Questions indie founders actually ask

Yes — two separate consoles ship by default.

• `/account` is the signed-in user area: profile, subscription, issued license keys, settings.
• `/admin` is the operator area: users, licenses, traffic, runtime status.

Both are five-language (EN/ZH/JA/FR/DE).

In the Builder, account and admin are toggleable features. Unchecking one removes its entire route tree from the ZIP, and navigation plus post-login redirects are rewritten so no dead links remain.

Both are writable:

• PATCH /api/profile edits the signed-in profile
• PATCH /api/admin/users manages roles (admin only)
• /api/billing/portal opens the provider billing portal
• /admin/tickets changes ticket status

RBAC tables (0004_profiles_rbac.sql) and org tables (0007_orgs.sql) ship with every build.

Protect `/admin` before deploying: ADMIN_USER / ADMIN_PASSWORD create an operator account that signs in through /admin's own form with an HMAC-signed session cookie; with no credentials configured, the console stays closed in every environment. A Supabase user with an admin/staff role — or an ADMIN_EMAILS allowlist entry — is accepted too.

The full source ZIP requires a license — a Buyout license ($99) or an active Care plan.

After a paid webhook, the key is emailed to the checkout address automatically, idempotent per issued key. A failed send is queued in mail_outbox and retried by a cron endpoint.

You can also:

• Sign in with the email you paid with and open /account/licenses
• Paste an offline key into /license
• Use the claim form on /license to request a re-send if you checked out as a guest or used a different login email

Real delivery still requires configuring a mail provider and a host scheduler — those are deployment steps, not missing code.

No license yet? Download a free, source-free preview: the complete file inventory of your build plus the design tokens (no source code). The gate protects this site only; the project you download ships with it disabled.

It's a prebuilt, production-grade starting point for a SaaS: authentication, database, billing, an admin area and often a working AI feature.

The point is to skip 4–8 weeks of commodity setup and build only what makes your product unique.

1. Start from a configurable starter such as make1day.
2. Set your env vars — Supabase, a payment gateway, an AI key.
3. Pick your stack in the Builder.
4. Download the generated scaffold and deploy to Vercel or Cloudflare.

Most founders reach a launchable MVP in days, not months.

Yes. The generated app ships with hosted checkout (Waffo Pancake by default) and webhook-synced plan status.

In the Builder you can switch to Stripe, Creem, PayPal, Lemon Squeezy or Waffo Acquiring — checkout and webhook routes are provider-agnostic, and only the selected adapter ships in the ZIP.

Trial periods are configured in your payment provider's dashboard, not hardcoded in the scaffold.

With Supabase Auth, yes: email magic-link plus OAuth (Google/GitHub/Apple/Microsoft) with row-level security on by default.

The local SQLite fallback is not a full auth provider. It is an account and role directory with:

• a real password sign-in (hash-only sessions)
• password reset and email-verification tokens

…but no MFA, no OAuth and no session rotation. Production should use Supabase.

Yes, with caveats. Selecting multi-tenancy ships supabase/migrations/0007_orgs.sql (organizations, memberships, row-level security) and lib/org.ts helpers.

The workspace switcher UI and /api/org endpoints ship only when the account console is also selected, because they live under /account.

You must run the migration yourself and add .eq("org_id", …) to your own domain tables — the starter cannot scope tables it does not know about. For a batteries-included B2B tenant model, Makerkit or Supastarter go deeper.

Three families, all streaming:

• OpenAI-compatible: OpenAI, OpenRouter, DeepSeek, Groq
• Anthropic: Claude
• Google: Gemini

/api/ai streams token-by-token as incremental text/plain from all three, and enforces a per-user daily quota (AI_MESSAGES_PER_DAY, default 50). Exhausted budgets get HTTP 429 with a truthful Retry-After.

Provider errors are logged server-side instead of being disguised as a successful reply.

A complete, agent-readable docs set:

• root AGENTS.md — repo contract and definition of done
• a style-locked design.md
• scoped rules in ai/rules/*.md
• .cursor/rules/*.mdc for Cursor
• CLAUDE.md for Claude Code
• up to 12 skills/*.md playbooks

After changing shipkit.config.json, run npm run ai:docs to rebuild all of them from one shared renderer.

This site's llms.txt, llms-full.txt and MCP endpoint are site-only and pruned from every customer ZIP.

Yes. The source is yours to rename and restyle — 11 visual styles (including the hand-drawn Doodle palette) are generated into design.md.

The ZIP is white-labelled: our marketing pages, brand strings and the generator itself are pruned, and the license gate defaults to off in source. There is no runtime watermark or phone-home.

The source is a one-time buyout you own forever. Free updates are included for 12 months; after that, make1day Care keeps them coming.

Care is an optional monthly subscription for ongoing updates, hosting help and priority support.

The license lets you build and ship your own products (commercial use allowed), but not resell or redistribute the source as a template. See the pricing page for current prices and the full rules.

Yes. Custom components, private deployment, AI/RAG integration with your own data, migrations and audits are scoped in a free 30-minute 1:1 call, then quoted at a fixed price before work starts.

There is no self-checkout and no automatic charge — use the Book a 1:1 call button on the pricing page.

It's Vercel-ready, and also runs on:

• Cloudflare Workers via the OpenNext adapter (nodejs_compat)
• your own Node server

The generated README lists the env vars you need.

Heads-up: the local SQLite backend is for development only — it does not persist on serverless and cannot run on Workers at all, so configure Supabase for production.

The marketing site and its documentation are public. The generated template is a paid, licensed product you receive as source after purchase, with an MIT LICENSE file in every ZIP.

You can inspect the live stack this site is built on.

Yes — and it is enforced by CI. Home, pricing, sitemap, robots and legal pages are regenerated from the customer's own configuration; marketing pages, brand strings and the generator source are pruned.

The build matrix downloads every representative ZIP and asserts there are no brand names, no dead links and no generator files — then runs the type checker inside it. 18 configurations are covered today.

Seven options in the Builder:

• Waffo Pancake (default Merchant of Record)
• Waffo Acquiring
• Stripe
• Creem
• PayPal
• Lemon Squeezy
• none (bring your own billing)

All six adapters implement the same interface: create checkout, create a portal session, verify a webhook.

Every adapter throws on an invalid or missing signature (HTTP 400); an empty event list means only a validly signed but unhandled event (HTTP 200 ignored). npm run probe:webhook checks that contract offline.

Yes. The storage layer picks Supabase or a local SQLite database (node:sqlite) based on whether SUPABASE_SERVICE_ROLE_KEY is set.

License keys, orders, traffic, quotas, AI usage, support tickets and user roles all have both backends.

SQLite is intended for local development: it does not persist on serverless and its auth path lacks MFA, OAuth and session rotation.

Through a full machine-readable surface:

• llms.txt (short overview) and llms-full.txt (long-form facts)
• an OpenAPI 3.1 contract
• an MCP scaffold_project tool at /api/mcp
• per-page canonical and hreflang links
• Organization / WebSite / OfferCatalog / FAQPage / BlogPosting JSON-LD
• a sitemap that lists the machine-readable routes
• robots.txt rules that explicitly allow AI crawlers

Every article also publishes a plain Markdown variant at /blog/<slug>/md. All editorial content is attributed to the company name make1day, so there is one consistent entity to cite.

Buyout purchases are refundable within 14 days of purchase. We deliberately do not condition this on whether you downloaded the ZIP.

Download, key-redemption and key-email events are logged in delivery_events with a hashed email — but they are evidence for support disputes, not a refund condition.

See terms for the full rules and privacy for the data we actually retain.

No. MAIL_PROVIDER accepts resend (Resend REST), sendgrid (SendGrid v3), postmark (Postmark Server API), mailgun (Mailgun Messages API), webhook (a custom HTTP mailer) or none (a safe logged no-op).

MAIL_PROVIDER=smtp is a reserved, not-implemented value; there is no nodemailer dependency.

A durable retry queue (mail_outbox + /api/cron/mail-outbox) does exist, but the host scheduler must be configured by the operator; with MAIL_PROVIDER=none nothing is queued or sent. SPF/DKIM/DMARC are operator-side DNS work. See docs/email.md.

11 visual styles — 10 palette themes plus the hand-drawn Doodle theme — and 18 representative build-matrix cases.

Each case downloads a real ZIP and runs tsc --noEmit inside it; the Doodle CSS is asserted to be absent from the other styles. See docs/build-matrix.md and the /styles gallery.