A maintained SaaS starter for the shared work every new application needs before its product work can begin.
A starter, not a fully fledged platform
Supacharger replaces the repetitive foundation work around authentication, account settings, profiles, organisations, billing, localisation, database policy and deployment. It gives a new application a tested starting point while leaving its product model, presentation, workflows and commercial decisions in developer-owned code.
Core remains updateable after installation. Later Core releases can be previewed and pulled through the CLI so managed foundations can follow material changes in Next.js, Vercel and Supabase without asking every application to rediscover the same migration. Updates are reviewable changes, not an invisible hosted platform or an automatic production deployment.
Current Core baseline
Next.js 16.3.2
React 19.2.8
Supabase SSR 0.12.4
supabase-js 2.112.3
Stripe 22.5.0
Tailwind CSS 4.3.3
next-intl 4.13.6
Zod 4.4.3
Core features
The table describes what is present in the canonical Core today and where an application is expected to take ownership.
System
Included in Core
Developer-owned boundary
Runtime and routingA current App Router foundation with explicit server access boundaries.Read the ownership guide
Next.js 16.3.2 App Router with React 19.2.8, Server Components, Server Actions and Route Handlers.
The current Next.js Proxy convention through src/proxy.ts; Core does not use the former middleware.ts entry point.
Request-scoped Supabase SSR clients, Cache Components support and Turbopack SVG handling through SVGR.
Verified-only, onboarded-only and full-application route groups with separate server-side access helpers.
Safe relative redirects, API 401 responses and exclusions for framework assets, metadata and platform association files.
Product routes and application layouts live under the project route group.
The root layout, fonts, providers and product shell remain editable after installation.
Handlers and RLS still authorise the underlying action or resource.
Authentication and accessManaged Supabase Auth journeys for browser, server and mobile-capable applications.Explore authentication
Email and password sign-in and sign-up with authoritative server-side Zod validation.
Exclusive passwordless email link or OTP modes, configurable six-to-ten digit codes and separate sign-up verification policy.
OAuth/PKCE callback handling and a complete enablement map for supported Supabase social providers.
Password recovery, reauthentication before password changes, safe return paths and sanitisation of sensitive Auth query fields.
Supabase Auth TOTP enrolment, challenge, removal and optional AAL2 enforcement for enrolled accounts.
Optional iOS Universal Link and Android App Link association routes for link-based verification journeys.
Hosted provider settings, redirect allow-lists, OTP length and email templates are configured per Supabase environment.
Brand imagery and presentation extend through preserved adapters and semantic style hooks.
Proxy improves navigation but never replaces server checks, grants or RLS.
Roles and custom claimsA managed trust boundary for global roles and active organisation context.Review roles and claims
Private app.user_roles storage and a managed custom access-token Auth Hook that emits the canonical user_role claim.
Active organisation ID, handle, role and context-version claims derived from server-owned session context.
A security-invoker custom_access_token_claims_extension seam for compact product-owned claims.
Reserved-claim rejection prevents extensions from replacing Supabase, global-role or organisation trust fields.
Session-refresh requirements are explicit because role and context changes do not rewrite an already-issued JWT.
Applications assign roles through a reviewed trusted administrative boundary.
Product claims are added by a new forward migration, never by editing applied Core history.
Current database state remains authoritative where immediate revocation matters.
Profiles, accounts and mediaOne profile foundation with protected account-management and media paths.See profiles and storage
A single app.profiles record created and synchronised from Supabase Auth, including name, username, email, language and media paths.
Configurable disabled, optional or required username policy and post-sign-in profile-completion onboarding.
Private avatar and header-image storage with object paths and short-lived signed URLs rather than public bucket URLs.
A process-image-upload Edge Function with named, server-controlled targets for resizing and encoding uploads.
Reusable image helper functions for target validation, MIME checks, resize modes, metadata stripping, Storage writes and signed or public URL responses.
Product-specific profile fields use preserved field and summary extension adapters.
Applications choose which account sections and media controls to expose.
Upload destinations and transformation targets are server-owned rather than caller supplied.
OrganisationsAn optional application surface backed by an installed multi-tenant foundation.Explore organisations
Organisation records, owner/admin/member roles and per-session active organisation context.
Create, read, update, switch and handle-availability operations through one authenticated dispatcher.
Member listing, addition, role changes and removal with current-membership checks.
Email invitations with acceptance and revocation, plus closed or request-based access policy.
Access-request listing, approval and rejection, organisation profile fields and optional protected media.
Stale active contexts are invalidated after membership or role changes and can require a session refresh.
ORGANISATIONS.ENABLED controls exposure, while the reusable schema remains installed.
Product-specific organisation fields and presentation use developer-owned extension adapters.
Product resources still need their own organisation-scoped RLS and authorisation rules.
Billing and entitlementsA Stripe subscription foundation for personal and organisation billing subjects.Review subscription billing
Stripe Checkout and Customer Portal flows with automatic-tax, address and promotion-code policy.
Personal or organisation billing accounts with explicit billing membership roles.
Multiple subscriptions and subscription items, quantities, flexible billing mode, trials and cancellation state.
Products, prices, customers and durable webhook-event ingestion projected into private application tables.
Entitlement projection by feature lookup key for server-side application access checks.
Event-processing and reconciliation secrets, Stripe fixtures and scheduled reconciliation guidance.
Applications define their Stripe catalogue, prices, entitlements and product access policy.
The current supported Stripe tuple is SDK 22.5.0 with API 2026-07-29.dahlia.
Hosted webhook endpoints and secrets must be configured separately for each environment.
Database and API securityA schema boundary designed for Postgres, PostgREST and privileged server work.Inspect database features
Private application tables in app, browser-callable RPCs in api and trusted service-only operations in api_edge.
Explicit grants, RLS policies, ownership, function search paths and authenticated identity derivation.
Descriptive, unprefixed PostgREST RPC arguments and generated TypeScript database types.
Forward-only Supabase migrations, local reset and lint scripts, pgTAP coverage and schema contract tests.
A managed Bruno request collection and parity check for every canonical client-callable API RPC.
Zod validation at server and Edge Function boundaries, backed by independent database constraints and authorisation.
Product tables, policies and RPCs belong in developer migrations and contract tests.
Browser exposure is deliberate; a table is not made safe merely by being reachable through the Data API.
Linked migration pushes are previewed and require separate approval.
Localisation and document shellInternationalised account copy, preferences and production metadata foundations.Read localisation guidance
next-intl routing support with an English source catalogue and preserved secondary-language catalogues.
Locale preference hand-off through a secure cookie and persistence to the authenticated profile.
Managed English namespaces for reusable authentication, account, billing and organisation interfaces.
Configurable metadata title template, canonical origin, social image, colour scheme and favicon set.
robots.txt, sitemap, indexing policy, Google Analytics and Vercel Web Analytics integration points.
Theme and toast providers behind serialisable developer-owned configuration.
Applications own their supported locales, wording, secondary translations and brand metadata.
Core updates merge only missing or empty canonical English values.
Secondary-language values are never invented or overwritten by the updater.
CLI, updates and deliveryA reviewable way to install and evolve the reusable foundation.Open the CLI reference
supacharger init installs the canonical starter and records the installed Core commit.