A Next.js 16 SaaS template that is already production-ready. 10 locales, 45 themed UI primitives, auth and Stripe billing wired, a full admin panel, and 60+ shipped routes. Ship a real SaaS in days.
first 1000 buyers, then $249
7-day no-questions refund · Instant delivery
Everything is plain TypeScript and React. No runtime lock-in, you own the code.
EN, VN, ES, FR, JA, KO, ZH, AR (with RTL), ID and TH ship as working locales. Type-safe translation keys, browser-locale and timezone auto-detect, hreflang alternates, a multi-locale sitemap, and a language switcher. Drop a new locale file into `src/locales/` and the build picks it up with no config change.
Every shadcn and Base UI primitive a SaaS needs: DataTable on TanStack v8, recharts, a cmdk command palette, a vaul drawer, resizable panels, combobox, sortable, hover-card, context-menu, tabs, dialog. A live `/components` catalog renders each one with copy-paste code so you never wire a primitive from scratch.
A `/settings/theme` page with 12 WCAG-AA colour presets, light, dark and system modes, soft, default and bold contrast, a font-size slider, layout and stretch controls, RTL and LTR. Settings persist to localStorage through CSS variables, so the preview is instant and nothing rebuilds.
Supabase Auth by default: email and password, OAuth, OTP, recovery. Flip `AUTH_PROVIDER=nextauth` and `DB_PROVIDER=neon` for an Auth.js v5 and Neon Postgres stack with the same `requireUser` and `requireAdmin` API surface, the same admin panel, and no code changes. UX shells ship for social-only, multi-step register, 2FA, magic-link and SSO.
Free, Pro and Business tiers with webhook-verified upgrades, a customer portal, dunning, an idempotent `StripeEvent` table, and a `profiles_update_self_safe_columns` RLS policy that blocks user-side billing tampering. Multi-currency across USD, EUR, GBP and VND, with the visitor locale picking the price.
A dashboard with four KPI cards, a signups timeseries and a plan-mix donut. Users with list, detail and five lifecycle actions. Subscribers with CSV export. Messages with mark-all-read and reply through Resend. A filterable, paginated audit log. Site settings as runtime feature flags. Posts CRUD, an email gallery with test sends, a feature-flag editor and a docs viewer.
Posts CRUD with `tsvector` full-text search through `websearch_to_tsquery`, `ts_headline` snippets that wrap matches in `<mark>`, drag-and-drop cover uploads to Supabase Storage behind folder-prefix RLS, public `/blog` and `/blog/[slug]` routes, and JSON-LD Article plus breadcrumb.
`Organization` and `Membership` Prisma models with RLS through `is_org_member()` and `is_org_admin()` SECURITY DEFINER helpers. `/app/organizations` lets users list and create orgs, where the creator becomes owner inside an atomic transaction. Owner-only delete, admin-only update and member-only read are all enforced server-side.
The `ApiKey` table stores a prefix and sha256 of the plaintext, and the plaintext is shown once at creation. `requireUser()` accepts `sk_live_` and `sk_test_` bearer tokens. `/api/v1/me` is the worked example, and `/app/settings#api-keys` handles create and revoke. RLS is owner-scoped.
The `/api/ai/chat` Server-Sent Events endpoint proxies to OpenAI when `OPENAI_API_KEY` is set, and otherwise streams a deterministic stub so the demo works without a key. A floating widget sits bottom-right, rate-limited to 30 messages per IP per minute.
One `track(event)` call fans out to GA4, Plausible and PostHog. UTM and affiliate ref capture with a 60-day cookie, sanitised and forwarded into Stripe metadata. Crisp live chat, a social-proof toaster, and a lead-magnet modal with cookie-gated dismiss. Each one sits behind a `FEATURES.*` flag.
A GDPR cookie-consent banner gates analytics and live chat until the visitor accepts. Sentry loads from CDN. The cron pattern (`/api/cron/trial-expiry` behind `requireCronSecret`) is scheduled through `vercel.json`. `bun run verify:rls` asserts every table's policies match expectations, and drift fails CI.
Three things. **10 locales pre-wired** with RTL, where most SaaS templates ship one or two. **Two parallel stacks**: Supabase by default, NextAuth with Neon optionally, switched by two env vars and no code changes, where most templates lock you into one. And **production RLS, not just auth**: every table has explicit policies plus a `verify:rls` script that asserts the live state matches expectations. Most templates ship with RLS off and let you fix it later.
Yes, that is the design. Buyer-optional subsystems sit behind `FEATURES.*` flags in `src/template.config.ts`: newsletter, themeStudio, blog, demoApps, aiChat, liveChat, analyticsFanOut, affiliateRef, socialProof, leadMagnet. Flip a flag to false and the route 404s while the component tree-shakes out. The buyer docs carry per-deletion guides for auth, billing and admin.
No limit. The 10 locales ship as working examples, and the i18n layer treats every locale file the same. Drop a new file such as `de.ts` or `pt.ts` into `src/locales/`, register it in one line of `template.config.ts`, and i18next, hreflang and the sitemap all pick it up. The Theme Studio handles RTL out of the box, with Arabic as the worked example.
Set `DB_PROVIDER=neon` and `AUTH_PROVIDER=nextauth`. The template ships a parallel migration track in `prisma/migrations-neon/` that is greenfield-friendly, with no `auth.users(id)` foreign key and no RLS. Auth.js v5 with `@auth/prisma-adapter`, bcrypt, and Google, GitHub and Credentials providers wires up automatically. The same `requireUser` and `requireAdmin` guards work in both modes.
The codebase talks to Stripe directly. A Vietnamese founder will need a Stripe-supported entity such as Stripe Atlas or a US LLC, or a Merchant of Record like Polar.sh or Paddle. The wiring is processor-agnostic where it matters, and the customer portal plus webhook layer is the heavy lift this template saves you.
Yes. The single-developer commercial licence covers unlimited apps for yourself or for clients you bill directly. Redistributing the source itself, by selling it, posting it on a marketplace or uploading it to a public repo, is not allowed.
Six months of free updates are included, with monthly minor versions covering Next.js and React bumps, bug fixes and the occasional feature. After that a paid upgrade adds another twelve months.
Fourteen days, no questions asked. If `bun install && bun dev` does not boot on a fresh machine, email me the error and I will refund within one business day.
Skip the setup. Ship tonight.
Code you own, forever. No runtime lock-in, no subscription.