Next.js SaaS boilerplate
See how the App Router, accounts, admin surfaces and production controls form one typed application.
Explore this foundationFull source · One-time payment · AI-agent nativev1.36August 26, 2026
The Next.js SaaS Boilerplate for developers who ship with AI.
Auth, Stripe billing, Supabase, multi-tenant teams, multi-LLM AI and i18n are already wired, typed and secured. Claude Code, Codex and Cursor understand the architecture from the first prompt.
- Keep the code forever
- 1 commercial project
- 12 months of updates
- Private GitHub access
~/your-saaslive
❯ git clone https://github.com/boilerplate-stack/boilerplate-stack-prod
✓Cloning into 'boilerplate-stack-prod'... done.
❯ cd boilerplate-stack-prod && pnpm install --frozen-lockfile
✓Packages: +982 · signatures verified · 0 vulnerabilities
✓Done in 11.4s
❯ pnpm run init
✓Branding, business model & admin email configured
✓Supabase, Stripe & Mailjet env vars wired
✓Database initialized · .env.local + config/app.ts generated
❯ pnpm dev
✓▲ Next.js 16.3.0 ready on http://localhost:3777
❯ claude "add a chat agent that answers from our docs"
✓Matched skill: /create-ai-agent · loaded config/ai.ts
✓Read rules: api.md · database.md · CLAUDE.md
✓Created agent · RAG pipeline · credit deduction wired
✓Types pass · ESLint clean · 0 questions asked
▸Shipped in 18s · agent live in chat selector
Built on the stack you already trust
Next.js 16
React 19
TypeScript
Supabase
Stripe
Multi-LLM AI
LangChain
LangGraph
Tailwind v4
shadcn/ui
i18n
OWASP
Inside the box
A real product, not a landing-page demo
Fully built, responsive screens — admin, billing, AI and CMS — you can ship today.
A complete admin platform
Users, organizations, subscriptions, CMS, media, scheduled jobs and analytics — all built, styled and responsive.
- User & workspace management
- Subscription & payment views
- CMS + media library
- Scheduled jobs dashboard
01 / 06
Everything a SaaS needs. Already built.
Months of foundational engineering — done, typed, documented and ready to extend.
Multi-LLM AI + RAG
GPT-5.6, Claude Opus 5 and Gemini 3.6 behind one server-only LLM boundary — direct provider APIs or OpenRouter, with zero-data-retention payloads and cross-provider failover when one degrades. LangChain orchestration, SSE streaming, prompt caching, a multi-agent registry and a built-in knowledge base (PDF/TXT/MD) on pgvector + HNSW.
View documentationEnterprise security & step-up
Recent-factor step-up for sensitive actions, organization-wide MFA policies and remote session revocation. OWASP-aligned CSP, rate limiting, RLS, CSRF and Turnstile pair with a signature-verified, zero-vulnerability supply-chain gate.
View documentationEU AI Act & GDPR, shipped
Article 50 transparency implemented, not just documented: AI-interaction notice, durable output marking, a public transparency page — and the operator paperwork as templates (Art. 30 ROPA, Art. 35 DPIA, breach runbook, DPA register). Plus an Art. 15 export in 28 sections and an append-only consent trail.
View documentationModern stack, production-ready
Next.js 16.3, React 19, Node 24 LTS, strict TypeScript, Tailwind v4, shadcn/ui, Motion, Docker + Coolify, SEO and an installable PWA out of the box.
View documentationMFA, passkeys & users
Supabase Auth with OAuth, magic links and passwordless passkeys, plus TOTP MFA, one-time recovery codes, real device sessions, onboarding and GDPR-compliant account deletion.
View documentationStripe billing & guest checkout
Subscriptions, one-time products, credit packs and multi-currency — plus secure B2C checkout without an account, post-purchase claiming, customer portal, webhook automation and affiliates.
View documentationMulti-tenant
B2C personal accounts or B2B workspaces with dynamic roles, permissions, invitations and account switching.
View documentationCMS & jobs
Multi-locale CMS with a WYSIWYG editor, media library, scheduled pg_cron jobs and a webhook handler dashboard.
View documentationi18n & email
URL-based locales (FR/EN), auto-detection, localized components and a pluggable email layer (Brevo, Mailjet).
View documentationDesign system
One hue token drives every brand, neutral and chart colour, so a rebrand is one line. Pattern library, manifest-driven navigation, Motion, and contrast measured rather than eyeballed.
View documentationFull QA automation
One command spins up a disposable Supabase stack, seeds member / admin / owner / platform-admin personas, proves the product end to end, then destroys the database. pgTAP covers schema, RLS and grants; Playwright covers the public site, both dashboards and all 43 admin pages, plus real Stripe, chat/SSE and document flows. The same gate runs WCAG 2.2 A/AA in light and dark, 320/768/1280px overflow, a Chromium/Firefox/WebKit matrix, visual baselines and Lighthouse budgets.
View documentationAnd 100+ more — all wired up120
Every item below is implemented in the codebase, not a roadmap.
Guest checkout + purchase claimingTOTP multi-factor authenticationSingle-use MFA recovery codesPasswordless passkeysRecent-factor step-up authOrganization MFA policyRemote device & session revocationStripe subscriptionsMagic Link AuthB2B multi-tenantClaude Code + Cursor + CodexSuper Admin DashboardOAuth (Google, GitHub)OpenAI GPT-5.6Anthropic Claude Opus 5Roles & permissionsAffiliate program (cash commissions)Knowledge Base RAGOWASP compliantFull QA automationGoogle Gemini 3.6Zero-data-retention routingCross-provider failoverLangChain orchestrationMulti-agentsSSE streamingDocument chat (PDF/TXT/MD)pgvector + HNSW search
Explore the foundation
Choose the SaaS architecture you want to inspect
Search by stack or product capability, then see how each part is implemented and connected to the rest of the codebase.
SaaS boilerplate with Stripe
Explore subscriptions, licences, credits, guest checkout, webhooks and account-scoped entitlements.
Explore this foundationSupabase SaaS boilerplate
Review the Auth, Postgres, Storage, membership and Row Level Security boundary.
Explore this foundationAI SaaS boilerplate
Inspect multi-LLM chat, agents, RAG, credits and the repository context used by AI coding tools.
Explore this foundationContext is everything
Your AI agent is only as good as the codebase you point it at
Drop a generic starter into Claude Code and it guesses. Drop in Boilerplate-Stack and it already knows the architecture, the conventions and the patterns.
generic-boilerplate.diff
// agent without context
- asks 10+ questions before the first line
- ignores your folder structure
- reinvents auth, billing and RLS
- breaks conventions you fix by hand
- hours lost re-explaining the project
boilerplate-stack.diff
@@ agent with full context
- ships on the first prompt
- follows CLAUDE.md and modular rules
- reuses your exact patterns
- skills, subagents and hooks built in
- production code, far fewer iterations
// net result
- ~10x faster scaffolding
- Fewer iterations
- Conventions respected
- Production-ready output
AI Blueprint
Built for how you code now — with an agent in the loop
A first-class .claude/ workspace ships in the box. Your agent reads it and immediately works like a senior dev who has been on the team for months.
boilerplate-stack
- .claude/
- CLAUDE.md
- settings.local.json
- rules/20 files
- architecture.md
- database.md
- anti-patterns.md
- skills/42 skills
- create-api-endpoint/
- stripe-webhook/
- agents/11 subagents
- security-reviewer.md
- db-architect.md
- hooks/6 hooks
- pre-write-guard.js
- lint-on-edit.js
- AGENTS.mdCodex
- .cursor/rules/Cursor · 17
- .gemini/GEMINI.mdGemini
claudelive
❯/create-api-endpoint secure, rate-limited route + Zod
❯/stripe-webhook verified Stripe webhook handler
❯/add-translation sync FR + EN locale files
❯@db-architect audit queries for N+1
Works with Claude Code, OpenAI Codex and Cursor.
Skills
Slash commands that generate code in your exact conventions.
/create-api-endpointSubagents
Expert reviewers that audit security, queries and payments.
@security-reviewerHooks
Lint, type-check and protect sensitive files on every edit.
lint + typecheck on editRules
Modular domain rules loaded on demand, per area of the codebase.
database.md · billing.mdYour toolchain
Drop it into the AI tool you already use
This isn't a boilerplate you read — it's one your agent operates. The .claude/, AGENTS.md and .cursor/rules/ configs ship in the box, so any AI coding tool understands the codebase from the very first prompt.
Compatible with
- Claude Code
- Cursor
- OpenAI Codex
- Gemini CLI
- GitHub Copilot
- + any AGENTS.md agent
01
Clone & install
Grab the repo and install. The full agent workspace — rules, skills, subagents and hooks — comes with the code.
❯git clone … && pnpm install02
Open in your AI tool
Open the folder in Claude Code, Cursor or Codex. The agent loads your conventions automatically — zero setup, zero priming.
❯claude03
Ship by prompting
Describe the feature. The agent writes code that already respects your auth, billing, RLS and i18n patterns — on-pattern, not guessed.
❯add a team invites pageSame conventions, every tool — your AI writes code that fits the codebase.
Compliance
The AI Act clock started on 2 August 2026
Ship a chat assistant in the EU and Article 50 binds you. It is implemented here — and the operator paperwork comes with it.
In force
Article 50 of Regulation (EU) 2024/1689 has applied since 2 August 2026 and was explicitly excluded from the Digital Omnibus deferral. Ceiling: EUR 15,000,000 or 3% of worldwide turnover.
What binds you
Obligations any product interacting directly with natural persons has to meet.
- Tell users they are interacting with an AI system (Art. 50(1))
- Mark AI-generated output in a machine-readable way (Art. 50(2))
- Publish which providers receive prompts, and what the known limits are
- Keep an Article 30 record of processing activities
- Run a DPIA where the processing is high risk (Art. 35)
- Notify a personal-data breach within 72 hours (Art. 33/34)
- Hold a DPA with every subprocessor (Art. 28)
- Prove consent over time, not just store its current state (Art. 7(1))
What ships
Implemented in the codebase and verified at runtime, not described in a README.
- Interaction notice at two placements per chat surface, so it survives scrolling
- Output marked in the database and on X-AI-* response headers, unconditionally
- Public /ai-transparency page, built from the providers actually configured
- Prompts cross one server-only LLM boundary: ZDR-capable endpoints required on the gateway, provider data collection denied, and no retention-bound model in the catalogue
- Risk tier and Annex III use cases declared in config, escalating automatically
- Article 15 export in 28 sections, referral and affiliate data included
- Append-only consent trail with policy versioning
- Terms section on AI use, in every locale
- Privacy section on automated processing and Article 22
Operator templates
Editable documents, pre-filled for a stock deployment.
- Art. 30
Records of processing
Eight processing activities with legal bases, recipients and retention.
- Art. 35
DPIA scaffold
Six risks analysed, residual ratings and the pre-launch mitigations.
- Art. 33/34
Breach runbook
Hour-by-hour procedure, plus the SQL that answers the regulator's scoping questions.
- Art. 28
Subprocessors & DPA
Subprocessor register and the customer-DPA clauses this stack can meet.
- AI Act
Compliance guide
Deadlines, Annex III self-assessment, env vars and a verification query.
The implementation is done. Classifying your own product's risk tier stays your call — the config makes it explicit instead of assuming it. Direct-provider ZDR stays an account and DPA control on your side: the code sets store: false and the SDK flag, it cannot sign your contract.
Design system
Rebrand the whole product in one line
Every brand, neutral, sidebar and chart colour derives from a single hue token. Drag it and watch a dashboard change identity — no stylesheet sweep, no find-and-replace.
app/globals.css
:root {
--brand-h: 288;
}- Raw palette usage is down to two documented exceptions across the codebase.
- Semantic states keep fixed hues, so a rebrand never turns "success" purple.
- The chart ramp stays analogous to the brand and hue-stable across themes.
- Contrast was computed oklch → linear sRGB → WCAG, in light and dark.
Tone sits on fills and icons here, every label stays on a foreground token — which is exactly why no hue on this slider can break contrast.
Run the numbers
What it costs to build this foundation yourself — versus owning it this afternoon.
Build it yourself
3–6months
- Auth, OAuth & sessions
- Stripe billing & webhooks
- Multi-tenant + roles + RLS
- Multi-LLM AI, streaming & RAG
- Security, i18n, CMS, jobs
- Debugging it all into one app
With Boilerplate-Stack
Dayone
- All of it, already wired
- Typed, documented, tested
- AI-agent workspace included
- Docker + Coolify deploy ready
- Configurable via clean config files
- Point your agent at it and build
Your delta
3–6 months
Time saved
$50,000+
Engineering cost avoided
Walkthrough
See the whole thing in action
A quick tour of what ships in the box — admin, billing, AI and the agent workspace.
One payment. The whole codebase.
No seats. No subscription. No usage metering. Buy it, clone the private repo, ship forever.
Pay in 4 installments with PayPal
Solo
For indie hackers & solo developers
$290$174
Use code SOLO40 — save 40%
- Full source code access
- Projects allowed: 1 project
- Updates included: 12 months
- Private GitHub repo access
- Discord community support
Most Popular
Team
For small teams & startups
$750
- Full source code access
- Projects allowed: 3 projects
- Updates included: 12 months
- Private GitHub repo access
- Discord community support
Agency
For agencies & multiple projects
$1,740
- Full source code access
- Projects allowed: Unlimited projects
- Updates included: 2 years
- Private GitHub repo access
- Discord community support
- Private GitHub access
- Use it on real client work
- Discord community support
- Free updates included
Compare your options
Choose the foundation you want to maintain
Fair, source-linked comparisons for the SaaS boilerplates appearing in rising related searches on Google Trends.
Boilerplate-Stack vs supastarter
Compare architecture, payment providers, AI support, project limits and update terms.
Read the comparisonBoilerplate-Stack vs Makerkit
Compare Supabase depth, stack choices, AI runtime, licensing and automated production controls.
Read the comparisonBoilerplate-Stack vs ShipFast
Compare a broad SaaS platform foundation with a lean, reusable Next.js startup starter.
Read the comparisonQuestions, answered
Everything worth knowing before you buy.
Stop rebuilding the boring 80%
Get the foundation, point your agent at it, and spend your time on the part only you can build.
- One-time payment
- Full source code
- AI-agent native
- Ships today