Build your SaaS product, not the repetitive infrastructure.
A security-conscious, production-oriented Next.js 16, Firebase, and Stripe foundation. Authentication, subscription billing, atomic quotas, and account lifecycle are already built and tested — so you can launch your actual product on day one.
This live site runs directly on the starter kit source code. Try the interactive demo or get the complete repo.
Technologies used in the starter kit
Modern, Production-Oriented Stack — No Proprietary Runtime Lock-in
Next.js 16
App Router
React 19
UI Library
TypeScript
Strict Mode
Firebase Auth
Google + Email OTP
Cloud Firestore
Tested Rules
Stripe Billing
Webhooks & Portal
Tailwind CSS v4
Modern Styling
Resend
Transactional Email
Gemini / Claude / OpenAI
Optional AI Module
Stop rebuilding the plumbing. Start with the foundation already solved.
Every subscription product needs auth, billing, usage limits, deletion flows, and security. Doing them properly takes weeks and is prone to expensive edge-case bugs. Synexa ships with this entire layer already engineered and tested.
Passwordless Authentication
Google OAuth + 6-digit email OTP via Resend. No passwords to hash, store, or leak.
- 14-day server-side httpOnly session cookies
- Edge middleware route protection
- Immediate revocation checking on mutations
- Unified single account per verified email
Webhook-Authoritative Billing
Stripe subscriptions with webhooks as the single source of truth — never client redirects.
- Idempotent event handling & per-subscription watermarks
- Checkout session locks prevent concurrent double-charging
- Self-serve Customer Portal for card and subscription updates
- Self-healing reconciliation cron repairs entitlement drift
Atomic Usage Quotas
Race-condition-proof metering wired directly into Firestore transactions.
- Atomic check-and-reserve before running costly work
- Automatic slot refund if downstream execution fails
- Configurable tier limits in config/quota.config.ts
- Prevents API overages, token bleeding, and double-spending
Durable Account Lifecycle
Clean account deletion and recovery that will never strand a paying customer.
- Stripe subscriptions cancelled before Auth is disabled
- Resumable deletion jobs with durable tombstones
- Account recovery flow if payment provider outages occur
- Email owner locks and user data purged cleanly
Protected Admin Dashboard
Administrative tools protected against unauthorized client SDK and role tampering.
- Audited role checks (admin/user) enforced on server
- Manual subscription synchronization tool
- User status inspection and safe deactivation flow
- System stats and health monitoring
Hardened Security Architecture
Fail-closed security controls shipped preconfigured throughout the stack.
- 300+ lines of tested Firestore security rules (server-only entitlements)
- Tuned Content-Security-Policy & HSTS response headers
- Sliding-window & Firestore-backed rate limiting
- CSRF guards and automatic PII redaction in server logs
Engineered for production resilience
Every capability is built into the source code, backed by strict types, and covered by automated test suites.
Passwordless Authentication
Google OAuth + 6-digit email OTP via Resend. 14-day server httpOnly cookies with revocation checking.
Stripe Billing & Webhooks
Checkout, self-serve portal, idempotent webhook processing, and watermark ordering.
Atomic Usage Quotas
Firestore transaction check-and-reserve metering with automatic refund on downstream errors.
Durable Account Lifecycle
Multi-step deletion that cancels Stripe before disabling Auth, with recovery on provider failure.
Protected Admin Panel
Server-verified role checks (admin/user) with manual subscription sync and user inspection.
Provider-Agnostic AI
Gemini, Claude, or OpenAI behind a clean interface with output token limits and request timeouts.
Security & Privacy Foundations
Synexa values your privacy. We process your data securely, only store what is strictly necessary, and never sell your information to third parties.
Data Handling
- Process the data transiently for the required action
- Avoid storing sensitive user data unnecessarily
- Store only minimal metadata or saved results you explicitly keep
AI Policy
Synexa does not use your private data to train our own models. Any third-party APIs used for processing follow strict data privacy agreements.
Clean boundaries with strict server-side authority
The client never writes entitlements or touches raw provider secrets. Every mutation is guarded, validated with Zod, rate-limited, and audited.
Browser / App Shell
React 19 themed shell, responsive header, user menu, and passwordless login forms (Google popup or 6-digit OTP).
Edge Gate & API Layer
Edge middleware verifies the httpOnly cookie. Server API routes enforce Zod schemas, rate limits, CSRF checks, and revocation state.
Firebase Admin & Firestore
Firestore transactions handle atomic quota reservations. 300+ lines of tested Firestore rules keep roles and billing tiers strictly server-only.
Stripe, Resend, AI
Stripe webhooks synchronize entitlements via watermarks; Resend sends OTP codes; optional AI runs within strict token caps and timeouts.
pricingTier.The expensive failure modes most starters skip
Wiring happy-path Stripe Checkout is easy. What is deceptively hard is everything that goes wrong in production: racing checkouts, deletion failures, duplicate webhooks, and out-of-order events.
The risk: User can accidentally pay both URLs, causing double-charges and broken subscription state.
The second request expires the first session at Stripe before creating a replacement. If expiry fails, no replacement is created.
The risk: A deleted account continues to be billed by Stripe indefinitely.
Deletion expires all open Checkout Sessions before touching Auth; the webhook cancels any subscription that slips through; the reconciliation cron acts as backstop.
The risk: Customer account is locked out in Firebase Auth while Stripe continues charging monthly.
Auth is not disabled and no tombstone is written until billing cancellation succeeds. The user gets a recovery screen, not a permanent lockout.
The risk: A banned or suspended customer is blocked from login but keeps getting billed every cycle.
Active subscriptions are cancelled at Stripe before user suspension takes effect. If Stripe cancellation fails, deactivation aborts retryably.
The risk: Stale events overwrite newer subscription state, downgrading active paying users.
Webhook events are claimed transactionally and ordered against a per-subscription watermark; outdated events are discarded safely.
The risk: Customer is charged money but assigned to no tier or silently dropped to Free.
A high-severity operational alert is raised immediately, retaining the event in failed_webhook_events for manual audit rather than failing silently.
Complete, unminified source code. Yours to own forever.
No proprietary platforms or black-box dependencies. You receive the complete repository with zero external runtime locks.
Complete Application Source Code
Next.js 16, React 19, and TypeScript with strict type-safety, clean modular boundaries, and single-source-of-truth configuration files.
800+ Automated Tests
Unit and integration tests with Vitest, Firestore and Storage emulator security rules tests, and Playwright end-to-end user journeys.
Firestore & Storage Security Rules
Production-oriented, unit-tested rule definitions that enforce server-only billing entitlements and prevent unauthorized data tampering.
Stripe Webhook & Reconciliation System
Signature-verified webhook handlers, idempotency locks, watermark ordering, and a scheduled reconciliation cron endpoint.
In-Depth Documentation Guides
Written guides covering quickstart setup, architecture overview, production verification matrix, and deployment checklists.
CI / CD & Security Automation
GitHub Actions workflows for automated linting, typechecking, Vitest execution, and CycloneDX Software Bill of Materials (SBOM).
Is this starter kit right for your project?
We want you to succeed. Here is who will get immediate value from Synexa, and who should look elsewhere.
- Solo founders and developers launching subscription products that take real money.
- Engineers who want billing, auth, and deletion edge cases solved before shipping to production.
- Builders creating AI SaaS tools who need atomic quotas, output token caps, and timeout guards.
- Teams looking for clean, strictly-typed Next.js 16 + Firebase architecture covered by 800+ tests.
- Unmonetized hobby or side projects that do not intend to charge for access.
- Teams looking for a finished, domain-specific vertical SaaS product rather than a source foundation.
- Projects requiring legacy email/password credentials or non-Firebase database backends.
- Developers looking for heavy monolithic platforms with vendor lock-in.
What's wired up already.
Authentication, billing, quotas, and the dashboard ship working. Enable the optional AI module in config/features.config.ts to make this section interactive.
Authentication
Google OAuth and email one-time codes, with secure httpOnly server-side sessions.
Billing
Stripe subscriptions with webhook handling and a self-serve customer portal.
Usage quotas
Atomic, race-free metering with configurable tiers — wired into Firestore.
Dashboard
A responsive, themed app shell with header navigation and a profile menu, ready to drop your features into.
Everything above ships in the box — configure it and start building.
Interactive Billing Demo
This section demonstrates the built-in Stripe subscription and quota billing system. In your own SaaS, customize these plans and limits in config/pricing.config.ts.
Free
Demo TierPerfect for getting started
Free forever
- 5 actions per month
- Core features
- Email support
- Community access
Pro
Demo TierFor teams that need more
$9/month
or $79/year ($6.58/mo) · save 27%
- 50 actions per month
- Everything in Free
- Priority support
The tiers above are for testing the demo application's Stripe integration. The Synexa SaaS Starter Kit itself is a complete source code package with a one-time license.
Why Synexa over starting from scratch
Synexa delivers the production-oriented foundations most teams rebuild from scratch — tested against out-of-order webhooks, concurrent checkouts, and failed deletions — so day one goes to your actual product.
Frequently Asked Questions
Straightforward answers about the codebase, technical architecture, and validation requirements.
What is the Synexa SaaS Starter Kit?
Synexa is a security-conscious, production-oriented Next.js 16, Firebase, and Stripe foundation. It handles the repetitive 80% of SaaS infrastructure — passwordless auth, subscription billing, atomic usage quotas, durable account deletion, and admin controls — so you can build and ship your actual product on day one.
What technologies are included in the stack?
The starter kit is built with Next.js 16 (App Router), React 19, TypeScript, Firebase Auth & Firestore, Stripe Billing, Tailwind CSS v4, Resend for transactional email, and an optional provider-agnostic AI module supporting Gemini, Claude, or OpenAI.
How does authentication work?
Authentication is passwordless by design. Users sign in via verified Google OAuth or a 6-digit email OTP delivered via Resend. The server issues 14-day httpOnly session cookies that are checked by edge middleware and verified against Firebase Auth with immediate revocation checking on mutations.
How does Stripe billing synchronization work?
Stripe webhooks are the authoritative source of truth for entitlements, not client redirects. Events are claimed transactionally and ordered against a per-subscription watermark to handle duplicate or out-of-order webhooks safely. A self-healing reconciliation cron automatically repairs any drift.
Why does the site show Free and $9/month Pro pricing?
The Free and $9/mo tiers shown on the site are an interactive billing demonstration showcasing the kit's built-in Stripe Checkout, portal, and quota metering. The starter kit itself is full source code available as a one-time purchase. When building your own product, customize the tiers and limits in config/pricing.config.ts and config/quota.config.ts.
What does production-oriented mean vs what requires my own validation?
All architecture, security rules, and failure handlers are implemented and verified by 800+ automated tests against mocks and the Firebase emulator. However, live integration guarantees require your own production Firebase project, Stripe keys, and Resend domain. The repository includes an end-to-end verification guide (docs/PRODUCTION_VERIFICATION.md) for running real-service checks in staging.
Can I customize or disable the AI integration?
Yes. The AI module is provider-agnostic and completely optional (disabled by default). You can toggle it on with a single flag in config/features.config.ts and choose Gemini, Claude, or OpenAI. It enforces strict token caps, timeouts, and quota reservations so model spend cannot run away.
What tests and documentation are included in the repository?
The repository includes 800+ automated Vitest tests (unit and integration), real Firestore and Storage emulator security rules tests, Playwright end-to-end user journeys, and in-depth documentation covering authentication, billing, quotas, deployment, data retention, and security hardening. Free demo accounts include 5 actions/mo and Pro includes 50 actions/mo for testing quota enforcement.
Like what you see? Ship it today.
Get the complete Synexa starter kit — authentication, billing, and a polished dashboard, wired up and ready to build on. One-time purchase, yours forever.