The Production-Ready Next.js SaaS Boilerplate to Ship Faster.
Auth, Stripe billing, multi-tenant teams, multi-LLM AI and i18n — wired end-to-end, typed and secured. And it ships with the rules and skills your AI coding agent needs to build features that actually fit.
- One-time payment
- Full source code
- No subscription
- Yours forever
❯ git clone https://github.com/boilerplate-stack/boilerplate-stack-prod
✓Cloning into 'boilerplate-stack-prod'... done.
❯ cd boilerplate-stack-prod && pnpm install --frozen-lockfile
✓Packages: +982 · signatures verified · 0 vulnerabilities
✓Done in 11.4s
❯ pnpm run init
✓Branding, business model & admin email configured
✓Supabase, Stripe & Mailjet env vars wired
✓Database initialized · .env.local + config/app.ts generated
❯ pnpm dev
✓▲ Next.js 16.3.0 ready on http://localhost:3777
❯ claude "add a chat agent that answers from our docs"
✓Matched skill: /create-ai-agent · loaded config/ai.ts
✓Read rules: api.md · database.md · CLAUDE.md
✓Created agent · RAG pipeline · credit deduction wired
✓Types pass · ESLint clean · 0 questions asked
▸Shipped in 18s · agent live in chat selector
Built on the stack you already trust
Your AI agent is only as good as the codebase you point it at
Drop a generic starter into Claude Code and it guesses. Drop in Boilerplate-Stack and it already knows the architecture, the conventions and the patterns.
// agent without context
- asks 10+ questions before the first line
- ignores your folder structure
- reinvents auth, billing and RLS
- breaks conventions you fix by hand
- hours lost re-explaining the project
@@ agent with full context
- ships on the first prompt
- follows CLAUDE.md and modular rules
- reuses your exact patterns
- skills, subagents and hooks built in
- production code, far fewer iterations
- ~10x faster scaffolding
- Fewer iterations
- Conventions respected
- Production-ready output
Everything a SaaS needs. Already built.
Months of foundational engineering — done, typed, documented and ready to extend.
Multi-LLM AI + RAG
GPT-5.6, Claude Opus 5 and Gemini 3.6 behind one server-only LLM boundary — direct provider APIs or OpenRouter, with zero-data-retention payloads and cross-provider failover when one degrades. LangChain orchestration, SSE streaming, prompt caching, a multi-agent registry and a built-in knowledge base (PDF/TXT/MD) on pgvector + HNSW.
Enterprise security
OWASP-aligned: CSP headers, rate limiting, RLS policies, CSRF, input sanitization and Turnstile bot protection — plus a locked-down supply chain: pnpm only, a seven-day release quarantine, lifecycle scripts off by default, signature verification at install and a zero-vulnerability audit gate in CI.
EU AI Act & GDPR, shipped
Article 50 transparency implemented, not just documented: AI-interaction notice, durable output marking, a public transparency page — and the operator paperwork as templates (Art. 30 ROPA, Art. 35 DPIA, breach runbook, DPA register). Plus an Art. 15 export in 28 sections and an append-only consent trail.
Modern stack, production-ready
Next.js 16.3, React 19, Node 24 LTS, strict TypeScript, Tailwind v4, shadcn/ui, Motion, Docker + Coolify, SEO and an installable PWA out of the box.
Auth & users
Supabase Auth, OAuth providers, magic links, onboarding flow and GDPR-compliant account deletion.
Stripe billing
Subscriptions, one-time payments, credit packs, multi-currency, customer portal, webhook automation and a built-in affiliate program.
Multi-tenant
B2C personal accounts or B2B workspaces with dynamic roles, permissions, invitations and account switching.
CMS & jobs
Multi-locale CMS with a WYSIWYG editor, media library, scheduled pg_cron jobs and a webhook handler dashboard.
i18n & email
URL-based locales (FR/EN), auto-detection, localized components and a pluggable email layer (Brevo, Mailjet).
Design system
One hue token drives every brand, neutral and chart colour, so a rebrand is one line. Pattern library, manifest-driven navigation, Motion, and contrast measured rather than eyeballed.
Full QA automation
One command spins up a disposable Supabase stack, seeds member / admin / owner / platform-admin personas, proves the product end to end, then destroys the database. pgTAP covers schema, RLS and grants; Playwright covers the public site, both dashboards and all 43 admin pages, plus real Stripe, chat/SSE and document flows. The same gate runs WCAG 2.2 A/AA in light and dark, 320/768/1280px overflow, a Chromium/Firefox/WebKit matrix, visual baselines and Lighthouse budgets.
And 100+ more — all wired up113
Every item below is implemented in the codebase, not a roadmap.
Built for how you code now — with an agent in the loop
A first-class .claude/ workspace ships in the box. Your agent reads it and immediately works like a senior dev who has been on the team for months.
- .claude/
- CLAUDE.md
- settings.local.json
- rules/20 files
- architecture.md
- database.md
- anti-patterns.md
- skills/42 skills
- create-api-endpoint/
- stripe-webhook/
- agents/11 subagents
- security-reviewer.md
- db-architect.md
- hooks/6 hooks
- pre-write-guard.js
- lint-on-edit.js
- AGENTS.mdCodex
- .cursor/rules/Cursor · 17
- .gemini/GEMINI.mdGemini
❯/create-api-endpoint secure, rate-limited route + Zod
❯/stripe-webhook verified Stripe webhook handler
❯/add-translation sync FR + EN locale files
❯@db-architect audit queries for N+1
Works with Claude Code, OpenAI Codex and Cursor.
Skills
Slash commands that generate code in your exact conventions.
/create-api-endpointSubagents
Expert reviewers that audit security, queries and payments.
@security-reviewerHooks
Lint, type-check and protect sensitive files on every edit.
lint + typecheck on editRules
Modular domain rules loaded on demand, per area of the codebase.
database.md · billing.mdDrop it into the AI tool you already use
This isn't a boilerplate you read — it's one your agent operates. The .claude/, AGENTS.md and .cursor/rules/ configs ship in the box, so any AI coding tool understands the codebase from the very first prompt.
- Claude Code
- Cursor
- OpenAI Codex
- Gemini CLI
- GitHub Copilot
- + any AGENTS.md agent
Clone & install
Grab the repo and install. The full agent workspace — rules, skills, subagents and hooks — comes with the code.
❯git clone … && pnpm installOpen in your AI tool
Open the folder in Claude Code, Cursor or Codex. The agent loads your conventions automatically — zero setup, zero priming.
❯claudeShip by prompting
Describe the feature. The agent writes code that already respects your auth, billing, RLS and i18n patterns — on-pattern, not guessed.
❯add a team invites pageThe AI Act clock started on 2 August 2026
Ship a chat assistant in the EU and Article 50 binds you. It is implemented here — and the operator paperwork comes with it.
Article 50 of Regulation (EU) 2024/1689 has applied since 2 August 2026 and was explicitly excluded from the Digital Omnibus deferral. Ceiling: EUR 15,000,000 or 3% of worldwide turnover.
Obligations any product interacting directly with natural persons has to meet.
- Tell users they are interacting with an AI system (Art. 50(1))
- Mark AI-generated output in a machine-readable way (Art. 50(2))
- Publish which providers receive prompts, and what the known limits are
- Keep an Article 30 record of processing activities
- Run a DPIA where the processing is high risk (Art. 35)
- Notify a personal-data breach within 72 hours (Art. 33/34)
- Hold a DPA with every subprocessor (Art. 28)
- Prove consent over time, not just store its current state (Art. 7(1))
Implemented in the codebase and verified at runtime, not described in a README.
- Interaction notice at two placements per chat surface, so it survives scrolling
- Output marked in the database and on X-AI-* response headers, unconditionally
- Public /ai-transparency page, built from the providers actually configured
- Prompts cross one server-only LLM boundary: ZDR-capable endpoints required on the gateway, provider data collection denied, and no retention-bound model in the catalogue
- Risk tier and Annex III use cases declared in config, escalating automatically
- Article 15 export in 28 sections, referral and affiliate data included
- Append-only consent trail with policy versioning
- Terms section on AI use, in every locale
- Privacy section on automated processing and Article 22
Editable documents, pre-filled for a stock deployment.
- Art. 30
Records of processing
Eight processing activities with legal bases, recipients and retention.
- Art. 35
DPIA scaffold
Six risks analysed, residual ratings and the pre-launch mitigations.
- Art. 33/34
Breach runbook
Hour-by-hour procedure, plus the SQL that answers the regulator's scoping questions.
- Art. 28
Subprocessors & DPA
Subprocessor register and the customer-DPA clauses this stack can meet.
- AI Act
Compliance guide
Deadlines, Annex III self-assessment, env vars and a verification query.
The implementation is done. Classifying your own product's risk tier stays your call — the config makes it explicit instead of assuming it. Direct-provider ZDR stays an account and DPA control on your side: the code sets store: false and the SDK flag, it cannot sign your contract.
A real product, not a landing-page demo
Fully built, responsive screens — admin, billing, AI and CMS — you can ship today.
A complete admin platform
Users, organizations, subscriptions, CMS, media, scheduled jobs and analytics — all built, styled and responsive.
- User & workspace management
- Subscription & payment views
- CMS + media library
- Scheduled jobs dashboard
Rebrand the whole product in one line
Every brand, neutral, sidebar and chart colour derives from a single hue token. Drag it and watch a dashboard change identity — no stylesheet sweep, no find-and-replace.
:root {
--brand-h: 288;
}- Raw palette usage is down to two documented exceptions across the codebase.
- Semantic states keep fixed hues, so a rebrand never turns "success" purple.
- The chart ramp stays analogous to the brand and hue-stable across themes.
- Contrast was computed oklch → linear sRGB → WCAG, in light and dark.
Tone sits on fills and icons here, every label stays on a foreground token — which is exactly why no hue on this slider can break contrast.
Run the numbers
What it costs to build this foundation yourself — versus owning it this afternoon.
- Auth, OAuth & sessions
- Stripe billing & webhooks
- Multi-tenant + roles + RLS
- Multi-LLM AI, streaming & RAG
- Security, i18n, CMS, jobs
- Debugging it all into one app
- All of it, already wired
- Typed, documented, tested
- AI-agent workspace included
- Docker + Coolify deploy ready
- Configurable via clean config files
- Point your agent at it and build
See the whole thing in action
A quick tour of what ships in the box — admin, billing, AI and the agent workspace.
One payment. The whole codebase.
No seats. No subscription. No usage metering. Buy it, clone the private repo, ship forever.
Solo
For indie hackers & solo developers
- Full source code access
- Projects allowed: 1 project
- Updates included: 12 months
- Private GitHub repo access
- Discord community support
Team
For small teams & startups
- Full source code access
- Projects allowed: 3 projects
- Updates included: 12 months
- Private GitHub repo access
- Discord community support
Agency
For agencies & multiple projects
- Full source code access
- Projects allowed: Unlimited projects
- Updates included: 2 years
- Private GitHub repo access
- Discord community support
- Private GitHub access
- Use it on real client work
- Discord community support
- Free updates included
Questions, answered
Everything worth knowing before you buy.
Stop rebuilding the boring 80%
Get the foundation, point your agent at it, and spend your time on the part only you can build.
- One-time payment
- Full source code
- AI-agent native
- Ships today