BidPilot
Supplier Portal Automation for Procurement Teams
BidPilot turns vendor onboarding into executable web labor. Build your vendor packet once — BidPilot's AI agent fills every supplier portal, uploads your documents, and saves the draft. Your team reviews before anything goes live
Live Links
The Problem
Enterprise procurement teams spend 6+ hours per vendor filling supplier portals like Ariba, Coupa, and Jaggaer. It's repetitive, error-prone, and impossible to scale. The "last mile" of procurement — the actual portal work — is still entirely manual.
The Solution
BidPilot separates preparation from execution:
- Build the packet — Collect legal details, tax forms, insurance, and compliance documents in one reusable vendor packet
- Launch the agent — TinyFish navigates the live portal, fills every field, uploads attachments, and saves the draft
- Review and approve — Your team inspects the saved draft before any final submission is allowed
Product Architecture
| Layer | Technology |
|---|
| Frontend | Next.js 16 App Router, React 19, Tailwind CSS 4 |
| Auth | Supabase Auth with session management |
| Database | Supabase Postgres with Row-Level Security on all 7 tables |
| Storage | Supabase Storage with encrypted document vault |
| Payments | Lemon Squeezy (merchant of record — handles global VAT/GST) |
| Automation | TinyFish — 4 APIs under one key |
| Deployment | Vercel (Edge Network) |
TinyFish Integration — All 4 APIs
BidPilot uses every TinyFish API product under a single API key:
| API | Endpoint | Used For |
|---|
| Web Search | search.tinyfish.ai | Discover RFPs, vendor registrations, and procurement opportunities |
| Web Fetch | fetch.tinyfish.ai | Extract portal requirements, form fields, and compliance signals |
| Web Agent | agent.tinyfish.ai | Navigate portals, fill forms, upload documents, save drafts |
| Web Browser | browser.tinyfish.ai | Stealth browser sessions for authenticated portal inspection |
API Surface
| Endpoint | Method | Purpose |
|---|
/api/tinyfish/config | GET | Check if live mode is enabled |
/api/tinyfish/run | POST | Launch an asynchronous TinyFish agent run |
/api/tinyfish/run/[id] | GET | Poll run status, steps, and results |
/api/tinyfish/search | GET | Search the web via TinyFish Search |
/api/tinyfish/fetch | POST | Extract content from URLs via TinyFish Fetch |
/api/tinyfish/browser | POST | Create a browser session via TinyFish Browser |
/api/payments/lemonsqueezy/webhook | POST | Verify the Lemon Squeezy signature and upgrade the team's plan |
/api/payments/lemonsqueezy/confirm | POST | Client-side success callback (logging only — the webhook is the source of truth) |
/api/packets | GET/POST | List and create vendor packets |
/api/packets/[id] | GET/PATCH/DELETE | Manage individual packets |
/api/packets/[id]/documents | GET/POST | Manage packet documents |
Dashboard Pages
| Page | Description |
|---|
| Overview | Real-time metrics from Supabase — packets, runs, documents, activity feed |
| Packets | Create, manage, and track vendor onboarding packets |
| Runs | Monitor TinyFish agent executions with live polling |
| Audit | Immutable log of every action taken by human or agent |
| Portal Intel | Learned patterns from TinyFish executions across portals |
| Discover | Search the live web for procurement opportunities (Web Search + Web Fetch) |
| Scanner | Scan any portal URL to extract requirements and launch browser sessions |
| Settings | Team, profile, and integration management |
Security
- Encryption: AES-256 at rest, TLS 1.3 in transit
- Auth: Supabase Auth with middleware-enforced session checks
- Database: Row-Level Security policies on every table
- Credentials: TinyFish Vault — portal passwords never touch our servers
- Execution Policy: Read-only or draft-save modes by default. No irreversible actions without human approval.
- Audit: Immutable audit trail of every action
Environment Variables
Create .env.local from .env.example and set:
TINYFISH_API_KEY=your_tinyfish_key
TINYFISH_API_BASE=https://agent.tinyfish.ai/v1
BIDPILOT_DEMO_CODE=optional_access_code
# Required. The webhook refuses to process events without this set.
LEMONSQUEEZY_WEBHOOK_SECRET=your_lemonsqueezy_webhook_secret
NEXT_PUBLIC_LEMONSQUEEZY_CHECKOUT_URL_PRO=https://your-store.lemonsqueezy.com/checkout/...
SUPABASE_SERVICE_ROLE_KEY=your_service_role_key
NEXT_PUBLIC_SUPABASE_URL=https://YOUR_PROJECT_REF.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=YOUR_ANON_KEY
Local Setup
npm install
cp .env.example .env.local
# Add your keys to .env.local
npm run dev
# Open http://localhost:3000
Deployment
The app is deployed on Vercel and linked to the GitHub repository. All environment variables are configured on Vercel for development, preview, and production environments.
Submission Assets
The repo includes ready-to-use assets in submission/:
LOI_TEMPLATE.md — Non-binding Letter of Intent for pilot customersOUTREACH_TEMPLATES.md — LinkedIn, email, and objection-handling scriptsDEMO_CHECKLIST.md — Pre-demo verification stepsPILOT_OUTREACH.md — Pilot program detailscapability-statement.pdf — Company capability statement
Validation
npm run build — passes cleannpx tsc --noEmit — zero type errors- Real TinyFish smoke test completed through the live app
- Live Vercel deployment verified
- All 4 TinyFish APIs tested and integrated
