Keynou Flow
A real-time Kanban workspace, boards, cards, checklists, comments and live presence, built as a free-first alternative to heavyweight task tools.
Visit flow.keynou.com
Recorded on the production app: open a board, scan the lists, open a card. This is the real interface, not a mockup.
The problem
Small teams either pay enterprise prices for task tools or lose work in chat threads and shared docs nobody maintains. Most free plans cap boards or members so early that the upgrade wall is the business model.
What we built
A Kanban workspace built around a real-time core: workspaces, boards, lists and cards that stay conflict-free across every open tab. Smart checklists, threaded comments with mentions, deadline reminders, board templates, public share links and per-board roles, genuinely free for teams up to 10.
The result
A production SaaS at flow.keynou.com: an 87-endpoint REST API guarded by JWT and TOTP 2FA, CRDT-based live sync over WebSockets, seat-based Polar.sh billing, webhooks in both directions, and a 43-page public site carrying the SEO load.
The product journey
Sign up free
Email/password or Google OAuth. New accounts get tokens instantly; a persistent banner nags until the email is verified.
Start from a template
Pre-built board templates spawn a full board, columns, starter cards and checklists, so teams skip the blank page.
Shape the board
Custom lists, color-coded labels, assignees, urgency, cover colors and cards with rich-text descriptions, checklists and attachments.
Invite the team
Workspace members get per-board roles; guests can join through share links or file access requests that admins approve.
Work live
Every open board syncs conflict-free over WebSockets. The Live badge means teammates' moves land without a refresh.
Grow into paid
Seat-based billing previews the next seat's price before checkout; webhooks and API access wire the board into other tools.
Best features
Real-time Kanban boards
Drag-and-drop boards that stay consistent while a whole team edits at once. CRDT sync merges concurrent card moves, edits and checklist changes. The Live badge on every board shows the connection is up.
Cards that carry the work
Rich-text descriptions with image paste/drop, auto-sorting checklists, threaded comments with @mentions, assignees, labels, urgency and cover colors.
Deadlines that chase themselves
Due dates feed a scheduled reminder job: email nudges 1/3/7 days out, optional repeats, and 'keep reminding until the card is done.'
Workspaces & roles
Separate workspaces per team, owner/admin roles per board, member invites, and a team screen that shows who can touch which board.
Public share links & access requests
Boards open to outsiders through token links: join directly or request access. Admins approve or reject from the board.
Webhooks in both directions
Inbound token endpoints turn external events into board actions, this site's own contact form posts into one, while outbound board webhooks push activity to other tools.
Seat-based billing
Free covers 10 seats; paid starts at $5/mo plus $2 per extra member. A preview endpoint quotes the next seat before checkout, and an admin override handles edge cases.
Serious sign-in
JWT sessions with refresh rotation, Google OAuth, email verification gating writes, and TOTP two-factor with email-code and backup-code fallbacks.
Try the workflow
Move a card, watch it stay in sync
An interactive take on the real board workflow. The same drag-and-drop Kanban core the product ships. Reduced-motion visitors get a static first frame.
How it's put together
Client
Next.js app behind Cloudflare: board UI, optimistic updates, CRDT-merged state that mirrors the board across tabs.
Realtime
WebSocket layer. Browsers can't set headers on a WS upgrade, so a single-use, short-lived ticket minted over HTTPS authenticates each connection.
API
Django REST Framework: 87 endpoints for auth, workspaces, boards, lists, cards, comments, notifications, billing and webhooks. JWT bearer auth; the full OpenAPI spec is served at /api/schema/.
Data & jobs
Relational core: workspaces→boards→lists→cards→threads (engine not publicly exposed). A scheduled job sends deadline reminders; Polar.sh webhooks keep seat billing in sync.
How we handled the hard parts
- WebSocket auth without headers
- Browser WebSocket connections can't carry an Authorization header. The API mints a single-use, short-lived ticket; the client exchanges it during the WS handshake, so a leaked ticket is useless almost immediately.
- Edits that never collide
- Two people editing the same card used to mean last-write-wins. With CRDTs in the sync layer, concurrent moves and edits merge deterministically. No refresh, no lost work.
- Spam gate at the API layer
- Registration issues tokens instantly, but an unverified email keeps a persistent banner and locks parts of the product. The boundary lives in the permission layer, not in hidden UI buttons.
- Billing that prices itself
- Seat pricing isn't a static string: /api/billing/preview-seats/ computes current seats, the next seat's price and the monthly total, while checkout + webhooks reconcile the subscription with Polar.sh.
- Webhooks both ways
- Inbound token'd URLs let any tool create board items without a user session (our own site posts its contact form into a Flow hook); outbound webhooks fan board activity out to other systems.
From the real spec
/api/realtime/ws-ticket/:
post:
operationId: realtime_ws_ticket_create
description: >-
Mint a single-use, short-lived ticket
for authenticating a WebSocket connection.
security:
- jwtAuth: [] # Bearer JWT required
responses:
'200': # { "ticket": "..." }Straight from the production OpenAPI spec (GET /api/schema/): the client mints a short-lived ticket over HTTPS, then exchanges it during the WebSocket handshake.
/api/hooks/{token}/:
get: # let integrators verify the URL first
operationId: hooks_retrieve
post: # lead object (or list) -> card(s) in target list
operationId: hooks_createSame spec: a POST to a board's token URL turns a lead object into card(s) in the target list. The token is the credential, no session needed. This site's contact form uses exactly this endpoint.
Stack
Frequently asked questions
Is the real-time sync actually real-time?
Yes, boards carry a Live indicator backed by a WebSocket connection. Concurrent edits merge through CRDTs, so two people can move or edit the same card without overwriting each other.
What does the free plan include?
Up to 10 members per workspace, Kanban boards with drag-and-drop, smart checklists, due dates, labels, board pinning and email notifications.
Can it import existing work?
A leads/CSV import turns each row into a card in a chosen list, useful for moving a pipeline out of a spreadsheet.
How does it connect to other tools?
A documented REST API (87 endpoints, OpenAPI spec), inbound webhook URLs that convert external events into board actions, and outbound board webhooks for activity, plus email notifications throughout.
Can Usmani Labs build a SaaS like this?
Yes, real-time collaboration, subscription billing and public API surfaces are the kind of systems we ship at a fixed price. Map your workflow with us.
Keep exploring
- SaaS Development : Subscription products from MVP to multi-tenant scale.
- Web Development : Marketing sites, web applications and portals: fast, accessible and built to rank.
- Custom Software Development : Internal systems, portals and tools built around your actual workflow.
- Keynou case study : Free online file-conversion and document tool suite.
- Gatha case study : White-label AI-visibility & GEO audit platform for agencies.
- Workflow automation for agencies : the same fixed-price, built-around-your-workflow approach for agencies.
- Software we build, by industry
Built by Usmani Labs
We turn manual business workflows into software that runs them: fixed price, shipped in weeks.