Documentation
Guides, comparisons, and resources for building multi-tenant SaaS applications with SvelteKit.
Products
Browse all products →Multi-tenant SvelteKit Starter
Orgs, invites, roles, seat billing — the unglamorous core of a B2B SaaS, done and tested.
18 guides →
API reference (docs/api on GitHub) →Product Documentation
Multi-tenant Authentication
How to model organizations, memberships, invites, and role enforcement at the application layer.
RBAC & Role Hierarchy
Three roles with strict hierarchy enforced server-side. The capability matrix and enforcement points.
Invite Link Flow
Single-use hashed invite tokens with expiry and atomic claim. Race-condition-safe by construction.
Seat Billing Adapter
Pluggable BillingAdapter interface for merchant-of-record checkout.
Append-Only Audit Log
Audit trail design: append-only by construction, no update or delete path.
Hashed Session Auth
Database-backed sessions with hashed tokens for revocation.
Rate Limiting Login
Sliding-window failed-attempt rate limiter with pre-hash blocking.
Sell Software Without Stripe
Merchant-of-record options for developers in countries where Stripe isn't available.
SaaS Starter Evaluation Checklist
Six-dimension evaluation framework for choosing a SaaS starter.
Multi-Tenant Starter Checklist
Production readiness checklist for multi-tenant SaaS starters.
Drizzle ORM Migrations in SvelteKit
Schema-first database management with Drizzle Kit: migrations, type-safe queries, and SQLite specifics.
Multi-Tenant Database Design
Shared-database tenant isolation patterns: tenant_id columns, membership scoping, and when to outgrow.
SvelteKit Session Management
Server-side sessions with hashed tokens, httpOnly cookies, and database-backed revocation.
SvelteKit Hooks & Middleware
Server-side request handling with hooks.server.ts: auth, sessions, and multi-tenant resolution.
Testing SvelteKit with Vitest
Unit tests, integration tests, and HTTP-level patterns from a 298-test suite.
SQLite for Production SaaS
When and how to use SQLite for multi-tenant applications: WAL mode, isolation, and ceiling awareness.
SvelteKit Environment Variables
Public vs private, static vs dynamic, .env files, Cloudflare Workers secrets, and startup validation.
SvelteKit Error Handling
fail(), error(), redirect(), and the errorToFail mapper: typed error patterns for form actions.
Supabase Starter: Architecture
Thin routes → framework-free services → rbac/billing seams → supabase/client.ts. Service-role vs user-scoped clients and RLS defense-in-depth (service-only: you wire the route layer).
Supabase Starter: RBAC & RLS
Three roles, one capability matrix, and a strict hierarchy enforced server-side at the app layer and again via Supabase Row Level Security.
Supabase Starter: Seat Billing
Pluggable BillingAdapter for merchant-of-record checkout, enforced at invite acceptance with seat-limit error codes.
Supabase Starter: Testing
Twelve Vitest suites (314 tests) against an in-memory fake Supabase client — no database, no network. RLS checks via supabase start.
Supabase Starter: Versioning
Semantic Versioning, Keep a Changelog, and the release process for the Supabase starter.
Postgres Starter: Multi-Tenant DB Design
Shared-database tenancy on Postgres with Drizzle ORM: org_id scoping, uuid PKs, bigint-ms timestamps, and per-request isolation in the service layer.
Postgres Starter: RLS Defense-in-Depth
Opt-in Row-Level Security for the Postgres starter — fail-closed, per-request identity via the app.current_user_id GUC, and per-table policies.
Postgres Starter: Connection Pooling
postgres.js pool sizing, tuning, and when to add PgBouncer/Supavisor for production concurrency.
Postgres Starter: Drizzle Migrations
Schema-first Postgres migrations with drizzle-kit — generate, review, and apply clean migrations.
Postgres Starter: Read Replicas
Write/read splitting with Drizzle — two handles, lag-tolerant reads, and when to use them.
Postgres Starter: Full-Text Search
Native Postgres tsvector + GIN full-text search over the audit log — no external service.
Postgres Starter: JSONB Metadata
Flexible audit-log metadata — the text-JSON default today and the documented jsonb upgrade path with containment queries.
Postgres Starter: Session Management
Hashed, DB-backed, revocable sessions with Postgres — token lifecycle and 30-day expiry.
Guides
How to Use Claude Code with VerdantStack
Build SaaS features faster with Claude Code. AGENTS.md and machine-readable docs make your agent productive from the first prompt.
How to Use Cursor with VerdantStack
Integrate Cursor AI with VerdantStack starters. AGENTS.md and machine-readable docs make Cursor productive from the first edit.
How to Build SaaS Features with AI Coding Agents
A complete guide to AI-assisted SaaS development: principles, workflow, and tool-specific guides.
How to Build Multi-Tenant SaaS
Step-by-step guide to building a production-ready multi-tenant SaaS with SvelteKit.
SvelteKit SaaS Boilerplate
What you actually need in a SaaS boilerplate — and what free starters skip.
Multi-Tenant SvelteKit Template
How to implement organizations, RBAC, seat billing, and audit logging.
Make Your Codebase AI-Agent-Friendly
AGENTS.md, llms.txt, and API references — the context files AI coding agents need to work productively in your code.
License Agreement
End User License Agreement for the starter kit.
Comparisons
SvelteKit vs Next.js for SaaS
Honest comparison of features, pricing, performance, and developer experience.
Multi-Tenant Starter Kit Comparison
What to look for when evaluating multi-tenant starter kits.
VerdantStack vs CMSaasStarter
Feature-by-feature comparison with the 2,362 stars Supabase starter.
SvelteKit + Postgres vs Supabase
Provider-neutral Postgres with Drizzle vs managed Supabase — auth, RLS, pooling, realtime, and lock-in tradeoffs.
SvelteKit + Postgres vs Next.js + Prisma
Building a multi-tenant SaaS: framework ergonomics, Drizzle vs Prisma, and Postgres hosting.
Drizzle ORM vs Prisma for SvelteKit
SQL-first Drizzle vs Prisma's schema DSL for a SvelteKit SaaS — queries, migrations, and type safety.