Kit v1.0.0 · A production SaaS baseline that runs on Cloudflare from the first commit.

Next.js on Cloudflare

Next.js App Router with strict TypeScript, Tailwind CSS and the Aback UI component library, deployed to Cloudflare Workers, backed by Cloudflare D1, and wired to Dodo Payments, Lemon Squeezy or Stripe for subscriptions. Sessions are rotating, revocable and stored server side.

v1.0.0Verified 2026-10-21TypeScript strictCloudflare WorkersD1Aback UI

Who this is for

Developers shipping a SaaS product who want authentication, billing and persistence solved without inheriting a large dependency tree.

Subscription SaaS products with a flat monthly plan
Internal tools that need real accounts and audit friendly storage
Teams that want to deploy on Cloudflare without a separate database vendor

Current releasev1.0.0

Published2026-10-21

Last verified2026-10-21

LicenseAback Stack License (proprietary)

You need3 accounts, 5 prerequisites in total

Providers9 behind one contract each

The coverage, stated plainly

A kit earns trust by naming its edges. This is the complete list of what ships and what does not.

Included

15 items

Next.js App Router with strict TypeScript and the vendored Aback UI component library
Credentials, single use email sign in links and Google, GitHub or Microsoft sign in with rotating, revocable server side sessions
Self service account deletion that erases every record of the account in one transaction
Optional Cloudflare Turnstile bot protection on sign up, password reset and sign in links
Optional product analytics with Plausible, Umami, PostHog or Cloudflare Web Analytics, cookieless by default
A daily Cron Trigger that deletes expired sessions, tokens and rate limit windows
Cloudflare D1 schema, migrations and repository layer with an in memory test double
One payment contract with Dodo Payments, Lemon Squeezy or Stripe: checkout, customer portal, signed webhooks and entitlement guards
One email contract with Resend, Postmark or SendGrid for verification, recovery and account notices
Server side validation, ownership scoped data access and safe error envelopes
Landing, dashboard, billing and settings surfaces with loading, empty, error and success states
Test suite covering the domain services, the route handlers, the storage repositories and the core components
One command, bun run verify, that runs the lint, the type check, the tests and the production build
Setup, database, payments, testing and deployment documentation
Agent contract files (AGENTS.md, DESIGN.md and the guides) so an AI coding agent extends the kit within the same rules the maintainers follow

Not included

8 exclusions

Teams, organisations, invitations and per member roles
An internal admin console for support staff
One time purchases and lifetime licences; the payment contract covers subscriptions
Multi region data residency options
A visual no code builder or a template marketplace
Usage based billing meters, credit entitlements and add ons
Automated upgrades that rewrite a customer repository
A hosted preview environment for every pull request

A planned capability is never described as included. If it is not on the left, the kit does not ship it.

What you need before the first run

Required accounts are needed for a production deployment. The kit still runs locally without most of them.

Bun 1.4 or newerRequired
The repository ships a Bun lockfile and the documented scripts assume Bun.
A Cloudflare accountRequired
Needed for Workers hosting, the D1 database and the custom domain.
A payment provider accountRequired
Dodo Payments, Lemon Squeezy or Stripe. The deployment names its provider with PAYMENTS_PROVIDER. Test mode keys work without verification.
A transactional email providerOptional
Resend, Postmark or SendGrid. Without one, verification and recovery messages are written to the log in local development.
OAuth credentials for the sign in providers you keepOptional
Google, GitHub or Microsoft. Credentials sign in works without any of them.

3 required, 2 optional. Every provider variable is documented in .env.example.

Supported versions

The exact versions this release is verified against.

Next.js16.2
App Router, server components and route handlers
React19.2
UI runtime
TypeScript5.9
Strict type checking
Tailwind CSS4.2
Design tokens and utility styling
Cloudflare WorkersOpenNext adapter
Hosting runtime
Cloudflare D1SQLite, Workers binding
Primary database
Dodo PaymentsREST API, unversioned
Merchant of record: checkout, subscriptions and webhooks
Lemon SqueezyREST API, unversioned
Alternative merchant of record
StripeREST API, unversioned
Alternative card processor
Resend / Postmark / SendGridHTTP APIs
Transactional email behind one contract
Google / GitHub / MicrosoftOAuth 2.0
Sign in providers, offered only when configured
NextAuth4.24
OAuth provider handling only

Part of the Aback ecosystem

The kit is a product of the shared library, not a one-off stack. The next Aback product starts from the same components and tokens.

The component libraryEvery component in the archive, rendered live and grouped by job.One token setHow colour, type and geometry stay identical across Aback products.The library docsInstallation, the registry and the component API references.

Configure your stack

Pick the vendors this deployment will use. The environment block is generated from the same registries the application resolves at runtime, so the names cannot drift from the code.

Payments

Hosted checkout, a customer portal and a signed webhook, behind one contract. A merchant of record and a card processor are both supported.

PAYMENTS_PROVIDER

Dodo PaymentsDefaultA merchant of record. It takes the money, settles the taxes and carries the chargeback risk.Lemon SqueezyLemon Squeezy is a merchant of record that takes the payment, settles the taxes and hosts the checkout, the customer area and the subscription webhooks.StripeA card processor. It takes the payment, and the merchant keeps the tax and the chargeback responsibility.

Verification, password recovery and account notices. The selected provider receives every message; a missing provider fails loudly instead of silently dropping mail.

EMAIL_PROVIDER

ResendDefaultA transactional email API built for developers. One API for every kind of message.PostmarkA transactional email service that delivers the message and reports the identifier of every accepted message.SendGridA transactional email service that delivers the message and reports the identifier of every accepted message.

OAuth providers are offered only when their environment is complete, so the sign in page never shows a button that cannot work.

AUTH_PROVIDERS (comma separated)

GoogleDefaultOpenID Connect. The address is verified by Google, so an account can only be linked with a verified address.GitHubA code hosting platform. A developer signs in with the account they already use everywhere else.MicrosoftA work and school identity. An organisation signs its people in with the Microsoft account it already manages.

Your .env.local block

# Aback Stack provider configuration
# Fill in the values. The names come from the provider registries.

# Payments
PAYMENTS_PROVIDER=dodo
DODO_PAYMENTS_API_KEY=
DODO_PAYMENTS_ENVIRONMENT=
DODO_PAYMENTS_RETURN_URL=
DODO_PAYMENTS_CANCEL_URL=
DODO_PAYMENTS_PORTAL_RETURN_URL=
DODO_PAYMENTS_WEBHOOK_KEY=

# Email
EMAIL_PROVIDER=resend
EMAIL_API_KEY=
EMAIL_FROM=

# Sign in
AUTH_PROVIDERS=google
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

Values are blank on purpose. Never commit a filled environment file.

A provider that is named but not configured fails with an actionable error. It never falls back to another vendor.

Read the payments guide and the authentication guide for the callback URLs and the webhook setup each provider needs.

Access, updates and support

Access: The kit is licensed for you to build your own products. The documentation is free to read. A one-time purchase includes read access to the private GitHub repository, every future update and email support for the kit.
Update policy: Every update is pushed to the private repository and reaches you with git pull. A breaking change ships with a migration note in the changelog, and a version you received stays licensed.
Support policy: Email support covers the kit itself: the setup, the documented checks and the behaviour of the code. It does not cover the operation of the product you build with it.

How you get the code

The source is a private GitHub repository. A verified payment grants your account read access, and every later update arrives with git pull.

Pay once with Dodo Payments
Dodo Payments is the merchant of record: it handles the card, the tax and the receipt.
Connect your GitHub account
The confirmation email from Dodo Payments links to your customer portal. Click Connect next to GitHub access.
Accept the invitation
GitHub invites you to the private repository with read access. Accept it, clone, and run bun run verify.

Install and verify

The installation guide lists every command, the environment variables each one needs and the checks to run before the first deploy. It assumes you have downloaded the release archive.

Installation guide All documentation