Skip to main content
New

SaaSForge Core

Multi-tenant Next.js SaaS boilerplate with Stripe & Supabase

Each customer lives in a workspace with Postgres RLS. Four roles map to real permissions. Stripe handles plans and the portal. Resend sends invites. You also get 2FA, SAML SSO hooks, API keys, inbound and outbound webhooks, audit rows on writes, support impersonation, and optional IP allowlists.

$199$299
Launch pricing · One-time purchase · Full source code

Secure checkout by Polar (Merchant of Record) · Taxes calculated at checkout · Refund Policy

View Documentation
SaaSForge Core: multi-tenant dashboard with workspaces, RBAC, and billing

What enterprise-minded buyers verify before they buy a multi-tenant Next.js SaaS boilerplate

  • Next.js App Router
  • TypeScript
  • Supabase + RLS
  • Stripe billing
  • Resend invites
  • E2E + unit tests
Next.js 16
App Router + React 19
4 roles
Owner · Admin · Member · Viewer
Stripe + Supabase
Billing, auth, Postgres RLS
Use cases

What you'll build

Three concrete products you can ship on this template without touching the plumbing.

CRM / Customer DB

Workspace-scoped contacts and deals with RBAC, custom fields, saved views, and team invitations.

Project Management

Teams, roles, tasks, bookmarks, and comments with tenancy already enforced in SQL.

Customer Portal

Give your customers a branded, role-based portal with SSO, audit trails, and usage-based billing.

Why teams buy this multi-tenant Next.js SaaS boilerplate

Workspaces with Postgres RLS, four roles, Stripe subscriptions, enterprise security primitives, and deep MDX docs are structured so technical buyers can validate scope before checkout, then ship without rewriting tenancy from scratch.

Workspace-first product surface your tenants can trust

Multi-tenant templates break when the UI pretends tenancy exists but the database does not. Here, workspaces are the boundary, permissions are explicit, and the dashboard patterns match what a serious B2B fork looks like. No single-tenant demo with a “team id” column bolted on.

Get instant access

Included in this template

  • Workspace switcher and settings flows that match real account shapes
  • Role-aware navigation and empty states that cut support tickets early
  • Entity patterns (saved views, bookmarks, comments, tags) you can extend
  • File attachment flows scoped to workspace data
  • Scheduled actions pattern for cron-style product behavior
  • Marketing pages (hero, pricing, testimonials, FAQ, CTA) included for launch

Supabase Auth + Postgres RLS as the tenancy backbone

Evaluators ask one question first: “Where is isolation enforced?” Row-level security, invitation flows via Resend, and migrations you can actually read beat hand-wavy “we'll add RLS later” promises. Especially when the buyer is a security-conscious team.

Read Supabase setup

Included in this template

  • RLS-first schema with workspace membership modeled explicitly
  • Email and OAuth sign-in via Supabase Auth
  • Invitation emails and role assignment wired to Resend
  • Ownership transfer and membership lifecycle hooks
  • SQL migrations for reproducible environments
  • Operational notes for local dev, staging, and production

Stripe subscriptions, portal, and webhooks (not slides)

Billing is where boilerplates usually lie by omission. Checkout, customer portal, plan tiers, and webhook lifecycle handling are real code. Swap price IDs and ship, without rewriting a subscription state machine during your first sprint.

See Stripe setup guide

Included in this template

  • Starter / Pro / Enterprise tiers, monthly and yearly
  • Webhook verification and subscription state updates, documented end-to-end
  • Customer portal integration for self-serve plan changes
  • Incoming and outgoing webhooks for product integrations
  • Clear mapping between Stripe objects and your workspace models
  • Guardrails that reduce double-charge and desync incidents

Enterprise security primitives: 2FA, SAML SSO, audit trails

If your buyer is an IT security reviewer, they will ask about MFA, SSO, and auditability. TOTP 2FA, SAML hooks for common IdPs, API keys with masking, optional IP allowlists, and mutation audit logs ship as first-class patterns. The boring enterprise features that close deals.

Read authentication docs

Included in this template

  • TOTP two-factor via Supabase Auth
  • SAML SSO patterns (Okta, Azure AD, Google Workspace, custom IdPs)
  • API keys with create, revoke, and secret masking in the UI
  • IP allowlisting for workspace access where required
  • Login history with IP and timestamp for support investigations
  • Audit logs on mutations (actor, resource, metadata) for compliance

21+ MDX guides so your technical champion can self-serve

A private repo without docs is a liability. Built-in MDX documentation covers install, Stripe, Supabase, deployment, data modeling, and testing. Your champion can onboard without Slack-spamming the template author the day after checkout.

Browse documentation

Included in this template

  • Docs index with deep guides for setup, configuration, and deployment
  • Product overview and route reference for navigating the codebase quickly
  • Testing guidance (Vitest + Playwright) for teams that ship with CI
  • GDPR-oriented export and deletion flows as starting points
  • Clear boundaries for what ships vs what you customize per niche
  • Faster stakeholder reviews when procurement asks for “the manual”

Extensible base: webhooks, keys, and support workflows

The best boilerplates stop before your product differentiators, but not before the integrations. Outbound webhooks, inbound endpoints, support impersonation, and granular permissions give you a base to add vertical features without rewriting tenancy and billing first.

Buy template (one-time license)

Included in this template

  • User impersonation for support and debugging, with guardrails
  • Webhook emit/listen patterns suitable for partner integrations
  • Granular permission checks aligned to the four-role model
  • shadcn/ui component set with dark mode across app and marketing
  • Metadata, Open Graph, JSON-LD, sitemap, and robots patterns
  • Config-first branding: reskin without a rewrite

FAQ

Questions we get before someone buys a template

Ready to Ship?

Start Building with SaaSForge Core Today

Get the complete source code and launch your multi-tenant SaaS in days, not months.