git clone to coding real features on Day One.
A production-grade spine for your SaaS — Supabase Auth, Multi‑Tenancy (Row-Level security - RLS), RBAC, Billing integration with idempotent webhook handlers, Entitlement enforcements, API Keys for workflows, Audit Trails — so you can stop plumbing and start shipping.
I kept losing weeks wiring the same auth, tenants, and billing. SupaCode is the kit I wished I had — so you ship the story that only you can tell.
$ # Stripe checkout session (server)
session = stripe.checkout.Session.create(mode='subscription', ...)The mountain between idea and launch
Authentication, tenants, Postgres RLS, roles, billing, entitlement enforcement, API key management, audit trails… Weeks disappear into plumbing.
"You’re building scaffolding, not the skyscraper."
SupaCode ships all of this prewired — your “10 days of setup” becomes a single git clone.
What's inside
Choose your path
DIY if you love to tinker, or build with me for speed.
- •FastAPI + Supabase RLS foundation
- •Auth, RBAC, Audit, Billing + Entitlements
- •Dynamic Object Builder & File Storage
- •Docs & Postman Collection
- •One‑week MVP sprint
- •Custom objects & roles for your domain
- •Payments wired + deploy plan
- •Handoff & backlog for next 30 days
Try to build these apps using the SupaCode foundation
- Contacts via Customer object
- Deals via Dynamic Builder
- Attach contracts in File Storage
- Entitlement‑based tiers
- Tenant = Agency
- Clients via Customer object
- Projects & Tasks via Builder
- Role‑based access
- Invoices object (amount, due_date, status) via Dynamic Builder
- Customer records with tenant‑isolated RLS
- Stripe/Dodo subscription + secure webhooks for status sync
- Entitlements: Flags (PDF export), Limits (invoices/month)
- Audit trail for edits, sends, and payment events
- File Storage for receipts/attachments, scoped per tenant
- Members via Customer object (RLS‑secured)
- Classes & Bookings as custom Objects (Dynamic Builder)
- Membership tiers via Entitlements: Flags, Limits, Meters
- RBAC roles: Manager, Coach, Frontdesk with fine‑grained access
- Recurring billing + webhooks to pause/resume on past_due
- Secure File Storage for waivers/photos; API Keys for kiosk/mobile
Transformation Realized
From clone to authenticated, tenant‑aware API.
RLS + RBAC checks across critical tables and endpoints.
Stripe & Dodopayments — swappable via environment variable.
"SupaCode felt like hiring a senior backend engineer for 2 weeks. We shipped our billing‑ready MVP in three days."
Frequently asked
What is this, exactly? A boilerplate or a platform?+
It's both. It starts as a production-ready boilerplate with all the foundational code you'd spend months writing: secure multi-tenancy, authentication, billing, and permissions. But it becomes a platform with its powerful Dynamic Object Builder, allowing you to create a 'Salesforce-like' application without writing new backend code.
Can I use this for my existing project?+
This starter kit is designed for new projects. Its value comes from providing a complete, integrated foundation from the start. Migrating an existing, complex application into its multi-tenant architecture would be a significant undertaking.
Can I connect any frontend?+
Yes, absolutely. This is a 100% headless, API-first backend. It's designed to work with any modern frontend framework (like React, Next.js, Vue, Svelte), a mobile application, or even for purely programmatic, headless workflows.
How do I switch billing providers between Stripe and Dodopayments?+
It's designed to be plug-and-play. You simply change one environment variable (`PAYMENT_GATEWAY="stripe"` or `"dodo"`). The core logic is decoupled, and the webhook handlers are built to be robust, idempotent, and provider-specific.
Is the Row-Level Security (RLS) hard to work with?+
Not at all. We've done the hard part. All the complex PostgreSQL policies for tenant isolation are pre-written and included. Your application code remains simple and clean; you just get the RLS-scoped database session, and the database guarantees data isolation. The full SQL is in the repository, so you can easily extend it.
How 'dynamic' is the Dynamic Application Builder?+
It's incredibly powerful for building CRMs, project management tools, or any business application. You can define custom objects (like 'Deals' or 'Projects') and typed fields via the API. The starter kit automatically provides secure, tenant-isolated CRUD endpoints for any object you create. It's perfect for low-to-medium scale use cases.
What's the technology stack?+
We chose modern, high-performance, and developer-loved technologies: FastAPI (Python) for the backend API, PostgreSQL for the database, SQLAlchemy for the ORM, Pydantic for data validation, and Supabase for authentication and file storage.
Can a user belong to multiple tenants (organizations)?+
The current V1 is built on a 'siloed' multi-tenancy model, where one user belongs to one tenant. This is the most common and secure pattern for many B2B SaaS apps. A collaborative model (many-to-many) is on our roadmap as a potential future update for agency-focused use cases.
Clone it. Customize it. Ship it.
A modern, secure SaaS backend that keeps you focused on what's uniquely yours.