What exactly do I get?

A private Git repository: 110 files, about 7,060 lines of code, 25 routes, 136 tests, 8 locale files, the documentation and the prompts library. There is no runtime service and no licence key phoning home.

Do I have to use Clerk, Stripe and Resend?

No, but the kit is wired for them. Auth touches lib/auth.ts and the middleware, payments live in lib/stripe.ts plus two API routes, and email is one file. Swapping any of the three is a contained job rather than a rewrite.

Is the whole app translated, or just the landing page?

The whole app. Dashboard, settings, billing, admin, teams and API keys are all translated across eight languages, with ICU plurals and locale-aware dates and currency. A test suite fails the build if one locale drifts.

How are teams billed?

Billing stays on the person who pays. A workspace's plan is its owner's plan, so one Stripe subscription covers the team. Seats come from the plan configuration and are enforced when an invitation is created and when it is accepted.

Can my AI assistant work with this?

Yes. CLAUDE.md, .cursorrules and GitHub Copilot instructions document the real patterns of the codebase, so an AI assistant extends the existing conventions instead of inventing a second style.

What is not included?

Background jobs, S3 file storage, in-app notifications and Sentry error monitoring are not included, and it is not a monorepo. It is deliberately one readable Next.js application.

Yes, for life, on both licences. You keep repository access and pull whatever you want; nothing is pushed into your fork.

Yes. Thirty days, no questions asked. Email the address you paid with and the purchase date; you do not have to give a reason. The refund goes back to the original payment method within five business days, and repository access is revoked.

SaaS Starter — Next.js 15 SaaS boilerplate with teams, billing & API keys

Ship your SaaS this month,
not next quarter.

A Next.js 15 SaaS boilerplate with auth, Stripe billing, teams with enforced seats, hashed API keys and an admin panel — plus the one thing no other kit ships: a command that audits its own claims before you believe a word of this page.

One-time payment · lifetime updates · 30 days to change your mind, no questions asked

136 tests passing

105 files, 6,584 lines you own

8 languages, dashboard included

npm run audit → no findings

No testimonial wall, because nobody’s face proves a codebase. The demo is open, and the audit runs on your machine.

You are about to rebuild the same fortnight.

×Two days on sign-in, sessions and protected routes — and not one line of the thing you actually want to sell.

×The Stripe webhook that works on your laptop and, in production, quietly lets a cancelled customer keep the Pro plan.

×Teams. Invitations, roles, a seat count that has to hold when the invite is created and again when it is accepted.

×The 11 pm discovery that your dashboard is English-only, and your first serious lead is in Madrid.

×An admin page you postpone until the day you need to answer “how many paying users do we have?” and cannot.

None of it is your product. All of it stands between you and the first customer who hands you money.

Codebase

A repository your agent can read

One Next.js 15 app, App Router, server components, TypeScript strict. A CLAUDE.md that documents the actual patterns — not a summary of the README — plus Cursor and Copilot instruction files, so your assistant knows the conventions from the first prompt instead of inventing new ones.

CLAUDE.md, .cursorrules, Copilot
End-to-end type safety
25 routes, 110 files, no monorepo
Prompts library in docs/

src/

app/

(marketing)/ landing, pricing, blog

dashboard/ protected app

settings/ profile + API keys

billing/ plan, portal, invoices

organization/ members, roles, invites

admin/ users, metrics, MRR

invite/[token]/ accept an invitation

api/ webhooks, stripe, v1/me

lib/

organizations.ts roles, seats, invites

api-keys.ts hash, verify, revoke

stripe.ts PLANS, limits, checkout

messages/ en fr de es it nl pl pt

__tests__/ 136 tests, Vitest

Authentication

Sign-in you don't have to think about

Clerk handles sessions, social login, SSO and the password reset flow you would otherwise write twice. What the kit adds is the part that is actually yours: middleware that protects every locale of every private route, and server helpers that fail closed.

Social login & SSO
requireUser / requireAdmin
Locale-aware route protection
Webhook user sync + first-admin bootstrap

/sign-in

Welcome back

ada@example.com

Password

••••••••••

Continue with GitHub

Payments

Charge on day one, not sprint three

Three plans configured, monthly and yearly. Checkout, the customer portal, and the four webhook events that actually matter — including the subscription-deleted case most kits forget, which is how a churned customer keeps their paid plan forever.

Checkout + billing portal
Signature-verified webhooks
Plan limits enforced in code
Cancellation downgrades the plan

/dashboard/billing

Current plan

Renews on 1 October 2026

ProActive

// src/lib/stripe.ts
pro: {
  price:  { monthly: 29, yearly: 290 },
  limits: { projects: 10, apiCalls: 10000, seats: 5 },
}

Manage subscription

Change plan

Organizations

Teams, with seats that actually hold

Workspaces, OWNER › ADMIN › MEMBER re-checked in the database on every mutation, and email invitations tied to one address. Seats come from the plan and are enforced: a pending invitation holds a seat, so a free workspace can't invite twenty people and discover the limit when they all accept.

Invite, revoke, change role, leave
The last owner can't be removed
One subscription covers the team
Invite links are noindex & POST-only

/dashboard/organization

4 of 5 seats used Pro

3 members · 1 pending invitation

Member	Role
ALAda Lovelaceada@acme.com	Owner
GHGrace Hoppergrace@acme.com	Admin
ATAlan Turingalan@acme.com	Member
?katherine@acme.comInvite expires in 6 days	Invited

Activity log · new in October

Who removed Bob? Now you can answer.

Every invite, join, role change, removal, rename, API key and plan change lands in an append-only audit trail per workspace. Admins read it on the dashboard, export it to CSV for the auditor, or pipe it into Slack and their SIEM through the API — the thing enterprise buyers ask about on the second call.

Append-only, written after the action succeeds
Snapshots: deleting a user never rewrites history
CSV export, formula injection neutralised
GET /api/v1/activity, cursor-paged

/dashboard/organization#activity

Activity logExport CSV

ada@acme.com invited katherine@acme.com as Admin
2 min ago · member.invited
grace@acme.com changed the role of alan@acme.com: Member → Admin
1 h ago · member.role_changed
ada@acme.com changed the plan from FREE to PRO
yesterday · billing.plan_changed
alan@acme.com created the API key ci-deploy (sk_live_7f3a…)
2 days ago · api_key.created

API keys

Machine access, hashed at rest

A key is shown once and stored only as a SHA-256 — a dump of the table grants nobody anything. Keys are gated on the plans that advertise API access, read straight off the same PLANS object your pricing page renders, so the table and the gate can't drift apart.

Create, reveal once, revoke
Bearer or x-api-key
Rate limited per key, not per IP
A working endpoint to copy

/dashboard/settings — API keys

Production serversk_live_7Ka9Xf••••••••••••

Last used today

CI pipelinesk_live_Qm2Vd0••••••••••••

Never used

$ curl https://acme.com/api/v1/me \
    -H "Authorization: Bearer sk_live_…"

{
  "email": "ada@acme.com",
  "plan":  "PRO",
  "key":   { "name": "Production server" }
}

Internationalization

Eight languages — inside the app, too

Most kits translate the landing page and stop at the login wall. Here the whole signed-in product is localized: dashboard, settings, billing, admin, teams, API keys. Dates, numbers and currency follow the request locale instead of a hard-coded one.

next-intl, ICU plurals
hreflang + per-locale sitemap
Default locale unprefixed
A test that fails on drift

src/messages/*.json

ENFRDEES ITNLPLPT

app.organization.seatsUsed

en4 of 5 seats used

fr4 sièges utilisés sur 5

de4 von 5 Plätzen belegt

plZajęte miejsca: 4 z 5

✓ npm test fails if one locale drifts — a missing key, an empty value, or a different ICU placeholder.

Themes

Seven looks, one variable

Not seven hues — seven complete themes. Each redefines the whole token set for light and dark, corner radius included, so they read as different products rather than the same one tinted. Nothing in a component names a colour, which is why NEXT_PUBLIC_THEME can change all of it.

Default, Ink, Paper, Mono, Violet, Sunset, Forest
Light and dark, both complete
shadcn registry components inherit them
A test fails on a half-applied theme

Try all seven, live

src/styles/themes.css

default

ink

paper

mono

violet

sunset

forest

yours
+1 block

# .env
NEXT_PUBLIC_THEME="forest"

# the dashboard, the admin area, the marketing pages and every
# component you add later from the registry all follow.

Admin

Know your numbers from day one

A real admin area, not a placeholder: every user, their plan and role, estimated MRR, active subscriptions, churn and new signups this month — computed from your own database, with no third-party dashboard to wire up first.

Users, plans, roles
MRR & churn estimates
Role-gated by middleware
First admin from an env var

/admin

Total users1,247+8.2%

Active subscriptions318+12.4%

Estimated MRR$12,470+23.1%

Churn2.1%−0.3%

User	Plan	Signed up
ALAda Lovelaceada@acme.com	Business	2 September 2026
GHGrace Hoppergrace@acme.com	Pro	31 August 2026
ATAlan Turingalan@acme.com	Free	30 August 2026

	SaaS Starter	supastarter	ShipFast
Price (single dev)	$149 once	€299 once	$199 once
Shape	One Next.js 15 app	Monorepo, several apps	One Next.js app
Auth	Clerk	better-auth (self-hosted)	Google OAuth & magic links
Payments	Stripe	Stripe, Lemon Squeezy, Polar, Creem, Dodo	Stripe, Lemon Squeezy
Database	Prisma + PostgreSQL	Prisma or Drizzle	MongoDB or Supabase
Teams & roles	Yes, with enforced seats	Yes	Not advertised
API keys	Yes, hashed + endpoint	Not advertised	Not advertised
Languages	8, app included	Yes	Not advertised
Admin panel	Users, MRR, churn	SaaS Admin UI	Not advertised
Tests shipped	136 unit tests (Vitest)	Playwright E2E configured	Not advertised
Self-audit command	npm run audit	No	No
Background jobs, S3, notifications	Not included	Included	Not advertised
Error monitoring (Sentry)	Not included	Included	Not advertised

SaaS Starter

supastarter

ShipFast

Price (single dev)

$149 once

€299 once

$199 once

Shape

One Next.js 15 app

Monorepo, several apps

One Next.js app

Auth

Clerk

better-auth (self-hosted)

Google OAuth & magic links

Payments

Stripe

Stripe, Lemon Squeezy, Polar, Creem, Dodo

Stripe, Lemon Squeezy

Database

Prisma + PostgreSQL

Prisma or Drizzle

MongoDB or Supabase

Teams & roles

Yes, with enforced seats

Yes

Not advertised

API keys

Yes, hashed + endpoint

Not advertised

Languages

8, app included

Yes

Not advertised

Admin panel

Users, MRR, churn

SaaS Admin UI

Not advertised

Tests shipped

136 unit tests (Vitest)

Playwright E2E configured

Not advertised

Self-audit command

npm run audit

Background jobs, S3, notifications

Not included

Included

Not advertised

Error monitoring (Sentry)

Not included

Included

Not advertised

I got tired of buying claims.

Every boilerplate landing page is a list of promises, and you only find out which ones were true after you have paid and cloned. Half-finished models. A table declared in the schema and never queried. An env var in .env.example that nothing reads. You inherit them quietly, and you pay for them three weeks later.

So this kit ships the command I wanted as a buyer: npm run audit. It reads the files on disk and names every gap between what the code declares and what it runs. It found six in this repository, and they got fixed — that terminal output is further up this page, failures included.

That is the whole deal. Not “trust me” — “check me, here is the command.” It runs on your fork too, the day you delete something and want to know what you left dangling.

— the developer who maintains this repository

Ship your SaaS this month,
not next quarter.

You are about to rebuild the same fortnight.

Priced in the only currency you actually spend

A repository your agent can read

Sign-in you don't have to think about

Charge on day one, not sprint three

Teams, with seats that actually hold

Who removed Bob? Now you can answer.

Machine access, hashed at rest

Eight languages — inside the app, too

Seven looks, one variable

Know your numbers from day one

The parts nobody wants to write twice

Transactional email

MDX blog

SEO out of the box

136 tests, Vitest

Dark mode, natively

Deploy anywhere

A codebase that reports its own gaps

It runs on your fork too

It fits in CI

It is not marketing

Where this kit fits — and where it doesn't

Pay once. Ship forever.

Starter

Unlimited

Questions people actually ask

I got tired of buying claims.

Start on Monday with week one already done