One-time purchase · $249 · Full source code
Build your B2B SaaS. Not the infrastructure behind it.
Production-ready Next.js + Supabase infrastructure for authentication, multi-tenancy, RBAC, billing, API keys, usage limits, and more.
Next.js 15 · React 19 · Supabase · Stripe · TypeScript
26/26 production checks passing · Full source code · One-time purchase
Team members
12
Plan
Pro
Usage
68%
Projects
8
The dashboard you ship on day one — explore the live demo.
01 · The problem
Every B2B SaaS starts with the same six months.
Before your actual product exists, you build the same foundation every competitor built. It's undifferentiated, error-prone, and it eats your runway.
Authentication plumbing
Email, OAuth, sessions, password resets — two weeks of glue code before you write a single feature.
The organization model
Multi-tenancy touches every table, every query and every policy. Retrofitting it later is the most expensive refactor in SaaS.
Row Level Security
One missing policy is a data breach. Getting Postgres RLS right across tenants is slow, careful work.
Stripe integration
Webhooks, seat tracking, plan limits, customer portal — billing state that must stay exactly in sync with your database.
Everything after billing
Invitations, roles, audit logs, API keys, usage metering. All expected by customers. None of it differentiating.
02 · The solution
One purchase. The whole foundation.
B2B SaaS OS is a source-code boilerplate: the multi-tenant data model, auth, billing, and developer infrastructure — already wired together, already deployed once, already reviewed.
- Clone it, rename it, ship it — no license server, no phone-home
- Multi-tenant from migration zero, not retrofitted
- Policies enforced in the database, not just the app
- Stripe that survives real webhooks and proration
- Readable, strictly-typed code you fully own
- No runtime fees, no vendor lock-in
├── app/ # routes: marketing, auth, dashboard
├── components/ # ui, dashboard, marketing, shared
├── config/ # site · navigation · plans · permissions
├── lib/ # supabase clients · rbac · usage · audit
├── supabase/
│ ├── migrations/ # orgs, members, invitations, audit, usage
│ └── policies/ # row level security, per table
├── stripe/
│ ├── webhooks/ # subscription + invoice handlers
│ └── portal/ # customer portal session route
└── docs/ # setup → deployment03 · Multi-tenancy
Tenancy designed in, not bolted on.
Organizations are the root of the data model. Members, roles, projects, API keys and usage all hang off an organization_id — and every query is scoped by policy, not by hope. Your customers' data stays partitioned from the first migration.
organization — Acme Inc.
members
12 rows
SC · MT · PS · +9
roles
owner
admin · billing · member
projects
8 rows
each with own keys
every row carries organization_id — RLS scopes it automatically
04 · Authentication
Sessions done once, done right.
Supabase Auth handles the hard parts — hashing, rotation, MFA-ready sessions — while the boilerplate supplies the flow: prebuilt sign-in, sign-up, forgot and reset pages, OAuth callbacks, and a dedicated route that exchanges codes for sessions.
Email & password
Sign-up, verification, password reset — forms included
Google OAuth
One-tap consent, account linking
GitHub OAuth
Developer-first sign-in
Magic link
Passwordless sessions via email
05 · Row Level Security
Policies live in SQL, not in your React code.
Authorization that lives only in application code is one refactor away from a leak. B2B SaaS OS ships deny-by-default Postgres policies per table, so even a buggy query can't cross tenant boundaries.
-- deny by default: only org members read org rows
create policy "members_read_org_projects"
on projects for select
using (
exists (
select 1 from organization_members m
where m.organization_id = projects.organization_id
and m.user_id = auth.uid()
)
);06 · RBAC
Four roles. One permission map. Zero guesswork.
Owner, Admin, Billing and Member — declared once in config/permissions.ts, enforced by RLS policies, and checked in-app through a single hasPermission() helper.
| Capability | Owner | Admin | Billing | Member |
|---|---|---|---|---|
| View projects & data | ||||
| Create projects | ||||
| Invite & manage members | ||||
| Manage API keys | ||||
| Manage billing & plan | ||||
| Delete organization |
07 · Billing
Stripe that survives real webhooks.
Checkout, customer portal, seat-based plans and invoice history — with handlers that reconcile Stripe's events into local state so your database always reflects what the customer actually pays.
webhook events handled
checkout.session.completed
→ activate the subscription
customer.subscription.updated
→ sync plan, seats & status
invoice.paid
→ record the payment
customer.subscription.deleted
→ downgrade at period end
08 · Developer infrastructure
The features customers assume you already have.
Every B2B buyer asks for these. Ship them on day one instead of quarter three.
API keys
Scoped keys with live/test prefixes, hashed at rest, rotation and revocation built in.
api_keysAudit log
Append-only trail of every sensitive action — actor, target, metadata.
audit_logUsage limits
Metered request counters compared against plan limits, with overage hooks.
usageInvitations
Tokened invite links with expiry, role pre-selection and an acceptance flow.
invitations09 · Architecture
Boring on purpose.
No exotic runtimes, no custom DSLs. A stack a mid-level developer can read in an afternoon and a senior developer can extend without asking permission.
“The best infrastructure is the kind you stop thinking about. This is the foundation, finished — so the next commit you write is product.”
Server Components by default. Client JavaScript only where interaction demands it. Strict TypeScript end to end.
10 · Example application
A working reference, not a skeleton.
The boilerplate ships with a complete example app — the same dashboard in the live demo — so every feature has a real implementation to copy from: organizations, invites, billing, usage, keys and audit.
11 · Pricing
Pay once. Own it forever.
No seats on the boilerplate, no revenue share, no runtime license checks.
B2B SaaS OS
One-time payment$249once
Full source code, yours forever. One license, unlimited projects for you and your clients.
Get B2B SaaS OSInstant download via Gumroad
- Full source code
- Multi-tenancy
- PostgreSQL RLS
- Authentication
- Organizations
- RBAC
- Team invitations
- Stripe billing
- API keys
- Audit logs
- Usage limits
- Documentation
- Updates
12 · FAQ
Questions, answered.
Anything else, the documentation covers setup through deployment.
What exactly do I get for $249?
A ZIP with the complete, unminified source: the Next.js application, Supabase migrations and RLS policies, Stripe webhook handlers, and documentation. No obfuscation, no license server, no phone-home.
Is this a subscription?
No. One payment of $249, yours forever, updates included. You keep building and shipping with it indefinitely.
Can I use it for client projects?
Yes. You can build and deploy unlimited projects for your own company or your clients. What you can't do is resell the boilerplate itself or redistribute the source.
Which services do I need?
You connect your own Supabase and Stripe accounts. Both have generous free tiers to get started, and you own the billing relationship with your customers end to end.
How customizable is it?
Everything is plain TypeScript, Tailwind tokens and shadcn/ui components. Rebrand in config/site.ts and app/globals.css, extend the schema with normal SQL migrations, and wire your own product features on top.
Do I own the code I build with it?
Your application code is yours. The boilerplate itself is licensed, not sold — see the license page for the short list of restrictions (no reselling or redistributing B2B SaaS OS itself).
Stop building infrastructure. Start building product.
Production-ready Next.js + Supabase infrastructure for authentication, multi-tenancy, RBAC, billing, API keys, usage limits, and more. One payment, full source, yours to ship.