What to Check in a Next.js SaaS Boilerplate with Stripe and Auth
By make1day · Updated 2026-11-07
When you search for a Next.js SaaS boilerplate with Stripe and auth, you are really asking one question: how little of the commodity 60% do I have to write myself?
The four non-negotiables
- Auth — email magic-link and OAuth through a managed provider, with row-level security on by default.
- Billing — a hosted checkout plus a webhook that flips a flag in your database. If the webhook is not wired, it is a demo, not a business.
- Database — Postgres with a seeded schema and RLS policies you can actually read.
- Deploy — a Vercel-ready config and a one-command path to production.
The part most templates get wrong
Webhook verification is not a detail. A missing, invalid or malformed signature must be rejected with HTTP 400 — not silently treated as an empty event list. In this codebase every provider adapter throws on verification failure, and an empty array means only one thing: the event was validly signed but needs no handling. Replays are deduplicated by event id before any license or plan is written.
Most free templates skip idempotency; you discover it at your first refund or duplicate event.
One gateway or six?
The default here is Waffo Pancake (Merchant of Record). Stripe, Creem, PayPal, Lemon Squeezy and Waffo Acquiring are switchable at generation time, with none as a valid choice when you bring your own billing. A single POST /api/webhook route and one PaymentProvider interface sit under all of them, so your app code never branches on gateway.
Ten-minute evaluation
Clone it, set the env vars, run the dev server, then try to: sign up, hit the paywall, complete a test checkout and see the plan flip. Also fire a webhook with a bad signature — it must return 400, never 200. If any step is blocked by missing code, keep looking.
FAQ
Does a starter need Stripe specifically?+
No. Stripe is the most documented option, but a Merchant of Record (Waffo Pancake, Lemon Squeezy) handles global tax without a company entity, and some markets need PayPal or Creem. What matters is one provider-agnostic checkout/webhook contract.
What should a webhook return on a bad signature?+
HTTP 400. A 200 with an empty event list lets forged or malformed requests look successful. Verification failure must throw; only a validly signed but unhandled event should be acknowledged as ignored.
Is OAuth included?+
With Supabase Auth, yes — email magic-link plus Google, GitHub, Apple and Microsoft. The local SQLite fallback is an account/role directory, not a full auth provider: no MFA, no OAuth, no session rotation.
All frequently asked questions · Markdown version (for AI agents)