getMickled

Mandi’s Mickles has sold online since 2019 on a store I built for it. That store served one business. Serving a second by copying the codebase would have meant fixing every bug twice, then three times, then once per client forever.

So in December 2025 I converted the store into a platform and called it getMickled. That makes mandismickles.com and getmickled.com one project: the store is the platform’s first business. getMickled runs every business from one codebase: each gets its own storefront, its own admin site, its own data and its own payment and shipping accounts, and a fix ships to all of them at once. Bisque & Co became the second business on it in June 2026. The hard rule underneath: one business must never be able to see or change another’s.

• Seven apps on one Nx monorepo. Two live storefronts (Mandi’s Mickles and Bisque & Co), a tenant admin site, an operator console for running the platform, the getMickled marketing site, and two end-to-end test suites.
• A serverless backend. Node 22 Lambdas behind API Gateway, with DynamoDB and Cognito, all in Terraform across 19 modules and deployed by CI through GitHub OIDC.
• Data and secrets per tenant. Each business gets its own admin table, and its secrets (Square, Shippo and the rest) live in Parameter Store under a path for that business and environment, so a development role can never read a production secret. The code refuses any secret that isn’t stored encrypted.
• Checkout that knows the products. A box is chosen from the order’s item dimensions, shipping rates come from the business’s own Shippo account through a Lambda (the key used to sit in the browser bundle), and local delivery zones are map polygons with a fee each, holes included, matched against the server-geocoded address.
• Payments through Square, connected per business, with each Square merchant claimable by exactly one tenant.

Taking the tenant out of the request

The shared backend works out the tenant from the request: the hostname, or a tenant header. That’s fine for picking a logo and wrong for anything that matters, because a caller controls both. The public contact form shows why: had it used that lookup, anyone could have stamped a message with another business’s tenant and dropped it in that business’s inbox. It was written to read its tenant from its own deployment instead, and so were the feedback and orders routes.

The goal is a tenant that never comes from the request. It comes from one of two places.

Admin requests use the verified token. Each admin user’s Cognito token carries their business, and the admin Lambdas pick the table from that claim, never from anything in the request. An unknown tenant fails closed with a 403. This is how production works today.

Public requests use the gateway. Each business gets its own API gateway and its own copies of the Lambdas, and the tenant is simply the gateway the request arrived at, with nothing in the request to forge. Until that reaches production, checkout and shipping rates on the shared gateway still take the tenant from the header, and closing that gap is what this work is for.

Giving every business its own backend could have meant hundreds of lines of Terraform per tenant per environment: Bisque & Co’s first version took 588. So I folded it into one module. A business now declares which routes it serves, and the module builds the functions, their roles, the gateway and the secret grants from that list. Bisque & Co’s block went from 588 lines to 87, and the next tenant needs two routes.

Deriving the grants from the routes wasn’t only about saving lines. Reviewing the first version, I found a flag that gave Bisque & Co’s catalogue publisher write access to every business’s catalogue snapshot, Mandi’s Mickles’ included, for a function it didn’t even run. I confirmed it in live IAM, then made the grant exist exactly when the function does, so it can’t be switched on by hand, copied by mistake or outlive the route that needed it.

The per-business gateway runs for Bisque & Co in the development environment; production is the next step. The module’s own notes are just as plain about what it doesn’t cover yet.