Enterprise SaaS
Starter Kit.
Stop wasting 2 weeks configuring auth, database relations, multi-tenancy, and payment webhooks. Clone the battle-tested Next.js 15+ + Supabase SSR + Stripe foundation we use for production client sprints.
Enterprise Multi-Tenant Next.js 15+ SaaS Starter Kit
A production-ready open-source Next.js SaaS starter engineered with zero placeholders, strict TypeScript safety, Supabase SSR HttpOnly cookie authentication, multi-tenant organization workspaces, cryptographic Stripe webhook idempotency, RFC 7807 problem details APIs, token-bucket rate limiting, and an Obsidian Dark aesthetic.
What's Inside the Boilerplate
Every feature is wired with strict TypeScript types, server actions, and error handling.
Multi-Tenant Workspaces & RBAC
Organization switcher, member invitations, role-based access control (Admin, Member, Owner), and tenant-isolated database models.
Supabase SSR HttpOnly Cookie Auth
Enterprise session management using @supabase/ssr with HttpOnly, SameSite=Lax cookies refreshed at Edge middleware. Zero client-side auth blinks.
PostgreSQL Row-Level Security (RLS)
True database-level tenant isolation ensuring every query is strictly filtered by organization membership through Postgres RLS policies.
Cryptographic Stripe Webhooks & Idempotency
Validates raw request bytes with HMAC signatures and deduplicates events inside an ACID stripe_events table to prevent double-crediting.
RFC 7807 APIs & Token-Bucket Rate Limiting
Standardized Problem Details envelopes ({ type, title, status, detail, traceId }) plus edge-ready sliding window rate limiting with standard HTTP headers.
Constant-Time SHA-256 Machine API Keys
Generates high-entropy API tokens (sk_live_...), stores them as SHA-256 hashes, and uses crypto.timingSafeEqual() to eliminate timing attacks.
System Telemetry & Structured JSON Logger
Non-blocking JSON logger with trace IDs, real-time memory metrics (heapUsedMB, rssMB), uptime tracking, and database latency checks.
Obsidian Dark Design & Spring Physics
Tailored design tokens, interactive terminal, Bento grid permissions simulator, and spring physics micro-interactions.
INQ-STUDIOS-NEXTJS-SAAS-STARTER-KIT/
├── src/
│ ├── actions/ # React 19 Server Actions ('use server')
│ │ ├── auth.ts # Login, Signup, Magic link, Sign out
│ │ ├── billing.ts # Stripe Checkout sessions & Customer portal
│ │ ├── organization.ts# Multi-tenant creation, invite member, org switch
│ │ └── user.ts # Profile updates, SHA-256 API key generation
│ ├── app/ # Next.js App Router
│ │ ├── (auth)/ # Auth route group (Login, Signup, Verify)
│ │ ├── (dashboard)/ # Protected multi-tenant dashboard & settings
│ │ ├── api/
│ │ │ ├── v1/
│ │ │ │ ├── health/ # RFC 7807 Health & memory telemetry
│ │ │ │ ├── organizations/# RESTful organization management
│ │ │ │ └── api-keys/ # RESTful machine tokens
│ │ │ └── webhooks/stripe/ # Raw body HMAC verified Stripe webhook
│ │ ├── globals.css # Design tokens & Obsidian Dark theme
│ │ ├── layout.tsx # Root layout with SEO & JSON-LD schemas
│ │ └── page.tsx # High-converting SaaS landing page
│ ├── components/ # Dashboard, Landing, UI component library
│ ├── lib/ # Supabase SSR, Prisma, Stripe, Rate Limiter, Logger
│ └── middleware.ts # Edge session token refresh & route protection
├── prisma/
│ └── schema.prisma # PostgreSQL schema with indexes & relations
├── supabase/
│ └── migrations/ # PostgreSQL RLS policies & tables
└── .env.example # Environment configurationsLocal Stripe Webhook Testing
Simulate end-to-end checkout sessions, card events, and invoice webhooks on your local machine.
Want us to customize this starter for your MVP?
We take this starter and build out your custom business logic, UI design tokens, database models, and integrations in 3 weeks.