NextBase Starter

NextBase Starter is a free, MIT-licensed boilerplate that gives SaaS teams a production-grade Next.js 16 + Supabase foundation with SSR-correct authentication, Row Level Security, typed server actions, and a Turborepo monorepo out of the box.

What is NextBase Starter?

NextBase Starter is the open-source baseline of the NextBase family: an opinionated, tested starting point for SaaS teams building on Next.js 16 and Supabase. It takes a fresh clone plus environment configuration and produces a working app with email/password, magic-link, and OAuth sign-in, a protected dashboard shell, and RLS-protected CRUD routes. It runs on any Node 22+ host, with Vercel recommended, and is maintained by the NextBase team.

The repo is a Turborepo with two apps: apps/web holds the Next.js application, and apps/database contains Supabase migrations, pgTAP-style tests, and seed.sql. Shared TypeScript config lives in packages/typescript-config. The app uses three route groups: (external-pages) for marketing pages, (auth-pages) for login, sign-up, and password flows, and (app-pages) for the authenticated dashboard and private-items CRUD.

Key Features

NextBase Starter packs the plumbing a SaaS team would otherwise write in their first sprint into a single repo, with these concrete features:

• SSR-correct Supabase auth — @supabase/ssr clients for browser, server components, server actions, and middleware; sign-in methods include email + password, passwordless magic link, and OAuth (Google, GitHub, Twitter).
• RLS-by-default database layer — every user-owned table ships with SELECT/INSERT/UPDATE/DELETE policies keyed on auth.uid(), timestamped SQL migrations under apps/database/supabase/migrations, and generated database.types.ts from pnpm gen-types.
• Typed server actions — all mutations use next-safe-action with Zod validation and two pre-built clients: actionClient for general actions and authActionClient which injects ctx.userId and rejects unauthenticated calls.
• Next.js 16 Cache Components — cacheComponents: true in next.config.ts enables static-by-default rendering with surgical "use cache" boundaries, plus a written guide in docs/NEXTJS_CACHE_COMPONENTS.md.
• shadcn/ui + Tailwind CSS v4 — pre-installed Radix-based UI components (40+), @tailwindcss/postcss with forms and typography plugins, Framer Motion, Embla Carousel, cmdk, Lucide icons, date-fns, and React Hot Toast.
• Turborepo monorepo — pnpm workspaces with pipelined tasks for build, lint, test, typecheck, gen-types, and test:e2e; a local Supabase stack lifecycle via pnpm database#start | stop | status.
• Testing built in — Vitest + Testing Library for unit/integration, Playwright for E2E, and pgTAP-style SQL tests for RLS policies, all wired into Turbo pipelines.
• Release automation — Changesets-based "Version Packages" PRs that roll changes into a single release and cut a GitHub release, plus GitHub Actions starter workflows for Playwright and coverage.

Who is it for?

NextBase Starter is designed for founders, indie hackers, and small teams shipping a SaaS on Next.js + Supabase who want to compress weeks of plumbing into a weekend of customization. It also suits senior engineers who want a credible, line-by-line auditable starting point rather than a black-box CLI generator, and developers already experienced with Supabase who want a reference architecture for RLS, SSR cookies, and Cache Components.

What can you do with NextBase Starter?

With NextBase Starter you can go from an empty repo to a working authenticated app in under an hour, then customize it for several concrete scenarios:

• Indie hackers and founders: clone the repo, configure .env.local, and have authentication plus a database layer working in under an hour; then replace the marketing pages and dashboard shell with your own branding.
• SaaS engineering teams: use the starter as the foundation for a multi-user product, keeping the RLS-by-default migrations and typed server actions as the data layer while trimming or adding packages.
• Agencies and consultants: build client MVPs on an MIT-licensed codebase; commercial and client use is allowed without attribution or fees.

How does NextBase Starter work?

Set up follows a five-step path: pnpm install, copy the example env files and fill in Supabase credentials, start the local Supabase stack with pnpm database#start (or link a hosted project with pnpm supabase link and db push), run pnpm dev to see the app at localhost:3000, and verify with pnpm test, pnpm test:e2e, pnpm typecheck, and pnpm lint. Auth flows are handled through middleware that re-verifies sessions with auth.getUser(), server components that read via a Supabase client under RLS, and server actions that use authActionClient.

Pros and cons

NextBase Starter has a clear set of strengths based on its documented features, and a few explicit limitations stated in its README.

• Pros: authorization is enforced at the database layer via RLS, with middleware and authActionClient as additional checks; database types are generated so schema drift surfaces at build time; the caching strategy is documented; tests are wired into the Turbo pipeline.
• Cons: the free starter omits Stripe billing, teams/orgs, RBAC admin, transactional emails, multi-tenancy, and AI starter kits — those are sold as premium kits at usenextbase.com; the codebase assumes professional fluency in React and TypeScript, and the page explicitly states it is not for first-time learners, no-code users, or teams wanting a non-Supabase stack.

Pricing

The starter is free and MIT-licensed, so it can be used for personal, commercial, and client work without payment. Premium NextBase kits sold at usenextbase.com add billing, teams, RBAC, email, multi-tenancy, AI starters, and some database variants; pricing for those kits is not stated on the page.

FAQ

Here are answers to common questions about NextBase Starter.

Is NextBase Starter really free?

Yes. The starter is MIT-licensed and free to use for personal projects, client work, internal tools, or commercial products; no purchase is required. The premium kits are a separate commercial offering.

What's the difference between the starter and the premium kits?

The starter covers the foundation: Supabase auth, RLS, server actions, Cache Components, monorepo, and tests. The premium kits add features most SaaS products need on top, such as Stripe billing, teams and organizations, RBAC with an admin panel, transactional emails, multi-tenancy, and AI starter kits.

Can I use the starter for client work?

Yes. MIT permits commercial and client use, and attribution is appreciated but not required.

Does NextBase Starter support edge runtime?

The middleware is edge-compatible, and protected routes are matched with path-to-regexp. Server actions and React Server Components default to the Node runtime, which the page says is the right choice for Supabase SSR cookies and most app logic.

Can I remove shadcn / Tailwind / TanStack Query?

Yes. It is your codebase, and the architecture does not depend on any single one of those packages, so you can replace or remove them.