning.
Webhook Security: HMAC signature verification on all incoming webhooks with 5-minute timestamp replay protection and 24-hour Redis idempotency keys. Database row-level locking for concurrent transaction processing.
Log Security: Automatic redaction of passwords, tokens, API keys, CVV numbers, and full card numbers from all log output. Audit logging with immutable records for all administrative actions.

What You Will Receive

Complete Python Flask API Server Source Code with 55+ service modules, 25 database models, and Alembic migration files
Full Flutter Admin Panel Application Source Code with 57 screens — zero screens removed or restricted
Full Flutter User Mobile Application Source Code with 30 screens covering the complete wallet experience
Comprehensive deployment and system architecture documentation with Nginx and Gunicorn configuration files
Pre-integrated payment gateway (Stripe, Cryptomus) and virtual card provider (StroWallet, Pentra Wallet) API configurations
Configurable email (SendGrid/SMTP), SMS (Twilio), and push notification (Firebase) assets with all templates
Database schema with full Alembic migration history and environment variable template (.env.example)
System validation and pre-flight check script for deployment verification

Live Demo Access

Experience the functional components of the ecosystem using the official testing profiles outlined below.

Download Admin Demo APK Download User Demo APK

Super Admin Accounts:

Username: test | Password: 12345678
Username: test2 | Password: 12345678
Username: test3 | Password: 12345678

Admin Accounts:

Username: admin | Password: 12345678
Username: admin1 | Password: 12345678
Username: admin2 | Password: 12345678

Important Note: System parameter modifications, global identity deletions, and administrative credential configurations have been restricted in this demonstration environment for operational security. Please test the target platforms using English configurations.

Important Disclaimer Regarding Third-Party Services

MANDATORY WARNING: This application integrates with external third-party services including Strowallet, Pentra Wallet, Stripe, Cryptomus, Twilio (SMS), SendGrid/Gmail, and Google/Firebase. Please be aware that these services may incur additional usage fees, transaction costs, and subscription charges that are strictly NOT included in the purchase price of this item. Buyers are solely responsible for creating their own accounts and managing any associated costs with these external providers. The purchase price covers the application source code only.

StroApp | Virtual Card Backend and Flutter Admin