Product
The SvelteKit + Supabase B2B starter — the boring 80% already wired.
Every B2B app ends up needing the same things, and every one of them is only obvious once a customer hits it. This kit is the version where that list was written down first, tested second, and shipped — with Supabase for auth, database and realtime.
Organizations, invitations, role-based access, seat-based billing behind a swappable adapter, and an append-only audit log — typed end to end.
What's inside
Organizations & membership
Create/join/leave orgs, invite links with expiry, transfer ownership.
RBAC via Supabase RLS
Three built-in roles (owner > admin > member) enforced server-side via Row Level Security policies — not hidden UI.
Seat-based billing
Seat limits enforced at join-time via a pluggable BillingAdapter (mock included; plug in Stripe, Lemon Squeezy, or Paddle).
Append-only audit log
Who did what, queryable, export-ready — the thing enterprise pilots ask for in week one.
Supabase Auth
Email+password, magic links, OAuth providers. Managed auth with session handling built in.
PostgreSQL via Supabase
Managed PostgreSQL with connection pooling, backups, and scaling. No SQLite limitations.
Feature summary
- Multi-tenancyFull implementation
- RBAC (owner > admin > member)Server-side + RLS
- Seat billing adapterPluggable seam
- Audit logAppend-only
- Rate limitingSliding window
- AuthSupabase Auth
- DatabasePostgreSQL (managed)
- RealtimeVia Supabase (platform)
- RLS policiesDefense-in-depth
See it in action
Real UI from the live deployed demo — supabase-starter.verdantstack-site.pages.dev/ (seeded org, resets daily).
Built for AI coding agents
The kit ships with the context files AI coding agents (Claude Code, Cursor, GitHub Copilot) actually need to work in a codebase the moment they open it.
- AGENTS.md — architecture decisions, command shortcuts, and "things that will bite you" so an agent starts productive, not fumbling.
- TypeDoc API reference — generated from the code, a machine-readable spec of every export that cannot silently rot.
- A public docs portal + llms.txt — deep-dive guides and a site index an agent can retrieve, not just a human can read.
Not a bolt-on: the full agent context lives in the repo from day one.Read the AGENTS.md.
Which database fits
All three kits ship the same tested multi-tenant core — orgs, invites, RBAC, seat billing, audit log. They differ only in the data layer. So the only real question is: which database do you already run, or plan to run? Pick by situation, not by feature list.
Do I need to scale past a single server / need Postgres features?
Postgres Starter (vendor-neutral)
Am I already invested in Supabase (auth, storage, realtime)?
Supabase Starter
Do I want a free, managed, edge-native database with zero ops?
Multi-tenant SvelteKit Starter (D1)
| Your situation | Pick | Why |
|---|---|---|
| You will outgrow a single-file DB — pooling, replicas, JSONB, RLS, big data | SvelteKit + Postgres Starter | Real Postgres, zero lock-in, Drizzle ORM, opt-in RLS. The vendor-neutral flagship. |
| You want managed Supabase Auth / realtime / storage APIs and RLS out of the box | SvelteKit + Supabase Starter(this one) | The same core layered onto Supabase — auth, database, realtime, RLS handled for you. |
| You want zero external services — everything on the Cloudflare edge, cost-free | Multi-tenant SvelteKit Starter | SQLite/D1 via better-sqlite3 + Drizzle. The zero-ops serverless default. |
Not sure? Read the documentation or the multi-tenant starter evaluation checklist. Every kit is a one-time license with lifetime updates and a 30-day refund.
How it compares
- This is NOT another basic starter. Free templates (CMSaasStarter, kiankit) already give you auth and a dashboard. This kit handles the hard parts: multi-tenancy, RBAC, seat billing, and audit logging.
- Scope: v1 uses Supabase exclusively. If you need self-hosted SQLite, see our other starter.
- Built by the same team behind the Multi-tenant SvelteKit Starter (475 tests, a production-ready foundation).
How it compares with free alternatives
If you don't need RBAC, billing, or audit logging, CMSaasStarter is a great choice. If you do, this starter handles that gap — the same hard parts our SQLite starter implements. The exact list is below, file by file, so you can price the difference at your own rate.
Who this is for
One reader: someone who has already chosen Supabase, is building aB2B product that will hold more than one organisation, and wants the tenancy layer finished rather than started.
- Auth is already a decision you made.Email and password, magic links and OAuth are handled by Supabase Auth, which means the accounts live in Supabase and your application tables live beside them — including a
usersprofile row per account, kept in sync by trigger. If you want to own auth yourself, take the Postgres kit instead. - You would rather not run a database server.Managed Postgres, backups and connection pooling come with the platform. This kit is the application layer that runs on top of them — orgs, invites, RBAC, seats, audit.
- Tenant isolation should not be a UI concern.Here RBAC is enforced through Row Level Security policies in the database, so a request that forgets its check fails closed instead of leaking a row.
- Your next customer has more than one team in it.When the first real account asks who changed what and when, the audit log is the answer you would otherwise be writing from scratch — under a deadline, in someone else's code.
What you're buying instead of building it
The honest version of "$99 or do it myself" is not a number of hours — you know your rate better than we do. It is the list of what you would otherwise have to write, and the list of what you would only notice was missing after a customer hit it.
- 37 source files, 3,638 lines of application code
- 24 test files, 7,032 lines of tests — 509 of them
- 5 tables across the migrations that create them — the four tenancy tables plus a
usersprofile table kept in sync with Supabase Auth by trigger - One licence covering every project you build on it
The tests are the part that earns the money. They are the written record of the edge cases: an invite link that expired, two members claiming the same invite, a join arriving after the seat limit, a member's forged request trying to promote themselves, an audit row with no edit path. None of that shows up in a screenshot, and all of it is what a paying account finds first.
If your own estimate for that list is a few weeks, then $99 is not really the decision — the weeks are. We don't publish an hour count, because we cannot measure yours, and a number we made up would only be an ad.
Who it's NOT for
- You want self-hosted SQLite or D1 — this is Supabase-native, deliberately.
- You need enterprise SSO/SCIM on day one — this ships app-level tenancy, not identity-provider federation.
- You want a huge component library — this is a foundation, not a UI kit.
Pricing, stated plainly
One license, unlimited projects, commercial use permitted. Lifetime updates included. Stated plainly because pricing pages that hide this are worse than useless.
Building for a client or a team of three or more? TheTeam Licence is$249 — 3+ seats, still unlimited projects. Same updates, same support, no per-project fee.Ask about a team licence — invoiced individually, since checkout is per-kit.
- Actively maintained — v0.4.2, released 2026-10-21, 15 dated releases, 62 logged changes. The full history is public.
- Commercial license — use it in your business
- Live interactive demo — try before you buy
- 509 automated tests covering auth, RBAC, invites, seats, audit
- Full documentation + API reference + AI-agent files
- Lifetime updates included
Source delivered to buyers. The full kit code is delivered privately to you after purchase — it is not posted publicly. Explore the docs, feature list and proof freely; buy when you want the code.
30-day full refund — no hassle, no questions. If it's not for you, get your money back.
Actively maintained — see the latest release.Read License Agreement
FAQ
Why Supabase instead of raw Postgres?
Supabase bundles Auth, RLS, Realtime, Storage, and a dashboard — things you would otherwise wire yourself. If you want managed convenience and are happy operating inside the Supabase ecosystem, this is the faster path. If you prefer provider-neutral control, see our Postgres starter.
Is this different from the free CMSaasStarter?
CMSaasStarter gives you auth and a dashboard — great for prototyping. This kit adds the hard parts free starters skip: multi-tenancy, RBAC, seat billing, and an append-only audit log. The "What you're buying instead of building it" section below lists that inventory file by file — the weeks it costs you is your own estimate, and we publish no hour count because we cannot measure yours.
How many tests does it ship with?
509 automated tests across 24 test files, running against an in-memory fake Supabase client — no database, no network. RLS policies are verified separately via supabase start.
What's the update policy?
One license, unlimited projects, commercial use permitted. Lifetime updates included. Stated plainly because pricing pages that hide this are worse than useless.
Is there a team license?
One license covers one developer. For a client or a team of three or more, the Team Licence is $249 — 3+ seats, still unlimited projects, same updates and support, invoiced individually.
Can't I build this myself or with an AI coding agent?
You can — and the kit includes AGENTS.md and TypeDoc so your agent starts productive. But the value is in the 509 tests, the edge cases (invite expiry, atomic claims, seat enforcement, audit tamper-proofing), and the plumbing that's invisible until an enterprise pilot asks for it in week one. You're buying a tested foundation, not a code generator.
Dive deeper
Get in touch
Questions about the product, team licenses, or anything else? We'll aim to respond within 48 hours.