Everything you need to ship

Authentication

Passwordless OTP and magic-link sign-in via better-auth, plus optional Google/GitHub/GitLab/Bitbucket OAuth.

Two-factor auth

Time-based one-time codes (TOTP, the standard behind Google Authenticator and similar apps) with 10 backup codes via better-auth. Works across OTP, magic-link, and OAuth sign-in, not just password flows, since there are none.

Admin panel

User management, impersonation, and access control at /dashboard/admin, guarded and audit-logged.

API keys

Per-user API key management. Keys are hashed (SHA-256) and plan-limited, never stored in plaintext.

Feature flags

Runtime toggles managed from the admin panel, no redeploy needed to turn a feature on or off.

Stripe billing

Checkout, customer portal, and webhook handling end-to-end. Subscriptions and one-time purchases.

Credits system

Per-call metering with atomic deduction, credit balance never goes below zero under concurrent use.

File uploads

S3 uploads straight from the browser via a temporary, server-generated upload link, so no AWS credentials ever touch the client. Plan-limited, metadata in per-user SQLite.

Per-user SQLite

Every user gets their own isolated database file. No shared schema, no row-level security to write or forget.

Typed error handling

Every server function returns Result<T>, not a thrown exception. Errors are values you check.

Domain events

In-process typed event bus for decoupled side effects: emails, jobs, webhooks, all typed end to end.

Durable operations

Multi-step flows touching Stripe, S3, or the filesystem resume correctly if the server dies mid-operation.

Postgres fork included

Same purchase also includes a Postgres/Drizzle fork with the same patterns, for teams who want shared-schema data or a Cloudflare Workers deploy.

Notifications

In-app notification bell backed by per-user SQLite, mark-read and mark-all-read built in.

Notification preferences

Per-user granular control over which notification types they receive.

Sidebar preferences

Per-user control over which dashboard navigation items are visible.

Onboarding wizard

Multi-step flow shown to new users after signup, easy to extend with new steps.

GDPR export + deletion

Durable, crash-safe account deletion and full data export, built in from day one.

Audit log

Read-only event viewer so users can see their own account activity.

Feature requests

Shared voting board where any authenticated user can propose and upvote ideas.

Notes

Reference CRUD feature showing the full pattern: simple per-user note management.

Integrations grid

Static card grid for third-party services users can connect to.

AI chat

Full AI chat at /chat with per-user SQLite history, streaming via OpenRouter or on-device.

SEO utilities

Centralized meta tags and structured data helpers so every page is search-ready.

Blog

Static blog rendering Markdown or JSON posts via content-collections.

Lead capture

A ready endpoint and drop-in form for collecting emails before you launch.

Cookie consent

GDPR-style consent banner, toggled from the admin panel, no redeploy needed.

Email validation

Blocks disposable addresses and optionally checks MX records at signup.

Captcha

Optional Cloudflare Turnstile on public forms: login, signup, lead capture.

Background jobs

SQLite-backed queue with retries, dead-letter handling (jobs that keep failing get set aside for review instead of retrying forever), and graceful shutdown. Survives restarts.

Transactional email

React Email components, Resend by default, SMTP/Nodemailer as a drop-in swap.

Observability

Sentry error tracking on client and server, one env var to enable.

Theming

Full look and feel lives in two CSS blocks. Swap the palette, no component edits.

UI components

shadcn/ui pre-configured and fully owned in your repo, no package to update.

E2E testing

Playwright browser tests covering full user flows, ready for local development.