Product
Ship your B2B SaaS on SvelteKit + Supabase without rebuilding orgs, invites, and billing from scratch.
A starter with multi-tenancy wired end-to-end: organizations, invitations, role-based access, seat-based billing via a merchant of record, and an audit log — all running on Supabase for auth, database, and realtime.
What's inside
Organizations & membership
Create/join/leave orgs, invite links with expiry, transfer ownership.
RBAC via Supabase RLS
Three built-in roles (owner > admin > member) enforced server-side via Row Level Security policies — not hidden UI.
Seat-based billing
Seat limits enforced at join-time via a pluggable BillingAdapter (mock included; plug in Stripe, Lemon Squeezy, or Paddle).
Append-only audit log
Who did what, queryable, export-ready — the thing enterprise pilots ask for in week one.
Supabase Auth
Email+password, magic links, OAuth providers. Managed auth with session handling built in.
PostgreSQL via Supabase
Managed PostgreSQL with connection pooling, backups, and scaling. No SQLite limitations.
Feature summary
- Multi-tenancyFull implementation
- RBAC (owner > admin > member)Server-side + RLS
- Seat billing adapterPluggable seam
- Audit logAppend-only
- Rate limitingSliding window
- AuthSupabase Auth
- DatabasePostgreSQL (managed)
- RealtimeVia Supabase (platform)
- RLS policiesDefense-in-depth
See it in action
Real UI from the live deployed demo — supabase-starter.verdantstack-site.pages.dev/ (seeded org, resets daily).
Built for AI coding agents
The kit ships with the context files AI coding agents (Claude Code, Cursor, GitHub Copilot) actually need to work in a codebase the moment they open it.
- AGENTS.md — architecture decisions, command shortcuts, and "things that will bite you" so an agent starts productive, not fumbling.
- TypeDoc API reference — generated from the code, a machine-readable spec of every export that cannot silently rot.
- A public docs portal + llms.txt — deep-dive guides and a site index an agent can retrieve, not just a human can read.
Not a bolt-on: the full agent context lives in the repo from day one.Read the AGENTS.md.
Which database fits
All three kits ship the same tested multi-tenant core — orgs, invites, RBAC, seat billing, audit log. They differ only in the data layer. So the only real question is: which database do you already run, or plan to run? Pick by situation, not by feature list.
Do I need to scale past a single server / need Postgres features?
Postgres Starter (vendor-neutral)
Am I already invested in Supabase (auth, storage, realtime)?
Supabase Starter
Do I want a free, managed, edge-native database with zero ops?
Multi-tenant SvelteKit Starter (D1)
| Your situation | Pick | Why |
|---|---|---|
| You will outgrow a single-file DB — pooling, replicas, JSONB, RLS, big data | SvelteKit + Postgres Starter | Real Postgres, zero lock-in, Drizzle ORM, opt-in RLS. The vendor-neutral flagship. |
| You want managed Supabase Auth / realtime / storage APIs and RLS out of the box | SvelteKit + Supabase Starter(this one) | The same core layered onto Supabase — auth, database, realtime, RLS handled for you. |
| You want zero external services — everything on the Cloudflare edge, cost-free | Multi-tenant SvelteKit Starter | SQLite/D1 via better-sqlite3 + Drizzle. The zero-ops serverless default. |
Not sure? Read the documentation or the multi-tenant starter evaluation checklist. Every kit is a one-time license with lifetime updates and a 30-day refund.
How it compares
- This is NOT another basic starter. Free templates (CMSaasStarter, kiankit) already give you auth and a dashboard. This kit handles the hard parts: multi-tenancy, RBAC, seat billing, and audit logging.
- Scope: v1 uses Supabase exclusively. If you need self-hosted SQLite, see our other starter.
- Built by the same team behind the Multi-tenant SvelteKit Starter (357 tests, production-ready).
How it compares with free alternatives
If you don't need RBAC, billing, or audit logging, CMSaasStarter is a great choice. If you do, this starter handles that gap — the same hard parts our SQLite starter implements, estimated at 3–5 weeks of focused work to build and test yourself.
Who it's NOT for
- You want self-hosted SQLite or D1 — this is Supabase-native, deliberately.
- You need enterprise SSO/SCIM on day one — this ships app-level tenancy, not identity-provider federation.
- You want a huge component library — this is a foundation, not a UI kit.
Pricing, stated plainly
One license, unlimited projects, commercial use permitted. Lifetime updates included. Stated plainly because pricing pages that hide this are worse than useless.
Building for a client or a team of three or more? TheTeam Licence is$249 — 3+ seats, still unlimited projects. Same updates, same support, no per-project fee.Ask about a team licence — invoiced individually, since checkout is per-kit.
- Actively maintained — v0.3.4, released 2026-10-04, 12 dated releases, 45 logged changes. The full history is public.
- Commercial license — use it in your business
- Live interactive demo — try before you buy
- 390 automated tests covering auth, RBAC, invites, seats, audit
- Full documentation + API reference + AI-agent files
- Lifetime updates included
Source delivered to buyers. The full kit code is delivered privately to you after purchase — it is not posted publicly. Explore the docs, feature list and proof freely; buy when you want the code.
30-day full refund — no hassle, no questions. If it's not for you, get your money back.
Actively maintained — see the latest release.Read License Agreement
FAQ
Why Supabase instead of raw Postgres?
Supabase bundles Auth, RLS, Realtime, Storage, and a dashboard — things you would otherwise wire yourself. If you want managed convenience and are happy operating inside the Supabase ecosystem, this is the faster path. If you prefer provider-neutral control, see our Postgres starter.
Is this different from the free CMSaasStarter?
CMSaasStarter gives you auth and a dashboard — great for prototyping. This kit adds the hard parts free starters skip: multi-tenancy, RBAC, seat billing, and an append-only audit log. Estimated at 3–5 weeks of focused work to build yourself.
How many tests does it ship with?
390 automated tests across 12 Vitest suites, running against an in-memory fake Supabase client — no database, no network. RLS policies are verified separately via supabase start.
What's the update policy?
One license, unlimited projects, commercial use permitted. Lifetime updates included. Stated plainly because pricing pages that hide this are worse than useless.
Is there a team license?
One license covers one developer. For a client or a team of three or more, the Team Licence is $249 — 3+ seats, still unlimited projects, same updates and support, invoiced individually.
Can't I build this myself or with an AI coding agent?
You can — and the kit includes AGENTS.md and TypeDoc so your agent starts productive. But the value is in the 390 tests, the edge cases (invite expiry, atomic claims, seat enforcement, audit tamper-proofing), and the plumbing that's invisible until an enterprise pilot asks for it in week one. You're buying a tested foundation, not a code generator.
Dive deeper
Get in touch
Questions about the product, team licenses, or anything else? We'll aim to respond within 48 hours.