Skip to content
2026 edition · v1.1 Production-ready Polished from 13+ yrs of dev

Ship the SaaS.
Skip the scaffolding.

A multi-tenant Django + Next.js boilerplate. Auth, multi-tenant, Stripe billing, roles, 2FA, i18n — already wired and tested. Buy once, ship every SaaS idea you have for the rest of your career.

Buy LaunchKit — from $249 See what's inside →
Backend tests
500
Frontend tests
39
i18n coverage
100%
License
∞ projects
~/launchkit · zsh 
$ git clone [email protected]:launchasaas/launchkit-api.git
$ git clone [email protected]:launchasaas/launchkit-web.git
$ cd launchkit-api && cp .env.example .env && docker compose up -d --build
[+] Running 6/6 — postgres, redis, mailhog, api, celery, celery-beat
$ docker compose exec api python manage.py migrate && docker compose exec api python manage.py seed_demo
[seed] demo tenant · plans · members · tickets
$ cd ../launchkit-web && npm install && npm run dev
→ http://localhost:3000 — Dashboard live. Stripe wired. Time to ship features.
▍

Production-grade stack — already wired

Django
PostgreSQL
Redis
Stripe
Cloudflare
Next.js
TypeScript
Tailwind CSS
shadcn/ui
Sentry
GitHub Actions
Django
PostgreSQL
Redis
Stripe
Cloudflare
Next.js
TypeScript
Tailwind CSS
shadcn/ui
Sentry
GitHub Actions
01 / Inside

24 screens. Audited end-to-end.

app.launchasaas.dev/dashboard
Auth · Sign in
Settings · Members
Settings · Subscription
  • 08 Auth screens
  • 03 Onboarding steps
  • 10 Settings pages
  • 03 Billing flows
02 / Problem

You've built this exact thing four times already.

Three weeks of plumbing before a single feature line lands. Skip it.

  1. W1

    Auth · JWT refresh · Password reset · Email verify · 2FA · Google OAuth

  2. W2

    Tenants · Roles · Member invites · Permission system with wildcards

  3. W3

    Stripe · Plans · Addons · Webhooks · Idempotency · Past-due grace

  4. W4

    i18n · Audit logs · Rate limits · Error pages · Tests · CI · …

03 / What you get

Everything between “idea” and “I’ll take a credit card.”

Not a starter template. Not a tutorial with TODOs. Full backend + frontend, audited end-to-end, every unsexy part already done — and tested.

  • Backend

    Django 5.2
    • Django REST Framework 3.17
    • PostgreSQL with multi-tenant scoping
    • Celery + Redis for async jobs
    • django-auditlog on sensitive models
    • pytest + factory-boy · 500 tests
    01 / 06 5 items

  • Frontend

    Next.js 16
    • React 19 with React Compiler
    • TypeScript throughout (strict) — API types generated from the schema
    • NextAuth (credentials + Google OAuth)
    • TanStack Query + custom useFetch hook
    • Tailwind v4 + shadcn/ui
    • next-intl (EN + ES, 100% covered)
    02 / 06 6 items

  • Billing

    Stripe
    • Plans · Addons · Prepaid credits
    • Idempotent webhook handlers
    • Customer portal · Invoices · Retry failed payments
    • Trial + past-due grace period
    • Tested against race conditions
    03 / 06 5 items

  • Auth

    4 methods
    • JWT with rotation + blacklist
    • Email/password with verification
    • Google OAuth
    • Email codes (AuthCode model)
    • TOTP (pyotp) for 2FA
    04 / 06 5 items

  • Tooling

    CI included
    • GitHub Actions: lint + tests
    • Dependabot weekly bumps
    • Pre-commit hooks (ruff + eslint)
    • Sentry hooks · structured JSON logs
    • Docker compose for local dev
    05 / 06 5 items

  • Developer XP

    AI-ready
    • AGENTS.md architecture maps (open standard)
    • 9 agent skills — Claude Code, Cursor, Codex
    • OpenAPI export · Postman collection
    • Demo seed + email previewer
    • CHANGELOG with migration notes
    06 / 06 5 items
04 — 06 / Deep dive

Three of the parts most boilerplates get wrong.

04 Multi-tenant

Tenant isolation that's impossible to forget.

Every request gets a TenantMiddleware-resolved tenant. ViewSets auto-scope queries. New models inherit TenantOwnedModel. You literally have to opt out of tenancy, not opt in.

  • TenantMiddleware sets request.tenant on every hit
  • TenantViewSetMixin auto-filters querysets
  • Wildcard permissions: *.* · app.* · app.resource.*
  • Cache-invalidating permission revocations
python 
# apps/your_feature/views.py
class InvoiceViewSet(
    TenantViewSetMixin,        # auto-scopes by request.tenant
    TenantPermissionMixin,     # checks app.resource.action
    SubscriptionLimitMixin,    # enforces plan quotas
    viewsets.ModelViewSet,
):
    serializer_class = InvoiceSerializer
    queryset = Invoice.objects.all()
 
# That's it. 5 lines. Multi-tenant + RBAC + plan-gated.
05 Stripe billing

Stripe done the way it should be done.

Idempotent webhook handlers backed by a StripeEvent table. Credit purchases dedup on payment_intent_id. CreditBalance updates run inside select_for_update() — race conditions caught and tested.

  • Plans, addons, and prepaid credits — all wired
  • Idempotent webhooks (StripeEvent + payment_intent dedup)
  • select_for_update() on credit balance mutations
  • Past-due grace period · auto-cancellation safety net
python 
# apps/subscriptions/tasks.py
@shared_task
def handle_credit_purchase_completed(event_id, session):
    with transaction.atomic():
        balance = CreditBalance.objects.select_for_update()
            .get_or_create(tenant=tenant)[0]
 
        # Re-check inside the lock — Celery may retry.
        if already_processed(payment_intent_id):
            return  # idempotent. nothing to do.
 
        balance.deposit(amount, metadata={...})
06 Auth + 2FA

Auth that's been audited, not assembled.

JWT with rotation and blacklist. 2FA via email codes or TOTP. Google OAuth. Per-user lockouts after N failures. Hardened across multiple security + quality audits — every finding pinned by a regression test.

  • cryptographically secure 6-digit codes (secrets.randbelow)
  • Login lockout: 5 attempts / 15 min (configurable)
  • Invitation tokens use a separate signing key
  • Regression tests pin every closed security finding
python 
# apps/users/tests/test_security_regressions.py
def test_email_field_is_read_only_on_profile_patch(api):
    # Closes account-takeover via PATCH /auth/user/
    response = api.patch("/auth/user/", {"email": "[email protected]"})
    assert response.status_code == 200
    assert User.objects.get().email != "[email protected]"
 
# 17 of these. Every audit finding has its own test.
07 / AI-ready Built for AI agents

Built so your AI agent can ship the next feature.

AGENTS.md — the open standard read natively by Claude Code, Cursor, Codex, Copilot, Gemini CLI and Zed — maps every load-bearing pattern in both repos: the request pipeline, the permission engine, the billing invariants, the traps. 9 skill recipes cover the jobs agents (and humans) most often get wrong. Thin CLAUDE.md, Cursor and Copilot pointers keep every tool on the same page.

  • /launchkit-api-patterns Models, serializers, ViewSets, services and Celery tasks — the house style. api
  • /launchkit-add-app Scaffold a tenant-scoped Django app: mixins, permission catalog, default roles, i18n. api
  • /launchkit-permissions Add a permission, catalog it, back-fill roles — and debug a 403 in minutes. api
  • /launchkit-stripe-webhook Idempotency, dedup on payment_intent_id, transaction.atomic + select_for_update. api
  • /launchkit-tests Fixtures, real-JWT clients, idempotency and one-regression-test-per-finding. api
  • /launchkit-app-patterns Server Component page → client component → API client → query keys → routes. web
  • /launchkit-add-feature End-to-end recipe for a new page or module, sidebar and breadcrumbs included. web
  • /launchkit-forms react-hook-form + Zod + shadcn, with the React 19 / Compiler traps called out. web
  • /launchkit-i18n next-intl on the client, gettext on the API, and the audit scripts that catch drift. web
AGENTS.md
read by your agent on every prompt 
# LaunchKit API — request pipeline

Every request passes through this stack:

  1. JWTAuthenticationMiddleware → request.user
  2. TenantMiddleware            → request.tenant
  3. PresenceMiddleware          → last_activity_at
  4. SubscriptionMiddleware      → 403 if expired
  5. TenantPermissionMixin       → app.resource.action
  6. ModuleAccessMixin           → entitlements

## Things that are easy to get wrong

— Middleware raises 500s, not 4xx.
  Catch your own errors and degrade.

— Two exempt-path lists must stay in sync:
  TENANT_MIDDLEWARE_EXCLUDED_PATHS and
  SUBSCRIPTION_MIDDLEWARE_EXEMPT_PATHS.

— New webhook handler?
  Idempotent. Mark StripeEvent.processed. Retry.
…
Works with
Claude Code · Cursor · Codex · Copilot · Gemini CLI · Zed
08 / The math

Buy vs. build vs. the other guy.

 
Option A LaunchKit
Option B Other boilerplate
Time to first dashboard
5 min
 2–3 days
Multi-tenant by default
Yes
 Maybe
Stripe webhook idempotency
Tested
 Hopeful
Permission system with wildcards
Yes
 Sometimes
Automated tests
500 backend + 39 frontend
 Demo only
i18n (EN + ES, both stacks)
100% covered
 Frontend only
AI-agent docs (AGENTS.md + skills)
Yes · 9 skills
 No
License
One-time, commercial
Updates for life on both tiers
Subscription

Three weeks of plumbing at a junior contractor's rate is roughly $4,800. Three weeks of your time is whatever opportunity cost you'd rather not put a number on.

09 / Pricing

Pay once. Own it forever.

No subscriptions, no per-seat creep, no renewal. Pay once, own the source, and keep every update for as long as LaunchKit is maintained. Pick the tier by how many products you plan to ship.

Solo
$249

one-time · One product · Updates for life

  • Django 5.2 + Next.js 16 · 539 automated tests · audited
  • Multi-tenant, Stripe billing, RBAC, 2FA, i18n (EN+ES) — wired
  • AGENTS.md + 9 agent skills — Claude Code, Cursor, Codex, Copilot
  • Ship one product, commercially, forever
  • Updates for life · Email support
Buy Solo

Secure checkout · Repo access in 5 min

Best value
Unlimited
$499

one-time · Unlimited products · Client work

  • Everything in Solo, and:
  • Ship unlimited products on one licence
  • Build with it for clients
  • Private Discord community
  • Early access to new features · vote on the roadmap
Buy Unlimited

Secure checkout · Repo access in 5 min

Secure checkout · Powered by Stripe
Instant repo access · clone & ship
Email me first · I read every reply
10 / FAQ

The honest answers.

Anything else? Email us directly — we read every message.

From the maker

I’m Franyer. After 13+ years of building web products I kept rebuilding the same auth, tenants and billing plumbing for every client — LaunchKit is that plumbing, done once, properly. Not sure it fits your project? Email me before you buy. I’d rather answer a question than lose you to a refund.

— Franyer Verjel · franyer.dev

  • 01 What exactly do I get when I buy?
    Access to a private GitHub organization with two repositories: launchkit-api (Django 5.2 + DRF) and launchkit-web (Next.js 16 + React 19). Plus the AGENTS.md architecture maps, 9 agent skills, pointer files for Claude Code, Cursor and Copilot, the CI configuration, 539 automated tests, and a CHANGELOG. Everything in the box — yours.
  • 02 Can I use it for commercial projects? Multiple projects?
    Commercially, yes, on both tiers — you never owe us a cut or a credit. The difference is how many products you can ship: Solo covers one, Unlimited covers as many as you like plus work you build for clients. The only thing neither tier allows is reselling the boilerplate itself as your own starter kit.
  • 03 What's the difference between Solo and Unlimited?
    The same source code, the same repository access, and updates for life on both. Solo licenses one product. Unlimited licenses as many as you want, adds the right to build client work on it, and comes with the private Discord, early access and a vote on the roadmap. If you ever outgrow Solo, email us and we'll credit what you paid against the difference.
  • 04 Do I have to credit LaunchKit anywhere?
    No. Strip every reference to LaunchKit from the codebase. Rename every file. Use it however you want.
  • 05 How do I get access, and how do updates work?
    Right after checkout you get an email with a claim link. Enter your GitHub username and you're invited to the private GitHub organization within minutes. Pulling updates is a normal git fetch + merge; each release ships with a CHANGELOG and migration notes when relevant. Both tiers keep receiving updates for as long as LaunchKit is maintained — there is no renewal and nothing expires.
  • 06 What's the refund policy?
    Honest answer: once you've claimed access to the private GitHub organization, the source code is in your hands and we can't take it back — so we don't offer refunds after that point. If you change your mind before claiming access, email us within 7 days and we'll refund in full. The best way to avoid buyer's regret is to read the FAQ, scroll through the screens, and email us if you're unsure before you check out — happy to answer anything.
  • 07 Can I see more before I buy?
    Yes — every screenshot in the showcase clicks open. The full feature list lives in the stack and features sections above. If you want a deeper look at a specific area (a particular page, a code pattern, the Stripe webhook handler), email us and we'll send you a short Loom or a code snippet. We'd rather walk you through it than have you regret the purchase.
  • 08 Do I need to know Django and Next.js to use this?
    Yes — this is a foundation, not a no-code product. If you've shipped anything in either framework, you'll be at home. The bundled AGENTS.md files and skills make it easier to onboard with any AI coding assistant.
  • 09 Is the frontend TypeScript?
    Entirely. Every file in the Next.js app is TypeScript under strict mode, and the API types are generated from Django’s own OpenAPI schema — so a renamed serializer field breaks the build instead of surfacing as undefined in production. Type-checking runs in CI next to lint, tests and the build.
  • 10 Is the multi-tenant model strict isolation or schema-per-tenant?
    Logical isolation: every tenant-scoped model carries a tenant FK and the middleware sets request.tenant. ViewSets auto-scope queries. This is the right tradeoff for early-stage SaaS — schema-per-tenant adds operational complexity that you don't need until you hit thousands of tenants.
  • 11 What if I find a bug or need a feature?
    Email support is included on every tier — reply to your welcome email and you'll get a response within 24 hours on weekdays. Unlimited buyers also get the private Discord where I drop early builds, answer architecture questions, and pick the next features with the community. Security fixes ship to every license holder for free, regardless of tier.
11 / Ship

Stop writing auth.
Start writing features.

Pay once, own it forever. Build the SaaS your customers see — not the plumbing they never will.

Buy LaunchKit — from $249

Secure checkout · Repo access in your inbox · Read the FAQ before buying