Boilerplate-Stack

Join +10K users

Full source · One-time payment · AI-agent nativev1.37.1September 21, 2026

The Next.js SaaS Boilerplate for developers who ship with AI.

Launch your SaaS with auth, billing, teams and AI already wired. Choose Supabase or Neon, your payment provider, and build with Claude Code, Codex or Cursor.

Get the source — $174 with SOLO40See the product tour
  • Keep the code forever
  • 1 commercial project
  • 12 months of updates
  • Private GitHub access
~/your-saaslive

❯ git clone https://github.com/boilerplate-stack/boilerplate-stack-prod

✓Cloning into 'boilerplate-stack-prod'... done.

❯ cd boilerplate-stack-prod && pnpm install --frozen-lockfile

✓Packages: +982 · signatures verified · 0 vulnerabilities

✓Done in 11.4s

❯ pnpm run init

✓Branding, business model & admin email configured

✓Database, auth, payments, storage & email providers selected

✓Prisma schema initialized · .env.local + config/app.ts generated

❯ pnpm dev

✓▲ Next.js 16.3.0 ready on http://localhost:3777

❯ claude "add a chat agent that answers from our docs"

✓Matched skill: /create-ai-agent · loaded config/ai.ts

✓Read rules: api.md · database.md · CLAUDE.md

✓Created agent · RAG pipeline · credit deduction wired

✓Types pass · ESLint clean · 0 questions asked

▸Shipped in 18s · agent live in chat selector

Built on the stack you already trust

Next.js 16
React 19
TypeScript
Supabase
Stripe
Multi-LLM AI
LangChain
LangGraph
Tailwind v4
shadcn/ui
i18n
OWASP
Inside the box

A real product, not a landing-page demo

Fully built, responsive screens for provider-neutral admin, billing, AI, analytics and CMS workflows — ready to ship today.

A complete admin platform

Users, Accounts, subscriptions, CMS, media, scheduled jobs, operational health and consent-aware product analytics — all built on provider-neutral repositories.

  • User, Account & MFA management
  • Cross-provider subscription & payment views
  • CMS + pluggable object storage
  • Activation and paid-conversion analytics
  • Worker heartbeats, queue age & dead letters
Walkthrough

See the whole thing in action

A quick tour of what ships in the box — admin, billing, AI and the agent workspace.

Everything a SaaS needs. Already built.

Months of foundational engineering — done, typed, documented and ready to extend.

Governed multi-LLM AI + RAG

GPT-5.6, Claude Opus 5 and Gemini 3.6 behind one server-only LLM boundary, with Account and member allowances, model and agent policies, output limits, threshold alerts and exact provider-token accounting. B2B adds an organization-managed, Account-scoped knowledge base for every member; B2C keeps personal libraries. Includes resilient streaming, safe PDF ingestion, cross-provider failover and pgvector + HNSW search.

View documentation

Enterprise security & MFA

Enrolled MFA is enforced across authenticated APIs, independently from recent-factor step-up for sensitive actions. Organization coverage, remote session revocation, OWASP-aligned CSP, configurable rate limiting, RLS, CSRF and Turnstile pair with fail-closed provider checks.

View documentation

EU AI Act & GDPR, shipped

Article 50 transparency implemented, not just documented: AI-interaction notice, durable output marking, a public transparency page — and the operator paperwork as templates (Art. 30 ROPA, Art. 35 DPIA, breach runbook, DPA register). Plus an Art. 15 export in 28 sections and an append-only consent trail.

View documentation

Provider-neutral, production-ready

Next.js 16.3, React 19, Node 24 LTS and shared Prisma/PostgreSQL repositories across Supabase or Neon. Strict TypeScript, Tailwind v4, shadcn/ui, Docker + Coolify, SEO, PWA and a guided initializer keep every supported provider composition explicit.

View documentation

Supabase Auth or Better Auth

Choose the identity provider during setup while keeping one canonical application identity. OAuth, magic links, passkeys, enforced TOTP MFA, recovery codes, real device sessions, onboarding and GDPR-compliant account deletion share the same product contracts. Better Auth verification reservations are replay-safe, and invalid-code feedback is reserved for explicit OTP rejection.

View documentation

Stripe, Lemon Squeezy or Paddle

Choose one payment provider for subscriptions, one-time products, licences, credit packs, multi-currency, webhooks, refunds and admin reporting. Durable signed payment proofs, Account-safe entitlements, guest checkout and affiliate flows are already wired.

View documentation

Multi-tenant

B2C personal accounts or B2B workspaces with dynamic roles, permissions, invitations and account switching.

View documentation

CMS, storage & operations

Multi-locale CMS, media and documents work with Supabase Storage, Neon Object Storage, AWS S3 or storage disabled. Dedicated pg_cron workers publish heartbeats; the protected dashboard surfaces queue age, terminal failures, mandatory-job health and notification dead letters. Push and in-app delivery use independent durable outboxes.

View documentation

i18n & email

URL-based locales (FR/EN), auto-detection, localized components and a pluggable email layer (Brevo, Mailjet).

View documentation

Design system

One hue token drives every brand, neutral and chart colour, so a rebrand is one line. Pattern library, manifest-driven navigation, Motion, and contrast measured rather than eyeballed.

View documentation

Full QA automation

Disposable-database gates seed member, admin, owner and platform-admin personas and prove auth, billing, analytics, AI policies, chat/RAG and documents end to end. Database assertions, Playwright journeys, WCAG 2.2 A/AA, responsive coverage, browser matrices, visual baselines and route-level JavaScript and Lighthouse budgets protect every release.

View documentation

And 100+ more — all wired up128

Every item below is implemented in the codebase, not a roadmap.

Supabase or Neon PostgreSQLSupabase Auth or Better AuthStripe, Lemon Squeezy or PaddleSupabase Storage, Neon Object Storage or S3Native product analytics & activation funnelsAccount & member AI allowancesAI model, agent & output policiesDurable AI usage settlementGuest checkout + purchase claimingTOTP multi-factor authenticationSingle-use MFA recovery codesPasswordless passkeysRecent-factor step-up authOrganization MFA policyRemote device & session revocationStripe subscriptionsMagic Link AuthB2B multi-tenantClaude Code + Cursor + CodexSuper Admin DashboardOAuth (Google, GitHub)OpenAI GPT-5.6Anthropic Claude Opus 5Roles & permissionsAffiliate program (cash commissions)Account-scoped B2B RAGOWASP compliantFull QA automation
Explore the foundation

Choose the SaaS architecture you want to inspect

Search by stack or product capability, then see how each part is implemented and connected to the rest of the codebase.

Next.js SaaS boilerplate

See how the App Router, accounts, admin surfaces and production controls form one typed application.

SaaS boilerplate with Stripe

Explore subscriptions, licences, credits, guest checkout, webhooks and account-scoped entitlements.

Supabase SaaS boilerplate

Review the Auth, Postgres, Storage, membership and Row Level Security boundary.

AI SaaS boilerplate

Inspect multi-LLM chat, agents, RAG, credits and the repository context used by AI coding tools.

Context is everything

Your AI agent is only as good as the codebase you point it at

Drop a generic starter into Claude Code and it guesses. Drop in Boilerplate-Stack and it already knows the architecture, the conventions and the patterns.

generic-boilerplate.diff

// agent without context

  • asks 10+ questions before the first line
  • ignores your folder structure
  • reinvents auth, billing and RLS
  • breaks conventions you fix by hand
  • hours lost re-explaining the project
boilerplate-stack.diff

@@ agent with full context

  • ships on the first prompt
  • follows CLAUDE.md and modular rules
  • reuses your exact patterns
  • skills, subagents and hooks built in
  • production code, far fewer iterations
// net result
  • ~10x faster scaffolding
  • Fewer iterations
  • Conventions respected
  • Production-ready output
AI Blueprint

Built for how you code now — with an agent in the loop

A first-class .claude/ workspace ships in the box. Your agent reads it and immediately works like a senior dev who has been on the team for months.

boilerplate-stack
  • .claude/
  • CLAUDE.md
  • settings.local.json
  • rules/20 files
  • architecture.md
  • database.md
  • anti-patterns.md
  • skills/42 skills
  • create-api-endpoint/
  • stripe-webhook/
  • agents/11 subagents
  • security-reviewer.md
  • db-architect.md
  • hooks/6 hooks
  • pre-write-guard.js
  • lint-on-edit.js
  • AGENTS.mdCodex
  • .cursor/rules/Cursor · 17
  • .gemini/GEMINI.mdGemini
claudelive

❯/create-api-endpoint secure, rate-limited route + Zod

❯/stripe-webhook verified Stripe webhook handler

❯/add-translation sync FR + EN locale files

❯@db-architect audit queries for N+1

Works with Claude Code, OpenAI Codex and Cursor.

Skills

Slash commands that generate code in your exact conventions.

/create-api-endpoint

Subagents

Expert reviewers that audit security, queries and payments.

@security-reviewer

Hooks

Lint, type-check and protect sensitive files on every edit.

lint + typecheck on edit

Rules

Modular domain rules loaded on demand, per area of the codebase.

database.md · billing.md
Your toolchain

Drop it into the AI tool you already use

This isn't a boilerplate you read — it's one your agent operates. The .claude/, AGENTS.md and .cursor/rules/ configs ship in the box, so any AI coding tool understands the codebase from the very first prompt.

Compatible with
  • Claude Code
  • Cursor
  • OpenAI Codex
  • Gemini CLI
  • GitHub Copilot
  • + any AGENTS.md agent
01

Clone & install

Grab the repo and install. The full agent workspace — rules, skills, subagents and hooks — comes with the code.

❯git clone … && pnpm install
02

Open in your AI tool

Open the folder in Claude Code, Cursor or Codex. The agent loads your conventions automatically — zero setup, zero priming.

❯claude
03

Ship by prompting

Describe the feature. The agent writes code that already respects your auth, billing, RLS and i18n patterns — on-pattern, not guessed.

❯add a team invites page
Same conventions, every tool — your AI writes code that fits the codebase.
Compliance

The AI Act clock started on 2 August 2026

Ship a chat assistant in the EU and Article 50 binds you. It is implemented here — and the operator paperwork comes with it.

In force

Article 50 of Regulation (EU) 2024/1689 has applied since 2 August 2026 and was explicitly excluded from the Digital Omnibus deferral. Ceiling: EUR 15,000,000 or 3% of worldwide turnover.

What binds you

Obligations any product interacting directly with natural persons has to meet.

  • Tell users they are interacting with an AI system (Art. 50(1))
  • Mark AI-generated output in a machine-readable way (Art. 50(2))
  • Publish which providers receive prompts, and what the known limits are
  • Keep an Article 30 record of processing activities
  • Run a DPIA where the processing is high risk (Art. 35)
  • Notify a personal-data breach within 72 hours (Art. 33/34)
  • Hold a DPA with every subprocessor (Art. 28)
  • Prove consent over time, not just store its current state (Art. 7(1))
What ships

Implemented in the codebase and verified at runtime, not described in a README.

  • Interaction notice at two placements per chat surface, so it survives scrolling
  • Output marked in the database and on X-AI-* response headers, unconditionally
  • Public /ai-transparency page, built from the providers actually configured
  • Prompts cross one server-only LLM boundary: ZDR-capable endpoints required on the gateway, provider data collection denied, and no retention-bound model in the catalogue
  • Risk tier and Annex III use cases declared in config, escalating automatically
  • Article 15 export in 28 sections, referral and affiliate data included
  • Append-only consent trail with policy versioning
  • Terms section on AI use, in every locale
  • Privacy section on automated processing and Article 22
Operator templates

Editable documents, pre-filled for a stock deployment.

  • Art. 30

    Records of processing

    Eight processing activities with legal bases, recipients and retention.

  • Art. 35

    DPIA scaffold

    Six risks analysed, residual ratings and the pre-launch mitigations.

  • Art. 33/34

    Breach runbook

    Hour-by-hour procedure, plus the SQL that answers the regulator's scoping questions.

  • Art. 28

    Subprocessors & DPA

    Subprocessor register and the customer-DPA clauses this stack can meet.

  • AI Act

    Compliance guide

    Deadlines, Annex III self-assessment, env vars and a verification query.

The implementation is done. Classifying your own product's risk tier stays your call — the config makes it explicit instead of assuming it. Direct-provider ZDR stays an account and DPA control on your side: the code sets store: false and the SDK flag, it cannot sign your contract.

Design system

Rebrand the whole product in one line

Every brand, neutral, sidebar and chart colour derives from a single hue token. Drag it and watch a dashboard change identity — no stylesheet sweep, no find-and-replace.

app/globals.css
:root {
  --brand-h: 288;
}
  • Raw palette usage is down to two documented exceptions across the codebase.
  • Semantic states keep fixed hues, so a rebrand never turns "success" purple.
  • The chart ramp stays analogous to the brand and hue-stable across themes.
  • Contrast was computed oklch → linear sRGB → WCAG, in light and dark.

Tone sits on fills and icons here, every label stays on a foreground token — which is exactly why no hue on this slider can break contrast.

Run the numbers

What it costs to build this foundation yourself — versus owning it this afternoon.

Build it yourself
3–6months
  • Auth, OAuth & sessions
  • Stripe billing & webhooks
  • Multi-tenant + roles + RLS
  • Multi-LLM AI, streaming & RAG
  • Security, i18n, CMS, jobs
  • Debugging it all into one app
With Boilerplate-Stack
Dayone
  • All of it, already wired
  • Typed, documented, tested
  • AI-agent workspace included
  • Docker + Coolify deploy ready
  • Configurable via clean config files
  • Point your agent at it and build
Your delta
3–6 months
Time saved
$50,000+
Engineering cost avoided

One payment. The whole codebase.

No seats. No subscription. No usage metering. Buy it, clone the private repo, ship forever.

Pay in 4 installments with PayPal

Solo

For indie hackers & solo developers

$290$174
Use code SOLO40 — save 40%
  • Full source code access
  • Projects allowed: 1 project
  • Updates included: 12 months
  • Private GitHub repo access
  • Discord community support
Most Popular

Team

For small teams & startups

$750
  • Full source code access
  • Projects allowed: 3 projects
  • Updates included: 12 months
  • Private GitHub repo access
  • Discord community support

Agency

For agencies & multiple projects

$1,740
  • Full source code access
  • Projects allowed: Unlimited projects
  • Updates included: 2 years
  • Private GitHub repo access
  • Discord community support
  • Private GitHub access
  • Use it on real client work
  • Discord community support
  • Free updates included

Questions, answered

Everything worth knowing before you buy.

What exactly do I get?

Instant access to a private GitHub repository with the complete, production-ready Next.js 16 source code: Supabase auth, multi-currency Stripe billing, multi-LLM AI with RAG, B2C/B2B multi-tenancy, CMS, scheduled jobs and OWASP-aligned security — plus the .claude/ AI workspace.

Which technologies are used?

Next.js 16.3 App Router, React 19, strict TypeScript, Node 24 LTS, pnpm workspaces, Supabase (Postgres + Auth + Storage + RLS), Stripe, LangChain, Tailwind CSS v4, shadcn/ui, Motion, URL-based i18n (FR/EN), Docker & Coolify ready.

What makes it "AI-agent native"?

It ships with a complete .claude/ workspace: CLAUDE.md, modular domain rules, custom slash-command skills, specialized subagents and quality hooks. Claude Code, Codex and Cursor read it and generate code that follows the project's conventions from the first prompt.

Where do my users' prompts go?

Every chat and embedding request crosses one server-only LlmClient — the only module allowed to construct a provider SDK or call an inference endpoint. You pick the transport with AI_LLM_TRANSPORT: the direct OpenAI, Anthropic and Google APIs, or OpenRouter. On the gateway, requests require ZDR-capable endpoints, deny provider data collection and never fall back to an ineligible provider; Claude Fable 5 is kept out of the catalogue on purpose, because Anthropic documents a mandatory 30-day retention for it. Direct calls set store: false and the SDK ZDR flag — contractual zero retention with a direct provider remains an account and DPA matter on your side, which the operator docs state plainly instead of implying the code covers it. Audit rows record the resolved model, route and upstream request id; prompts, responses and provider bodies are never written to them.

Is it compliant with the EU AI Act?

The Article 50 transparency obligations are implemented, not just documented: the AI-interaction notice renders on every chat surface, AI output is marked durably in the database and on the response headers, and a public /ai-transparency notice lists the providers that actually receive prompts. You also get the operator paperwork as editable templates — Article 30 records of processing, an Article 35 DPIA scaffold, an Article 33/34 breach runbook, and a subprocessor + DPA register. Article 50 has applied since 2 August 2026 and was excluded from the Digital Omnibus deferral. The risk classification of your own product remains your call — the config makes it explicit rather than assumed.

How do you handle dependency security?

pnpm only, one lockfile, an integrity-pinned package manager and a Node 24 LTS baseline shared by CI and Docker. Dependency lifecycle scripts are off by default with a reviewed allowlist, new releases sit in a seven-day quarantine before they can be resolved, package signatures are re-verified at install, and CI runs a frozen install plus a low-or-higher audit before any code check. The audit baseline is zero — a low advisory fails the build rather than filing a ticket.

Can I use it for client work?

Yes. Solo covers 1 project, Team up to 3, Agency unlimited. Freelancers and agencies ship client SaaS products on it.

How do updates work?

You get the private repo with updates for your tier's window (Solo 12 months, Agency 2 years). Any code you've already pulled is yours to keep regardless.

What's the refund policy?

Because you receive the full source code and private repo access immediately, all sales are final — no refunds once access is delivered. Review the live demo and the documentation first so you can buy with full confidence.

Can I use Boilerplate-Stack for a commercial SaaS?

Yes. All plans allow you to build and monetize your own commercial SaaS or application.

Do I own the product I build?

Yes. You own your application, business logic, customer data, branding, and custom code built on top of Boilerplate-Stack.

Can I use it for client projects?

Yes, but you need the appropriate plan. Solo is for 1 project, Team allows up to 3 projects, and Agency allows unlimited projects.

Can contractors access the repo?

Yes. Contractors may access the private repo when working on your licensed project, provided they are bound by confidentiality and do not redistribute the code.

Can I open-source my app?

You may open-source your own original application code, but not Boilerplate-Stack itself or modified portions that would redistribute the commercial boilerplate.

Can I sell my company or product built with Boilerplate-Stack?

Yes. You can transfer the license as part of a normal company or product acquisition, as long as the boilerplate is not resold separately.

Stop rebuilding the boring 80%

Get the foundation, point your agent at it, and spend your time on the part only you can build.

Get Boilerplate-StackRead the docs
  • One-time payment
  • Full source code
  • AI-agent native
  • Ships today