How to build a UGC creator marketplace with Bolt

Rule of thumb: if the marketplace is your business (you take a margin, you own the relationships, you want your own licence terms), the rented options are a tax on the exact revenue you are trying to build, and owning the platform pays back fast. If you are a brand that simply needs a steady supply of video, buy the videos and skip all of this. The genuinely awkward middle is an agency running creator campaigns for clients on a subscription plus a percentage, because that percentage scales with the part of the business you are already doing yourself.

* Read the storage line before you pick a plan, because this template stores video. The free Supabase tier includes 1 GB of file storage, 500 MB of database, and 5 GB of egress, and pauses a project after 1 week of inactivity. A handful of creator uploads and you are out. Pro, from $25/mo, moves that to 100 GB of storage and 250 GB of egress with daily backups kept for 7 days, and charges $0.0213 per GB of storage and $0.09 per GB of egress beyond it. Payouts and identity checks are billed per use by whoever you route them through, and are the two lines that grow with the marketplace rather than sitting flat.

Both columns end with the platform belonging to you, and with the hundredth brand costing no more to serve than the first. The only thing that differs is whose hours go into it: a developer you pay up front, or your own, spent describing what you want and reading back what arrives.

Prices and rates from supabase.com, developex.com and bolt.new, checked August 2026.

The GitHub step comes before Bolt exists for you at all. Everything after it happens inside the browser tab Bolt opens, with no install.

1. 01

   Create the repository, then import it

   Bolt has no upload button, so the project has to exist on GitHub before Bolt can open it. Create a private repository, import it, then set the ground rules in your first message.

   PromptSet the project up after importingCopy

   This project is a two-sided UGC marketplace. Set it up as React 18 + Vite + TypeScript with Tailwind, and keep this vocabulary consistent everywhere from here on: brands, campaigns, applications, submissions, licences, wallets, payouts. Two standing rules: we will add a database in the next step and every screen after that reads and writes real data rather than placeholders, and anything that changes a balance runs in a server-side function rather than in the browser.

   Keep the repository private. Bolt commits to it automatically as you build, and a project holding payout logic has no business being public.

2. 02

   Talk the schema through in Plan Mode before it is written

   The data model is the one thing that is expensive to change later, and a marketplace model has two sides and a ledger in it. Use Plan Mode to agree it before Bolt writes a line.

   PromptDesign the marketplace data modelCopy

   Use Plan Mode for this one. I need the database for a two-sided UGC marketplace. Two sides, both hanging off an account: brands buying, creator profiles selling. Each campaign sits under a brand with a title, a brief, the deliverable format, the number of slots, a deadline, the rate paid per accepted submission, and its funded budget as a separate figure, moving through draft, active, paused, completed, cancelled. One creator against one campaign is an application. A submission belongs to an application, points at an uploaded video, and travels through draft, submitted, under review, approved, rejected, revision requested. Approval writes a licence stating channels, term, exclusivity, and the moment it was granted. The money is a wallet per creator holding a balance, backed by a transactions table where every credit and debit is a row, so the balance is recomputable rather than editable. Talk me through the plan first, then connect a database and build it.

   Plan Mode costs a message and can save a rebuild. A two-sided schema with money in it is exactly the change worth spending it on.

3. 03

   Clear the context, then add sign-in and the three roles

   Permissions have nothing to do with the schema conversation you just had, so clear the context first. Bolt reloads the whole project each message, and a clean slate makes this one cheaper.

   PromptAdd auth and the three rolesCopy

   Add authentication and the role model. Email-and-password sign-up, login, logout, a persisted session, and a profile row per account. Then three roles (creator, brand manager, and admin) stored in their own table rather than on the user account, because anything on the account is editable by the person it belongs to, plus a helper the access rules can call without calling back into themselves. Then fork the sign-up: a creator completes a creator profile, a brand creates or joins a brand record, and each lands on their own dashboard rather than a shared one.

   Clearing the context between unrelated features is Bolt’s own advice, and it is the single easiest way to slow the token burn.

4. 04

   Lock the tables down, the wallet hardest of all

   Point this prompt at the database layer specifically rather than letting it range over the whole project. Then read what it produces. This is the step that keeps one creator out of another’s earnings.

   PromptAdd row-level security and storage rulesCopy

   Working on the database layer only: turn on row-level security for brands, creator profiles, campaigns, applications, submissions, licences, wallets, and transactions, written through the role helper. Admins are unrestricted. Everything a brand manager can reach hangs off their own brand: its campaigns, and whatever applications and submissions came in against them. Everything a creator can reach is their own: profile, applications, submissions, wallet, transaction history, with active campaigns readable but never the other people who applied to them. Every insert and update needs an explicit ownership check. Wallets and transactions get no client-side update or delete at all, because a balance may only move inside a server-side function. Then apply the same rule to uploaded video: the submissions bucket must not be public, and a file must be readable only by the creator who uploaded it, the brand whose campaign it belongs to, and an admin. Show me how to verify one creator gets nothing back when querying another creator's transactions.

   Naming the layer keeps the prompt narrow, which Bolt charges you less for and which makes the result easier to check.

5. 05

   Build each side, checking the preview between them

   Two prompts, and a look at the live preview after each. The preview is the running app, so what you click is what a creator on a phone would click.

   PromptBuild the creator sideCopy

   Build the creator half now: a board of open campaigns showing what each pays and how many slots remain, a campaign page with an apply action, and an upload for submitting video. The upload has to send large files in chunks so a lost connection resumes instead of starting again, show honest progress, and say clearly that the submission arrived. Assume a phone on poor wifi throughout.

   PromptBuild the brand sideCopy

   Then the brand half: creating and editing a campaign, an applications view for shortlisting and accepting creators, and a review screen that plays a submission back and offers approve, decline, or request a revision with a written reason that stays on the record for both sides to read later.

6. 06
   Destination

   Pay the creator on approval, then publish

   Close the loop, click the whole thing through from both sides, then publish, to Bolt’s own hosting by default, or to Netlify if you would rather keep the domain there.

   PromptAdd licences, payouts, and publishCopy

   Add what is left, all of it in server-side functions. Approving a submission must grant a licence on that campaign's terms and credit the creator's wallet with the rate in one transaction, so neither half lands without the other. Add a withdrawal request that queues a payout, and make the payout safe to run twice so a retry never pays anyone a second time. Give the admin side a finance view of what is owed, paid, and stuck. Then walk me through the full flow in the preview from both sides (post a campaign as a brand, apply and upload as a creator on a second account, request a revision, approve the next version, confirm the licence and the wallet both moved, request a withdrawal), and once it holds up, publish it.

Review the access rules (row-level security policies) on every table. For each one, tell me in simple terms who can view, add, edit, and delete records, confirm that people can only reach their own data while the right roles can reach more, and flag anything left open that shouldn’t be.

The one rule that matters: no secret key (database, payments, identity, mail, or AI) ever goes into the app or a public repo. If one does get out, treat it as compromised and rotate it the same day.

All of them will serve this app, and the front end is the cheap half whichever you pick. What is worth checking before you commit: whether the plan you are on allows commercial use at all, since Vercel’s Hobby tier says plainly that it does not, and what happens to your bill once creators are uploading video and brands are streaming it back.

Add a server-side function that runs on every new submission, sends the video’s frames and transcript to your ai function, and returns a moderation verdict with a confidence score and a short reason. Store it against the submission, sort the review queue by it, and never auto-reject on it alone. Anything flagged goes to a person with the reason attached.

Add a “Improve this brief” action on the campaign form that sends the brand’s draft to your ai function and returns a structured brief (what to show, what to say, what to avoid, deliverable format and length, and the usage rights being asked for), presented as an editable draft the brand confirms rather than something saved automatically.

Add a “Suggest a shortlist” action on the applications view that sends the campaign brief and each applicant’s profile and past accepted submissions to your ai function, and returns a ranked shortlist with one line of reasoning per creator. Show it as a suggested order the brand can ignore, and never hide unranked applicants.

When a brand requests a revision, add an action that sends the brief, the submission, and the brand’s note to your ai function and returns a clearer version of that feedback: specific, tied to the brief, and phrased as changes to make. Show it to the brand for approval before it reaches the creator, and keep both versions on the record.

Pick a lighter model for the high-volume prompts above and save a stronger one for wherever the reasoning actually matters. That is the same token-budget logic as the rest of this page, applied to the app’s own AI calls instead of the build itself. When Bolt flags a missing secret, add the key through its secrets settings instead of pasting it into the chat, and keep every AI feature behind one server-side function so there’s only one key to manage.