Product · SvelteKit SaaS boilerplate
A SvelteKit SaaS boilerplate — and an honest account of what you would still have to build yourself
Most of the top ten results for this search are free, and two of them are good. So this page does not try to out-market them. It does the thing a roundup will not: it says what each layer of a B2B SaaS actually costs when it is missing, and lets you decide whether $79 buys your week back.
The short answer
What ships in all three kits: multi-tenant orgs and membership, server-side roles (owner / admin / member), single-use invite links, a seat-billing seam with one enforcement point, an append-only audit log, failed-login rate limiting, and 475 / 509 / 454 tests.
What does not ship: the adapter that talks to your payment provider. The seam, the states, the error codes and the tests are done; the one function that calls Stripe or Paddle is yours. Marketing site, blog engine and component library are also not included — we build the part that is hard to get right, not the part that is easy.
The trade, stated once: if you have a free weekend and want to learn the architecture by building it, take one of the free options linked below — it is the right call for some people. If you would rather spend that weekend on the part only your product knows, this is $79, one time, no subscription, 30-day refund.
The six layers before a SaaS can charge anyone
This is the part of the decision that is not a feature list. Read thewhat it costs when it is missing column — that is the column that decides whether a starter saved you a week or handed you a month.
Tenant isolation
Ships: Every query is scoped by org. The scoping is in the data-access layer, not left to each route remembering to add a where clause.
If it is missing: The failure is a single forgotten filter, and it is silent — no error, one customer sees another customer's rows. Ask any seller what their isolation test asserts, and whether it is an integration test or a comment.
Here: Shared schema, org_id on every tenant table, plus a service layer all three kits share. The Postgres kit adds opt-in row-level security as defence in depth.
Roles and permissions
Ships: owner > admin > member, resolved on the server. The client never decides.
If it is missing: A check in a Svelte component is not a check. If the permission is enforced in the UI, a curl request skips it, and the first person to notice is someone testing your product for fun.
Here: A rank on the membership row and a single server-side gate. Removing a member is a distinct permission from inviting one, because it destroys data.
Auth and sessions
Ships: Password hashing, session storage, expiry, and revocation.
If it is missing: A session you cannot revoke is a permanent credential. JWTs without a server-side deny list mean a deleted user stays logged in until the token expires.
Here: Sessions are stored hashed server-side, so revocation is a delete. The Supabase kit uses Supabase Auth instead and documents the difference.
Billing and seats
Ships: A provider-neutral adapter, one enforcement point, subscription states that block new seats.
If it is missing: Enforcing a seat limit in two places is enforcing it in one place eventually. And a payment-provider adapter is genuinely yours to write — anyone who tells you otherwise is selling you a mock.
Here: The seam ships and the mock adapter ships; the provider adapter is the one thing you write. It is stated on this page, at the top, and on the billing page, rather than in a footnote.
Audit log
Ships: Append-only by construction — there is no update or delete path in the code.
If it is missing: An audit log that the application can also edit is a log of what the application chose to record. Enterprise buyers ask about this, and a mutable table is the answer that loses the deal.
Here: Append-only by construction. Every membership, role and invite change writes a row.
Rate limiting on login
Ships: Sliding-window throttling on failed logins.
If it is missing: Throttling per IP alone is defeated by a botnet, and throttling per account alone is a denial-of-service against one user. It wants both.
Here: All three kits ship it. This was added to the Supabase kit after review and is called out here because a kit that quietly lacked it is exactly why you read this table.
What is actually on the results page
Every description below was read off the linked page on 14 October 2026, not from a directory listing and not from memory. If a vendor changes their positioning, this table is wrong — check the link before you decide. We are not going to describe a competitor's product worse than it is and call that analysis.
okupter/kitforstartups
Open source"The Open Source SvelteKit SaaS starter kit" — full-stack SvelteKit and TypeScript, per the repository description.
Price: $0 — free and open source.
For you: Held position 1 on the query this page targets. Free, and a genuine option if a TypeScript monorepo is what you want.
dsotr/sveltekit-boilerplate
Open source"user auth, user dashboard, marketing site, blog engine, billing/subscriptions, pricing page, and more", per the repository description.
Price: $0 — free and open source.
For you: Held position 2. Free. If you want a marketing site as well as an app, this has more surface than we do.
FastSvelte
Paid · one-timeA SvelteKit single-page app on Svelte 5 over a FastAPI (Python) backend. Publishes auth, Stripe billing, multi-tenancy, AI usage billing, a generated TypeScript client, versioned migrations, admin and user dashboards, and deployment guides for five platforms. "A one-time purchase with full source code. No platform lock-in, no subscription."
Price: Solo $159 (1 year of updates) · Developer $199 (lifetime updates, a 1:1 onboarding session, 30 days of email support — the tier they mark "most popular") · Team $399 (lifetime updates, up to 5 developers). One-time, "no recurring fees". Their pricing block says "Last updated: October 2026".
For you: The closest thing to a direct competitor, and the closest we have found in any round — and it costs roughly twice what we do at its entry tier, so if you have decided to buy rather than to build, it is not the cheaper option. It is better than us if your data work is Python. It is worse for you if you want one language across the stack: you would be running Python and TypeScript to keep one app together. Our three kits are TypeScript end to end. Note also what their Developer tier includes that ours does not — a 1:1 onboarding session and 30 days of email support. If that matters more to you than the stack, buy theirs.
microservices.sh
Free tier + subscriptionPositioned as "Cloudflare-native SaaS modules you own live on npm" — 24 composable modules covering auth, Stripe, multi-tenant isolation, webhooks, audit and an admin dashboard. Priced Free $0, Solo $19/mo, Agency $149+/mo. MIT. Installed with `pnpm create microservices-app`.
Price: Free $0 · Solo $19 per month · Agency $149+ per month.
For you: Explicitly argues against boilerplates ("Boilerplates hand you one monolith repo to fork and maintain forever"). Its free tier does the same job we sell. Worth reading before you pay anyone, including us.
Svelteflare
Open source"An open-source, production-ready SaaS boilerplate with a SvelteKit SPA, typed Hono API, Better Auth, Stripe subscriptions, and a themed component library, deployed on Cloudflare Workers with Alchemy."
Price: $0 — open source.
For you: Held position 8. Free. Cloudflare-first, like our SQLite/D1 kit, with a component library we do not ship.
Four of the ten results for this query are directories that list everyone. If you want the directory version of this comparison, those are the ones to read next — they are also how we found the list above.
Which kit — the only decision you cannot defer
The service layer, the roles, the invite flow, the audit log and the billing seam are the same in all three. They differ on one axis, and it is the axis that decides the schema.
You run Postgres somewhere already, or want to be able to.
SvelteKit + Postgres Starter
Vendor-neutral — Neon, Supabase, RDS, anything that speaks the protocol. The strongest seat guarantee of the three: the seat check and the invite claim run in one transaction under a per-org row lock.
Opt-in row-level security, connection pooling, and a docker-compose for local Postgres.
$79 · 454 tests
You want managed auth, RLS and a database you do not run.
SvelteKit + Supabase Starter
The same service layer re-expressed against Supabase, with tenant isolation enforced by RLS policies as well as app-level scoping. No database to provision.
The largest test suite of the three.
$99 · 509 tests
You want no database to run at all, and deploy to the edge.
Multi-tenant SvelteKit Starter
SQLite as a single file — and the same schema runs on Cloudflare D1. Smallest surface, fastest to first commit.
The default entry point if you have never shipped a multi-tenant app before.
$79 · 475 tests
Try it before you buy
Each kit runs as a public deployment you can sign into. They are seeded with an organisation, two users on different roles, and an audit trail, and they are reset daily — so what you see is the real thing, not a screenshot of a database you cannot reach.
| Kit | Database | Tests | Live demo |
|---|---|---|---|
| SvelteKit + Postgres Starter | Any Postgres — provider-neutral | 454 | Open demo → |
| SvelteKit + Supabase Starter | Supabase — managed auth and RLS | 509 | Open demo → |
| Multi-tenant SvelteKit Starter | SQLite — one file, also runs on Cloudflare D1 | 475 | Open demo → |
One-time price, one licence, unlimited projects, commercial use permitted, lifetime updates, 30-day refund. A Team Licence is $249 for 3+ seats. Prefer one place to decide? All three compared · pricing · licence.
Risks of buying this
A buyer who finds these after paying asks for a refund. A buyer who finds them first is a customer.
You still write the payment adapter
The seam, the seat gate, the subscription states and the error codes are done and tested. The function that calls your payment provider is not, and cannot be — we do not know which one you chose. Each kit documents the four things it has to do.
No marketing site, no blog, no UI kit
We build the part that is hard to get right. If your product needs a marketing site, a docs engine and a component library, this is not the product — several of the free options above ship more of that surface.
It is one opinionated architecture
Shared schema with org_id, rather than schema-per-tenant or database-per-tenant. That is the right default for almost every B2B SaaS and the wrong choice for a few. Read the multi-tenant design guide before you buy, not after.
We are a small pseudonymous operation
No customer count, because there is not one worth printing yet, and no testimonials, because we will not write them. What you get instead is a licence with lifetime updates and 12 months of standard support, and code you can read before you pay.
FAQ
Why pay $79 when the top two results are free?
They are genuinely good and you should look at them first — they are linked above. The difference is not the feature list; it is that our kits have a service layer with a single enforcement point per concern, and a test suite that covers the unhappy paths, rather than a working happy path. Whether that is worth $79 depends entirely on how much of your time the alternative costs. If you have a free weekend, take the free one.
Is there a subscription?
No. A one-time licence per kit, unlimited projects, commercial use permitted, lifetime updates and a 30-day refund. A Team Licence is 249 for 3+ seats.
Can I see it running before I pay?
Yes — there is a public live demo of each kit, linked in the table below, seeded with an organisation, two users and an audit trail. They are reset daily. That is a real deployment, not a screenshot.
Do I get the payment provider integration?
The billing architecture ships: a provider-neutral adapter interface, one seat-enforcement gate, subscription states and the tests. The adapter that talks to your payment provider is the one thing you write, and each kit documents what it has to do. We would rather tell you that here than have you find it on day two.
Why three kits instead of one?
Because the database is the only decision that cannot be deferred, and the three choices lead to genuinely different schemas. A starter that hedged on the database would have to be wrong about it.
Read the implementation before you buy
Every claim above is backed by a page you can read without paying. If a statement on this page is not checkable, that is a defect in this page.
The layers above, in detail
- Multi-tenant database design — shared schema vs the alternatives
- RBAC role hierarchy — where the gate actually sits
- Append-only audit log — why it has no update path
- The billing adapter pattern — the seam in full
- Single-use invite links — where a seat is consumed
- Failed-login rate limiting
Still deciding?
- What to check before you buy any starter — works against any vendor, including us
- What free SvelteKit starters leave out — the short version of this page
- SQLite vs Postgres for a multi-tenant SaaS
- Postgres vs Supabase for this decision
- The billing page — what ships and what you write
Get in touch
Questions about the product, team licenses, or anything else? We'll aim to respond within 48 hours.
Not buying yet? Get told when something new lands.
Every guide, comparison and changelog entry published on this site is written about a real implementation decision — multi-tenancy, seat billing, audit logs, RLS, deploys. Leave an address and you get a message when a new one is published. Nothing else, and no schedule to keep up with.