S SaaS Boilerplate
ID
GitHub
Free & open source · MIT →

The SaaS layer, already written.

Auth, billing, organizations, invitations, and an Indonesian payment gateway are done. Free and open source — clone it and focus your time on the product itself.

View on GitHub Read the docs

Built with

saas-boilerplate — zsh
$ bun run docker:up
Container saas-postgres Started
Container saas-mailpit Started
$ bun install
bun install v1.3
573 packages installed
$ bun run db:migrate && bun run db:seed
Migrations complete.
Seeding plans...
Seed complete.
$ bun run dev
API listening on http://localhost:3000
→ Web running at http://localhost:5173
$
The stack

What is wired.

Not a buzzword list. These are the packages actually installed.

  • bun@1.3

    Bun 1.3

    Install, dev, build, and test through one tool.

  • hono + zod-openapi

    Hono + zod-openapi

    Type-safe routes. OpenAPI docs generated from the code.

  • drizzle + postgres

    Postgres 16 + Drizzle

    Migrations live in the repo. Not in a vendor dashboard.

  • better-auth

    Better Auth

    Email, OAuth, organizations, invitations, roles.

  • duitku · midtrans · xendit

    Duitku

    Implemented. Midtrans, Xendit, and Stripe share the same interface — implementation is on you.

  • i18next (en · id)

    i18next

    Bahasa Indonesia and English resources included.

The problem

What actually slows SaaS shipping down.

Not the feature list. It is the layer underneath — auth, orgs, billing, webhooks. The part that gets rewritten from scratch on every project.

01

Auth is not just a login page.

Sessions, email verification, password reset, OAuth, organizations, invitations, roles. Written from zero, this eats weeks.

02

Each payment gateway speaks its own dialect.

Duitku, Midtrans, Xendit — signature schemes, webhook shapes, and status codes all differ. Wiring the first one is work. The second starts over.

03

Miss one query scope and a tenant sees another tenant.

Every query needs the org scope. Active org needs to be resolved per request. Role checks need to be in the right place. One slip and the data leaks.

04

A leaky foundation slows the whole team down.

Loose types, manual migrations, brittle test setups. Bugs that should surface in the editor only show up in production.

Tech stack

What you get.

The full list of packages with their versions. Everything is already integrated.

Runtime & Language

Runtime and language.

One tool for install, dev, build, and test. TypeScript strict mode across every workspace.

  • Bun runtime + package manager + bundler 1.3
  • TypeScript strict mode 5.7
  • Biome formatter + linter 2.5
Backend

A type-safe API framework.

Hono for routing, zod-openapi for request validation and auto-generated OpenAPI spec. Swagger UI at /api/docs.

  • Hono 4.12
  • @hono/zod-openapi 1.4
  • @hono/swagger-ui 0.6
  • Zod 4.4
Database

Postgres with migrations in the repo.

Drizzle ORM with TypeScript schema. Versioned migrations. No drift between dev and production.

  • Postgres Docker Compose untuk dev 16
  • Drizzle ORM 0.45
  • drizzle-kit generator migrasi 0.31
  • postgres.js driver 3.4
Auth

Better Auth with the organization plugin.

Sessions, email verification, password reset, OAuth (Google/GitHub), organizations, invitations, and roles — all one package.

  • Better Auth 1.6
  • Organization plugin multi-tenant built-in
Payments

Swappable payment gateway.

Abstract interface as the contract. Duitku already implemented. Midtrans, Xendit, and Stripe just need implementation — they share the same interface.

  • Duitku VA, e-wallet, QRIS implemented
  • Midtrans butuh implementasi interface
  • Xendit butuh implementasi interface
  • Stripe butuh implementasi interface
Frontend

React 19 with file-based routing.

TanStack Router auto-generates the route tree. TanStack Query for server state. Tailwind v4 with shadcn/ui — every component already customized.

  • React 19.2
  • Vite 8.1
  • TanStack Router file-based routing 1.170
  • TanStack Query server state 5.101
  • Tailwind CSS 4.3
  • shadcn/ui komponen ter-customize new-york
  • Radix UI primitives aksesibel pinned
  • i18next en + id 26.3
  • lucide-react ikon 1.24
Email

React templates, sent via Resend.

React Email for templates. Falls back to console log when the API key is missing — dev is never blocked.

  • React Email template React 6.7
  • @react-email/components 1.0
  • Resend delivery 6.17
DevOps & Testing

CI/CD and tests from day one.

Multi-stage Dockerfiles for API and web. GitHub Actions for lint, typecheck, and test. A separate workflow builds and pushes images to GHCR. Vitest for unit tests, Playwright for end-to-end.

  • Docker API + web images multi-stage
  • GitHub Actions lint + typecheck + test CI
  • Vitest unit test 3.2
  • Playwright end-to-end 1.61
Reliability

Things that usually get missed.

Not optional add-ons. These are the leaks that show up once production has real users.

  • 01

    Full security headers

    CSP, HSTS, X-Frame-Options, Referrer-Policy — all wired through hono/secure-headers. The SPA nginx is hardened too.

  • 02

    Consistent error shape

    AppError with a stable code and HTTP status. Clients branch on the code, not on parsed strings.

  • 03

    Per-IP rate limit

    Sliding window on business routes, stricter cap on sign-in and password reset. Webhooks are exempt so provider retries do not trip the limit.

  • 04

    Signatures verified before DB writes

    Every gateway adapter verifies the signature timing-safely. Amount and currency are re-checked against the pending order.

  • 05

    Idempotent webhooks + state machine

    Payments dedupe by (provider, reference). Terminal states (paid/refunded) cannot regress. Subscription activation runs in the same transaction.

  • 06

    Role-based access

    requireActiveOrg + requireRole helpers. Owner/admin/member hierarchy. Workspace-changing routes require admin at minimum.

  • 07

    OpenAPI docs auto-generated

    Routes declared with createRoute() appear in Swagger UI at /api/docs during dev. In production docs are gated off.

  • 08

    Test harness in place

    Vitest for unit tests, Playwright for end-to-end. GitHub Actions CI is already configured.

Works with AI tools

Built for coding agents, not just humans.

Hierarchical AGENTS.md files carry the invariants next to the code they govern. Point Claude Code, Cursor, or Copilot at the repo and it ships features instead of rediscovering your stack.

  • 01

    AGENTS.md at every layer

    A root map plus one AGENTS.md beside each package. Golden rules, landmines, and file-sync tables live where the agent reads them — no context re-derivation per session.

  • 02

    Invariants written down, not implied

    Tenant scoping, money-as-integer, provider-agnostic payments, error-at-boundary — each rule is stated explicitly so an agent (or a new hire) cannot silently break it.

  • 03

    Guardrails the agent can enforce

    Every rule pairs with a grep or command to verify it — one <AppShell>, filter by organization_id, i18n keys in both locales. Reviewable by a machine before merge.

  • 04

    Decision tree for new work

    New table, route, page, provider, or error code each has a documented path. The agent follows the same recipe you would, touching the exact files that must stay in sync.

  • 05

    Type-safe from DB to UI

    OpenAPI is the HTTP source of truth; shared @saas/* types flow across packages. A broken contract fails typecheck, so the agent catches it at compile time.

  • 06

    Translations fail loud

    The id locale is typed against en, so a missing key breaks the build instead of falling back silently. Agents add copy to both files or CI stops them.

+ No secret prompt. The docs your team reads are the same context your agents get.

Use cases

Products this shape fits.

  • Subscription SaaS

    Monthly IDR plans. Organizations with members and roles. Checkout through a swappable gateway.

  • Marketplace

    Vendors each get their own workspace. Members, invitations, and billing scoped per organization.

  • Internal tools

    Auth guards, role-based access, and a dashboard shell you can extend without a rewrite.

  • API products

    Rate limits, consistent error shape, and hooks for usage-based billing.

  • Agency projects

    One codebase across client apps. Swap gateway config per project.

  • Indie SaaS

    Build solo without rewriting the plumbing. Spend the time on what makes your product different.

Honest scope

Clear about the boundaries.

Not a hosted platform. Not a code generator. It is a repo you clone and edit freely.

What you get
  • + A TypeScript codebase that runs
  • + A monorepo with clear package boundaries
  • + A multi-tenant, gateway-agnostic foundation
  • + A starting point you own outright
What it is not
  • − A hosted SaaS platform
  • − A code generator you cannot touch again
  • − Business logic specific to your product
  • − A guarantee that it fits every project
Start today

Start from further along.

If auth, billing, or multi-tenancy has stalled you before — those parts are done here. Clone the repo and build.

View on GitHub Read the docs