Case Study · Live Product · 2026
Fantasy Music
A Song on WhatsApp, Written in the Language You Actually Speak
3
Languages: English, Nigerian Pidgin, Yoruba
2
Processes: a webhook API and a separate generation worker
19
Database migrations, from first commit to security audit
10
Tables locked down by row-level security in the audit
01
Project Overview
Fantasy Music lets anyone make an original, produced song by sending a WhatsApp message. You describe the song you want in English, Nigerian Pidgin or Yoruba. Claude writes the lyrics, a music engine produces the track, and the finished song comes back into the same chat with a shareable song card. The first song is free. After that, you buy credits in naira through Paystack.
The audio model is a licensed commodity that anyone can swap in. The part worth building is the lyric: a song that uses your names and your memories, in the language you would actually say them in.
02
The Problem
AI song tools exist, but most are built for English-speaking users with a card and a laptop. The person I had in mind has WhatsApp open all day, wants a song for a moment such as a birthday, a wedding or a roast, and drops off at the first bit of friction.
- Generic lyrics. Thin input produces a song that could be about anyone
- Weak local languages. Yoruba needs correct tone marks and Pidgin needs real idiom, not translated English
- Payment friction. A dollar-priced card checkout loses most impulse buyers in Nigeria
- Another app to install. Anything outside WhatsApp is a reason to quit
03
What I Built
The whole loop runs inside WhatsApp, plus a small website for sharing, a radio page and bulk orders.
Conversation that asks first
The bot asks one focused question at a time and only generates once it has the occasion, genre, language and a concrete detail. Eagerness alone does not trigger a song.
Lyrics in three languages
Claude writes the lyrics with per-language craft rules. You can also paste your own lyrics and have them polished instead.
Voice cloning with consent
A user can sing on their own songs. The flow needs a voice sample and then a recording of a generated phrase, so you cannot clone a voice you did not perform.
Naira credits
First song free, then credit packs through Paystack. Credits are granted only after the signed webhook confirms payment.
The Fantasy and Radio
An opt-in public collection of shared songs. Nothing is public by default, and each story passes an automated check and then a human review.
Bulk orders
For weddings and reunions: a web form, one payment, and a private page listing every song so each can be forwarded to the right person.
04
Tech Stack
RuntimeNode + TypeScript on Fastify
ProcessesAPI for webhooks, separate worker for generation
DatabaseSupabase Postgres + Storage
AIClaude for conversation, moderation and lyrics
MessagingWhatsApp Cloud API, directly
PaymentsPaystack: card, transfer, USSD
05
Key Product Decisions
Generation never blocks a webhook
WhatsApp and Paystack both retry if you answer slowly. So the API only acknowledges and records, and a separate long-running worker claims queued jobs, writes lyrics, calls the engine and delivers the result. A slow song cannot make a webhook time out.
The engine is a one-file swap
The music engine sits behind an adapter, with a second engine kept ready. If the vendor changes its price or terms, the change stays inside one file and nothing else is touched.
Money is a ledger, not a number
Credits live in an append-only ledger, and a database trigger refuses to let a balance go negative. A credit is spent when a job is queued and reversed exactly once if generation ultimately fails. Money is stored in kobo as integers.
Nothing is public unless the creator opts in
A story attached to a song can name a real person who never agreed to anything. So public sharing is opt-in, runs through an automated first check, and still waits for a human to approve it.
06
The Security Audit, and What It Found
In early September 2026 I audited the product before it grew. It found two real problems, and the fixes are in the repository history.
- Webhook checks failed open. For both the WhatsApp and the Paystack webhooks, a missing raw request body short-circuited the signature check and let the request through unverified. Both now fail closed and reject it.
- Row-level security was off. Nothing was exposed, because no public role had ever been granted access. But that was true only by the absence of a grant. I enabled row-level security with no policies on all 10 tables, so denial is now the schema's own default and a future accidental grant cannot make a table readable on its own.
07
Milestones Achieved
- ✦ First commit on 19 Aug 2026, with the radio page, genre stations and a Song of the Month in the first build
- ✦ Live at fantasymusic.com.ng, with a real registered WhatsApp number
- ✦ Voice cloning with a built-in consent step
- ✦ Referral mechanic and bulk orders shipped as growth levers
- ✦ Owner-only analytics dashboard and a capacity watch that checks every six hours
- ✦ Security audit completed in early September 2026: webhooks fail closed and row-level security covers every table
08
What I Learned
"Safe in practice" is not the same as safe
The database was not exposed, but only because nobody had granted anything yet. The audit's real value was making the schema itself enforce what I had been relying on by luck.
Put the effort where the product is different
The audio engine can be swapped, so I kept it replaceable and spent the craft on the lyrics, the languages and the payment flow people in Nigeria will actually finish.
Make a song, Free
Fantasy Music is live. The first song is free.