Features
The parts every SaaS needs — auth, payments, quotas, and security — built the way you'd build them if you had the time, and wired together so you can focus on what makes your product different.
Core Features
Authentication
Passwordless email OTP and Google sign-in on Firebase Auth. Server-side httpOnly session cookies are revocation-checked on every request, so disabling an account takes effect immediately — not whenever a token happens to expire.
- Email OTP + Google sign-in
- httpOnly session cookies (14-day)
- Revocation-aware verification
- CSRF-guarded, one account per email
Database & Admin
Firestore with strict, tested security rules that keep entitlements and roles server-only — a signed-in user can never grant themselves Pro. Ships with Admin SDK helpers and a full admin dashboard.
- Locked-down Firestore rules
- Admin dashboard (users, stats)
- Composite indexes included
- One-click GDPR data export
Payments
Stripe Checkout and the billing portal, wired end-to-end. The webhook — not the browser redirect — is the single source of truth for entitlements: idempotent, safe against out-of-order and duplicate events, and impossible to double-charge.
- Stripe Checkout + billing portal
- Webhook-authoritative entitlements
- Idempotent, double-charge-safe
- Self-healing reconciliation cron
Usage Quotas
Meter billable work without race conditions. A single atomic Firestore transaction check-and-reserves a slot before the work runs, and refunds it automatically if the work fails — so you never over- or under-charge.
- Atomic check-and-reserve
- Per-tier, per-resource limits
- Auto-refund on failure
- Anonymous + signed-in tracking
Also Included
AI, provider-agnostic
Drop in Gemini, Claude, or OpenAI behind one interface. Every generation is quota-gated with hard token and timeout ceilings, so your model spend can't run away.
Security by default
A tuned Content-Security-Policy and full security-header set, Firestore-backed rate limiting, Zod validation on every input, timing-safe secret checks, and PII-redacting structured logs.
Account deletion & GDPR
Durable, resumable account deletion that cancels Stripe before disabling Auth and leaves a tombstone — a failed step never strands a paying user. Plus data export, cookie consent, and legal templates.
Transactional email
Resend integration for login codes, contact submissions, and operational alerts.
Reliability & ops
A scheduled reconciliation cron repairs entitlement drift and retries failed webhooks, and unhandled server errors fire a throttled ops alert — so you hear about problems before your customers do.
Developer experience
End-to-end TypeScript, 300+ Vitest unit tests, Playwright e2e coverage, feature flags, env-var validation, and thorough docs for every subsystem.
Ready to get started?
Clone the repo, add your Firebase and Stripe keys, and deploy. The foundation is done — your first real feature is the next thing you write.