Customer accounts
Registration, email verification, login, logout, and password reset, all non-enumerating: responses never reveal whether an address exists.
AVAILABLE NOW
NextJS Frontend + C# Backend SaaS Kit
Every SaaS begins with the same unglamorous core: accounts, sessions, password resets, a signed billing webhook, an audit trail. Built badly it's a liability; built well it's weeks of work before your first real feature. The NextJS and C# SaaS Kit ships that core already hardened, in a stack you'd choose anyway — Next.js 16 in front, ASP.NET Core on .NET 10 behind, PostgreSQL underneath.
The architecture is the differentiator. The two trees build independently, with no root manifest or monorepo glue. The browser talks only to the Next.js server, which holds the backend origin and application secret server-side. The backend is the account authority: every call proves both that the caller is your frontend (a constant-time secret check) and which user is acting (an opaque session token validated on every request). The frontend cookie is a convenience, never an authority; origin headers are checked, never trusted as authentication.
Out of the box: registration, email verification, login, logout, and reset with non-enumerating responses; argon2id passwords with breach screening; lockout with owner alerts; absolute and idle session expiry; HMAC-SHA256-signed billing entitlements; an admin surface; per-IP rate limiting; security headers; structured JSON logs with a closed audit.* stream; and a non-root container image with a health check. CI runs the full battery on every push.
Placement is one CLI command, and local development is one idempotent bootstrap script: databases, aligned environment files, migrations, and two seeded verified accounts. Your product identity is applied for you, and the extension seams — pages, endpoints, mail and billing providers, migrations — are documented.
About the boundary, plainly: billing is a provider-agnostic seam with a mock implementation, not a payment integration. Multi-factor auth, logged-in credential changes, TLS, backups, and hosting are yours to add. The kit covers the foundation; you own the product.
WHAT YOU GET
What ships in the kit.
Hardened sessions
32 random bytes stored only as SHA-256 hashes, with 12-hour absolute and 30-minute idle expiry; logout and password reset revoke cleanly.
Password security
Argon2id hashing (64 MiB, 3 iterations), a 12-character minimum, a shipped common-password list, and Pwned Passwords breach screening.
Lockout and alerting
Five consecutive failed sign-ins lock the account for 15 minutes and alert the owner.
Trusted-frontend boundary
Every account call proves the caller is your frontend with a constant-time application secret, then identifies the user by opaque session token. CORS and origin headers are never authentication.
Provider-agnostic billing
A billing seam with a mock provider and HMAC-SHA256-signed webhooks; subscription events drive entitlements, and a real provider drops in without touching the core.
Admin surface
An admin-only page renders account state, with capability granted by the backend rather than the page.
Audit trail and logging
A closed audit.* event stream covers sign-ins, resets, and billing, correlated by request ID and keyed to customer UUIDs, never email addresses. Logs are readable locally and JSON in production.
Fail-closed configuration
Missing or weak secrets, an invalid frontend origin, or a remote database without TLS stop startup with a clear error instead of failing open.
Instant placement and bootstrap
The CLI applies your product name, header token, slug, and image owner; one idempotent script then creates local databases, writes aligned environment files, applies migrations, and seeds two verified accounts.
Hardened CI
Format checks, isolation tests against real PostgreSQL, a release build, dependency vulnerability scans, lint, unit tests, a production build, and Playwright end-to-end tests.
Production container
A non-root backend image with a health check, published only by a manual workflow that never ships on push.
BEYOND THE SOURCE
Own the code. Understand the path.
Every kit is built to be read and changed by hand. The documentation, examples, and agent context travel with the source.
MCP server, included. Generate a Personal Access Token in your account (one active token at a time) and add it to your agent's MCP configuration. Your coding agent can then discover the kits you own, pull their context and runbooks, and scaffold supported project and workflow files. Your code stays on your machine.
- The full source of the kit you license
- Full source code
- Documentation
- Setup and extension guidance
- Practical examples
- Coding-agent guidance
SIMPLE OWNERSHIP
One kit. Two licenses.
Start with the kit that fits. Pay once for your license, with 12 months of updates and support included. Renew maintenance when you need it.
Solo
1 developer
$249 one-time
12 months of maintenance included from purchase
Optional renewal $99 / year
MCP access for your coding agent
Get SoloTeam
Up to 5 developers
$599 one-time
12 months of maintenance included from purchase
Optional renewal $249 / year
MCP access for your coding agent
Get TeamThis license covers NextJS Frontend + C# Backend SaaS Kit. Licensing another kit is a separate purchase under the terms shown at checkout.
Amounts are in USD.
WHAT THE LICENSE AND MAINTENANCE MEAN
Your license stays with you
The license is a permanent right to use and modify the entitled code. Maintenance is access to new releases and product support, not the right to keep running what you already have.
Maintenance follows your purchase
The included 12 months run from your purchase anniversary, not from the calendar year.
What expiry does not take away
When maintenance ends, existing applications keep running. Entitled versions remain yours to download and use. Expiry does not revoke that use.
What new releases require
After expiry, every newly released update — including critical security fixes — needs active maintenance. Notifications about known relevant security issues continue whether or not maintenance is active.
How renewal works
Renew early and the current expiry moves forward by 12 months. Renew after a lapse and a new 12 months starts on the renewal date, without a charge for the gap.
Each kit is licensed on its own
Your purchase covers the kit you chose. Licensing another kit is a separate purchase under the terms shown at checkout; it does not unlock every implementation in the collection.
MAKE IT YOURS
Start with a foundation. Keep your freedom.
Inspect the kit and its documentation before you decide.