A modern, feature-rich dashboard for Crew Banking

Features • Screenshots • Quick Start • API • Contributing

SimpleCrew is a comprehensive financial dashboard that connects to Crew Banking to provide enhanced money management features. Built with a focus on usability and modern design, it offers real-time transaction tracking, intelligent expense management, family account oversight, and a beautiful dark mode experience.

• Enhanced Visibility - See your Safe-to-Spend, bills, and pockets all in one place
• Family Management - Easily monitor and manage your children's accounts and cards
• Smart Categorization - Automatic bill detection and expense tracking
• Modern UI/UX - Clean, responsive design with dark mode support
• PWA Ready - Install on any device for an app-like experience

Dashboard and transaction views with dark mode support

Screenshots coming soon - the app features a clean, modern interface with support for both light and dark themes.

• Docker and Docker Compose (recommended)
• Or: Python 3.9+ for manual installation

# Clone the repository
git clone https://github.com/Nerdykidtech/SimpleCrew.git
cd SimpleCrew

# Start the application
docker-compose up -d --build

# Open in browser
open http://localhost:8080

# Clone the repository
git clone https://github.com/Nerdykidtech/SimpleCrew.git
cd SimpleCrew

# Install dependencies
pip install -r requirements.txt

# Create data directory
mkdir -p data

# Run the application
python app.py

# Open in browser
open http://localhost:8080

pip install -r requirements.txt pytest
pytest tests/

The suite uses a throwaway SQLite database and makes no network calls.

1. Navigate to http://localhost:8080
2. Create your account (first-time only):
   • Enter a username and password
   • Email is optional
   • Password must be at least 8 characters
3. Complete the onboarding flow:
   • Select Crew Banking as your provider
   • Enter your Crew bearer token
4. (Optional) Configure passkeys for passwordless login:
   • Navigate to Account Settings → Passkey Configuration
   • Set your RP_ID (domain) and Origin URL
   • For localhost: Use localhost and http://localhost:8080
   • For production: Use your domain and HTTPS URL
   • Click "Add Passkey" in the Passkeys section to register your device
5. Start managing your finances!

Getting Your Bearer Token: Log into Crew, open browser DevTools (F12), go to Network tab, and find the authorization header in any API request.

Security Note: Only one user account can be created per installation. Registration is automatically disabled after the first user signs up.

Passkey Support: Passkeys work on Chrome 67+, Safari 14+, Firefox 60+, and Edge 18+. HTTPS required in production (localhost works for development).

SimpleCrew/
├── app.py                          # Main Flask application
├── requirements.txt                # Python dependencies
├── Dockerfile                      # Container configuration
├── docker-compose.yml              # Docker Compose setup
│
├── data/                           # Database storage (git-ignored)
│   └── savings_data.db
│
├── tests/                          # pytest suite
│   ├── conftest.py
│   └── test_api_keys.py
│
├── static/
│   ├── css/
│   │   ├── main.css                # Core styles & theming
│   │   ├── components.css          # UI components
│   │   ├── navigation.css          # Navigation styles
│   │   ├── modals.css              # Modal dialogs
│   │   └── mobile.css              # Mobile responsive
│   │
│   ├── js/
│   │   ├── api/                    # API layer modules
│   │   │   ├── cards.js
│   │   │   ├── expenses.js
│   │   │   ├── family.js
│   │   │   ├── goals.js
│   │   │   ├── transactions.js
│   │   │   └── credit.js
│   │   │
│   │   ├── ui/                     # UI layer modules
│   │   │   ├── dialogs.js
│   │   │   ├── modals.js
│   │   │   ├── navigation.js
│   │   │   └── rendering.js
│   │   │
│   │   ├── features/               # Feature modules
│   │   │   ├── dragdrop.js
│   │   │   └── groups.js
│   │   │
│   │   ├── utils/                  # Utility functions
│   │   │   ├── formatters.js
│   │   │   └── helpers.js
│   │   │
│   │   ├── state.js                # Global state
│   │   └── app.js                  # Main app initialization
│   │
│   ├── images/
│   │   ├── logo.png                # Light mode logo
│   │   ├── logo_white.png          # Dark mode logo
│   │   ├── 192.png                 # PWA icon
│   │   └── 512.png                 # PWA icon (large)
│   │
│   ├── manifest.json               # PWA manifest
│   └── sw.js                       # Service worker
│
└── templates/
    ├── base.html                   # Base template
    ├── index.html                  # Main dashboard
    ├── login.html                  # Login page
    ├── register.html               # First-time registration
    ├── onboarding.html             # Setup wizard
    └── partials/
        ├── header.html
        ├── navigation.html
        └── views/                  # Tab views
            ├── activity.html
            ├── expenses.html
            ├── goals.html
            ├── family.html
            ├── cards.html
            ├── credit.html
            └── account.html         # Account settings & security

Note: All API endpoints below require authentication. Unauthenticated requests will be redirected to /login.

Sessions are for browsers; API keys are for scripts. Mint one under My Account → Security → API Keys, then send it as a bearer token:

curl -H "Authorization: Bearer sc_your_key_here" \
     http://localhost:8080/api/savings

The plaintext key is displayed once, at creation. Only its SHA-256 hash is stored, so a lost key is replaced rather than recovered. Revoking a key takes effect on the next request.

Keys currently carry a single scope, read, which is limited to an explicit allowlist of endpoints — balances, transactions, pockets, expenses, goals, card metadata, and sync status. Everything else returns 403.

read does not mean "any GET request". Two endpoints in this app answer a plain GET with a live credential: /api/cards/<id>/sensitive returns a full card number and CVV, and /api/simplefin/get-access-url returns the SimpleFin access URL for every linked bank account. Both are refused to API keys by name and remain reachable only from a logged-in browser session.

An unknown or revoked key returns 401. Requests without an sc_ bearer header are unaffected and continue to use session authentication.

All credentials and configuration are securely stored in the SQLite database:

Note: No environment variables are required. SECRET_KEY is automatically generated and stored in the database on first run.

Passkey Configuration: WebAuthn settings (RP_ID and ORIGIN) can be configured through the Account Settings page under "Passkey Configuration". The UI provides validation and testing to ensure correct configuration. Environment variables are used as fallback only.

# Install dependencies
pip install -r requirements.txt

# Run in debug mode
python app.py

# Build and run
docker-compose up --build

# View logs
docker-compose logs -f simplecrew

# Rebuild after changes
docker-compose up -d --build

• HTTPS Required: Use HTTPS with SSL/TLS termination (mandatory for passkeys)
• Passkey Configuration: Configure RP_ID and ORIGIN through Account Settings → Passkey Configuration
  • Alternative: Set RP_ID and ORIGIN environment variables (UI configuration takes precedence)
• Set up regular database backups
• Configure a reverse proxy (nginx/traefik)
• Monitor API rate limits
• Implement log aggregation

# Build for production
docker-compose -f docker-compose.prod.yml up -d

# With custom configuration
docker-compose up -d --build

• Recommended: Set up passkeys for secure, passwordless login
• Register multiple passkeys (phone, laptop, security key) for redundancy
• Use a strong password (8+ characters) if using password authentication
• Change your password regularly via Account Settings
• Always use HTTPS in production deployments (required for passkeys)
• Regularly rotate API credentials
• Backup your data/ directory
• Keep Docker images updated
• Review access logs periodically

For production deployments, consider adding:

• Passkey Authentication: Enable passwordless login for better security and UX
• Rate Limiting: Prevent brute-force attacks on login endpoint
• Session Timeout: Configure automatic session expiration
• CSRF Protection: Implement CSRF tokens for state-changing operations
• HTTPS Only: Use SSL/TLS certificates and set SESSION_COOKIE_SECURE=True
• Multiple Passkeys: Encourage users to register backup passkeys on different devices

# In app.py
app.run(host='0.0.0.0', debug=True, port=8080)

Contributions are welcome! Please feel free to submit a Pull Request.

1. Fork the repository
2. Create your feature branch (git checkout -b feature/AmazingFeature)
3. Commit your changes (git commit -m 'Add some AmazingFeature')
4. Push to the branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

This project is licensed under the MIT License - see the LICENSE file for details.

• Built for use with Crew Banking
• Inspired by modern fintech dashboard designs
• Thanks to all contributors and testers

SimpleCrew - Take control of your finances

Made with ❤️ for the Crew community