Yes. Your product key never expires. When a new version ships — Next.js upgrades, new features, bug fixes — it appears in your dashboard alongside every previous version. Download any version, any time.

Is this production-ready?

Yes. Built with production-grade architecture: CI/CD pipelines, security headers (HSTS, CSP, X-Frame-Options), rate limiting, structured logging, environment validation, error sanitization, and foreign key enforcement.

What tech stack does it use?

Next.js 16, React 19, TypeScript 6, Hono.js 4, Cloudflare Workers, D1 database, Drizzle ORM, Razorpay, Google OAuth 2.0 with PKCE, NX 23 monorepo, Tailwind CSS v4, and GitHub Actions.

AdnanBuilds

Loading…

Blazing fast scaffolding · Next.js 16 · Lifetime Updates · Cloudflare

Home→Products→SaaS LaunchKit Pro

Best Seller Updated 3 days agov3.2.0 Lifetime updates

SaaS LaunchKit Pro

Blazing fast SaaS scaffolding kit. Full-stack boilerplate built with Next.js 16, Hono.js, Cloudflare Workers, D1, Drizzle ORM, Razorpay, Google OAuth 2.0 with PKCE, NX Monorepo, and GitHub Actions CI/CD. Go from zero to production in days, not months.

Next.js 16React 19TypeScript 6Hono.js 4Cloudflare WorkersD1 DatabaseDrizzle ORMRazorpayNX 23Tailwind CSS v4GitHub Actions

$0.00

One-time payment · every future update included, forever

Try Core Free First

No signup, no credit card — Core is MIT-licensed and free forever on GitHub.

terminal

$ npx create-saas-app

✓ Project scaffolded

✓ Dependencies installed

✓ Ready to deploy

Total: 12s

$0.00

one-time · Instant product key

Try Core Free

Version3.2.0

Last Updated3 days ago

LicenseCommercial (Lifetime)

Source CodeIncluded

UpdatesFree, forever

SupportEmail + Docs

Free & Open SourceMIT License

Not ready to buy? Run the free version first.

SaaS LaunchKit Core is the same production-grade auth foundation — Google OAuth with PKCE, HMAC-SHA256 sessions, AES-256-GCM encrypted tokens, security headers, and a dashboard — free and MIT-licensed on GitHub. Clone it, run it locally, read every line. When you're ready to charge customers, upgrade to Pro for Razorpay payments, a product catalog, and a commercial license — no rewrite required.

View SaaS LaunchKit Core on GitHub Compare Core vs Pro

Why this exists

Building a SaaS from scratch takes months.

You spend weeks on auth, payments, database setup, deployment configs, and testing — before writing a single line of your actual product. SaaS LaunchKit Pro is blazing fast scaffolding that eliminates that overhead. Production-grade architecture from the first commit. Go from zero to production in days, not months.

Who it's for

Built for builders.

Startup Founders

Freelancers

Agencies

Developers

Indie Hackers

SaaS Teams

Not ideal for: Non-technical users who need a no-code solution, or projects that don't use React/Next.js.

What's included

Everything you need. Nothing you don't.

Frontend

Next.js 16 App Router
React 19
Tailwind CSS v4
OpenNext Cloudflare deployment
Auth middleware for /dashboard
Landing page + Dashboard

Backend API

Hono.js 4 on Cloudflare Workers
CORS + body limit middleware
KV-backed rate limiting
Structured JSON logging
Environment validation on first request
Security headers on all responses

Auth & Security

Google OAuth 2.0 + PKCE (S256)
HMAC-SHA256 session hashing
AES-256-GCM encrypted refresh tokens
CSRF state validation (constant-time)
Single-session enforcement
Sliding window session renewal

Payments

Razorpay order creation
Payment signature verification
Webhook handler (captured, failed)
Idempotent order processing
Amount mismatch detection
Authenticated + anonymous purchases

Database

Cloudflare D1 (serverless SQLite)
Drizzle ORM type-safe queries
4 tables: users, accounts, sessions, orders
Interactive migration runner
Foreign key enforcement (PRAGMA)
D1 batch API for atomic operations

Shared Packages

@repo/auth — Google OAuth helpers
@repo/payments — Razorpay SDK
@repo/http — HMAC, encrypt/decrypt
@repo/types — TypeScript types
@repo/products — Product catalog
@repo/api-endpoints — Route constants

Infrastructure

NX 23 monorepo workspace
GitHub Actions CI (build, lint, test)
Auto-deploy web on push to main
Auto-deploy server on push to main
TypeScript 6 strict mode
ESLint + Prettier

Documentation

Architecture.md (601 lines)
SETUP.md (8-step guide)
LICENSES.md (commercial license)
EULA.md template for your customers
README.md with quick start
Environment variable reference

Feature deep dive

Built right. From day one.

Authentication

Google OAuth 2.0 with PKCE (S256) — the gold standard for OAuth security. State parameter with constant-time XOR validation prevents CSRF. Raw tokens are never stored; every session is HMAC-SHA256 hashed. Sliding window renewal auto-extends sessions at <50% lifetime. Single-session enforcement means old sessions are deleted on new login.

authentication.ts

// PKCE state validation — constant-time comparison

export function validateState(received: string, expected: string): boolean {

const a = new TextEncoder().encode(received);

const b = new TextEncoder().encode(expected);

const maxLen = Math.max(a.length, b.length);

let diff = a.length ^ b.length;

for (let i = 0; i < maxLen; i++) {

diff |= (a[i] ?? 0) ^ (b[i] ?? 0);

}

return diff === 0;

}

// Session hashing — raw tokens never stored

export async function hashSession(token: string, secret: string) {

return hmacHex(secret, token);

}

// Encrypted refresh tokens — AES-256-GCM

const encryptedRefreshToken = tokens.refresh_token

? await encrypt(tokens.refresh_token, c.env.SESSION_SECRET)

: null;

Payments

Razorpay integration with order creation, signature verification (constant-time comparison), and webhook handling. Idempotent orders prevent double-charging. Amount mismatch detection catches tampered requests. Works for both authenticated and anonymous purchases.

payments.ts

// Signature verification — constant-time

export async function verifyPaymentSignature(

params: { razorpayOrderId: string;

razorpayPaymentId: string;

razorpaySignature: string },

keySecret: string,

): Promise<boolean> {

const expected = await generateSignature(

params.razorpayOrderId,

params.razorpayPaymentId, keySecret,

);

return constantTimeCompare(expected, params.razorpaySignature);

}

// Idempotent order creation

const existing = await db.select().from(orders)

.where(and(

eq(orders.productId, product.id),

eq(orders.status, "pending"),

)).get();

if (existing) return c.json({ success: true, data: existing });

Backend API

Hono.js 4 running on Cloudflare Workers. Middleware stack: CORS with origin validation, body limit (1MB), structured JSON logging, security headers (HSTS, CSP, X-Frame-Options), KV-backed rate limiting per endpoint, and environment validation at startup.

backend-api.ts

// Security headers on every response

app.use("/*", async (c, next) => {

c.header("X-Content-Type-Options", "nosniff");

c.header("X-Frame-Options", "DENY");

c.header("Strict-Transport-Security",

"max-age=63072000; includeSubDomains; preload");

c.header("Permissions-Policy",

"camera=(), microphone=(), geolocation=()");

c.header("Content-Security-Policy",

"default-src 'none'");

return cors({ origin, credentials: true })(c, next);

});

// KV-backed rate limiting

app.use("/auth/google", async (c, next) => {

const ip = getClientIp(c);

if (!(await checkRateLimitKV(

c.env.RATE_LIMIT_KV, `auth:${ip}`, 10, 60)))

return c.json({ error: "Too many requests" }, 429);

await next();

});

Database

Cloudflare D1 — serverless SQLite at the edge. Drizzle ORM for type-safe queries. 4 tables with foreign key enforcement, indexed columns, and D1 batch API for atomic operations. No SQL injection risk. Interactive migration runner included.

database.ts

// Schema — 4 tables with relations

export const users = sqliteTable("users", {

id: text("id").primaryKey(),

email: text("email").notNull().unique(),

name: text("name").notNull(),

picture: text("picture"),

createdAt: text("created_at").notNull()

.default(sql`(strftime('%Y-%m-%dT%H:%M:%SZ', 'now'))`),

});

export const orders = sqliteTable("orders", {

id: integer("id").primaryKey({ autoIncrement: true }),

userId: text("user_id").references(

() => users.id, { onDelete: "set null" }),

razorpayOrderId: text("razorpay_order_id").unique(),

status: text("status").notNull().default("pending"),

}, (t) => [index("orders_status_idx").on(t.status)]);

Encryption

AES-256-GCM encryption with PBKDF2 key derivation (100K iterations, SHA-256). Random 12-byte IVs for every encryption. HMAC-SHA256 for session hashing and payment signature verification. Constant-time string comparison prevents timing attacks.

encryption.ts

// AES-256-GCM — PBKDF2 key derivation

async function deriveKey(secret: string) {

const keyMaterial = await crypto.subtle.importKey(

"raw", encoder.encode(secret),

{ name: "PBKDF2" }, false, ["deriveKey"],

);

return crypto.subtle.deriveKey(

{ name: "PBKDF2",

salt: encoder.encode("saas-launchkit-refresh-token"),

iterations: 100_000, hash: "SHA-256" },

keyMaterial,

{ name: "AES-GCM", length: 256 },

false, ["encrypt", "decrypt"],

);

}

// Constant-time comparison

export async function constantTimeCompare(a: string, b: string) {

if (a.length !== b.length) return false;

let result = 0;

for (let i = 0; i < a.length; i++) {

result |= a.charCodeAt(i) ^ b.charCodeAt(i);

}

return result === 0;

}

Deployment

Three GitHub Actions workflows: CI (build, typecheck, lint, test, audit on every PR), auto-deploy web when apps/web/ changes, auto-deploy server when apps/server/ or any package changes. OpenNext handles Cloudflare Workers deployment.

deployment.ts

# ci.yml — Runs on every PR

- run: npx nx affected -t build typecheck

- run: npx vitest run

- run: npx nx run-many -t lint

- run: npm audit --audit-level=high

# deploy.server.yml — Push to main

concurrency:

group: deploy-server

cancel-in-progress: true

steps:

- run: npm ci

- run: npx nx affected -t build typecheck

- run: npx vitest run

- run: npm run deploy

Security

Order input validated: length, amount > 0, integer, currency, email.

Infra

Error Sanitization

Internal errors return generic message. Stack traces never leak.

Infra

Environment Validation

8 required env vars checked on first request. Missing vars return 500.

Foreign Key Enforcement

PRAGMA foreign_keys = ON. Cascading deletes.

Payments

Idempotent Orders

Pending orders reused. Prevents duplicate charges.

Payments

Amount Mismatch Detection

Payment amount verified against database record.

Crypto

Constant-Time Comparison

XOR-based comparison prevents timing attacks.

Network

Referrer-Policy

strict-origin-when-cross-origin. Controls referrer leakage.

Auth

CSRF Logout Protection

Origin header validation on POST /logout prevents forced logout attacks.

Infra

Request ID Tracing

Unique UUID assigned per request. Enables distributed tracing and debugging.

API Reference

9 endpoints. Fully documented.

Method	Path	Description	Auth	Rate Limit
GET	/health	Health check with DB latency	—	—
GET	/auth/google	Initiates Google OAuth with PKCE	—	10/min
GET	/auth/google/callback	OAuth callback — exchanges code, creates session	—	—
GET	/auth/me	Returns current user with session rotation	✓	30/min
POST	/auth/logout	Destroys session and clears cookie	✓	—
POST	/auth/refresh	Refreshes Google OAuth tokens	✓	—
POST	/payments/create-order	Creates Razorpay order (idempotent)	—	10/min
POST	/payments/verify-order	Verifies payment signature + amount	—	20/min
POST	/payments/webhook	Razorpay webhook handler	—	—

Shared Packages

6 packages. Type-safe imports.

@repo/auth

Google OAuth 2.0 helpers — PKCE, state validation, token exchange

export generateState

export validateState

export getGoogleAuthUrl

export exchangeCodeForTokens

export refreshAccessToken

export getGoogleUser

@repo/payments

Razorpay SDK — orders, signatures, webhooks, validation

export createRazorpayOrder

export fetchRazorpayOrder

export verifyPaymentSignature

export validateOrderInput

export verifyWebhookSignature

@repo/http

HTTP utilities — fetch timeout, HMAC, encrypt/decrypt

export fetchWithTimeout

export hmacHex

export constantTimeCompare

export encrypt

export decrypt

@repo/types

Shared TypeScript types

export User

export Product

export PaymentStatus

export RazorpayOrder

export RazorpayPayment

@repo/products

Product catalog — centralized definitions

export PRODUCTS

export getProductById

@repo/api-endpoints

API route constants — type-safe URLs

export API_ENDPOINTS

Database Schema

4 tables. Edge-ready.

TABLE

users

User profiles from Google OAuth

id (PK, Google ID)

email (unique)

name

picture

created_at

updated_at

TABLE

accounts

OAuth accounts with encrypted tokens

id (auto-increment)

user_id (FK → users, cascade)

provider

provider_account_id

refresh_token (AES-256-GCM)

expires_at

created_at

TABLE

sessions

HMAC-SHA256 hashed session tokens

id (PK, HMAC hash)

user_id (FK → users, cascade)

expires_at

created_at

TABLE

orders

Razorpay payment orders

id (auto-increment)

user_id (FK, set null)

product_id

product_name

amount

currency

razorpay_order_id (unique)

razorpay_payment_id (unique)

razorpay_signature

status

failure_reason

customer_name

customer_email

created_at

updated_at

paid_at

Tech stack

Modern. Proven. Production-grade.

Next.js 16

React framework

React 19

UI library

TypeScript 6

Type safety

Hono.js 4

Edge API

Cloudflare

Edge runtime

D1 Database

Serverless SQLite

Drizzle ORM

Type-safe queries

Razorpay

Payments

NX 23

Monorepo

Tailwind v4

CSS framework

GitHub Actions

CI/CD

Architecture

NX Monorepo. Clean separation.

project structure

apps/
├── web/                        # Next.js 16 frontend
│   ├── src/app/                # App router (landing, dashboard)
│   │   ├── dashboard/          # Protected dashboard
│   │   └── page.tsx            # Landing page
│   ├── src/components/         # UI components
│   │   ├── razorpay-button.tsx # Checkout component
│   │   └── landing-page.tsx    # Landing sections
│   ├── src/config/branding.ts  # Centralized branding
│   ├── src/contexts/           # Auth context provider
│   ├── middleware.ts          # Auth guard (/dashboard)
│   └── wrangler.jsonc          # Cloudflare config
│
├── server/                     # Hono.js API (Cloudflare Worker)
│   ├── src/routes/
│   │   ├── auth.ts             # OAuth + session management
│   │   ├── payment.ts          # Razorpay orders + webhooks
│   │   └── health.ts           # Health check + DB latency
│   ├── src/db/
│   │   ├── schema.ts           # Drizzle schema (4 tables)
│   │   └── tables/             # users, accounts, sessions, orders
│   ├── src/lib/
│   │   ├── crypto.ts           # HMAC session hashing
│   │   ├── logger.ts           # Structured JSON logging
│   │   └── origins.ts          # CORS origin parsing
│   └── wrangler.jsonc          # D1 + KV bindings

packages/
├── auth/                       # Google OAuth + PKCE
├── payments/                   # Razorpay SDK
├── http/                       # HMAC, encrypt/decrypt, fetch
├── types/                      # Shared TypeScript types
├── products/                   # Product catalog
└── api-endpoints/              # API route constants

.github/workflows/
├── ci.yml                      # Build, typecheck, lint, test
├── deploy.web.yml              # Auto-deploy frontend
└── deploy.server.yml           # Auto-deploy API

Developer experience

Three commands. You're live.

Install

Clone the repo and install all dependencies.

$ npm install

Develop

Start the dev server. Hot reload. Zero config.

$ npm run dev

Deploy

One command to Cloudflare. CI/CD handles the rest.

$ npm run deploy

Summary

Everything in the box.

Packages

API Endpoints

DB Tables

20+

Security Features

CI/CD Workflows

Documentation Files

Comparison

Free Core. Paid Pro. Or months from scratch.

Start with Core for free. Upgrade to Pro the moment you need to charge customers. Either way, you're starting miles ahead of a blank repo.

Feature	Core (Free)	Pro	Build from Scratch
Price	Free (MIT)	₹1,499 one-time	$10,000+ (your time)
Time to production	~1 day	Days	3–6 months
Google OAuth + PKCE	✓	✓	Build yourself
Session management	✓ HMAC-SHA256	✓	Build yourself
Encrypted token storage	✓ AES-256-GCM	✓	Build yourself
Razorpay payments + webhooks		✓	Build yourself
Product catalog		✓	Build yourself
DB tables	3 (users, accounts, sessions)	4 (+ orders)	Design yourself
Dashboard	Profile + security overview	Full settings, API keys, team mgmt	Build yourself
Lifetime updates	Community (GitHub)	✓ Every future release, forever	N/A
Support	Community (GitHub Issues)	Direct — email + docs	N/A
License	MIT — use for anything	Commercial, unlimited projects	N/A

Get Core Free

One purchase. Every future release.

Buy once. Get every fix and feature, forever.

This isn't a subscription. Pay ₹1,499 one time and your product key never expires — Next.js version bumps, new security hardening, bug fixes, and entirely new features all land in your dashboard at no extra cost. The changelog below moves fast; every one of those releases is already yours.

Changelog

Actively maintained.

v3.2.0Latest3 days ago

Upgraded to Next.js 16.2.9
Added Hono.js 4 backend
Google OAuth 2.0 + PKCE implementation
New dashboard with profile card

v3.1.02 weeks ago

Razorpay webhook integration
KV-backed rate limiting
Structured JSON logging
Bug fixes

v3.0.0Major1 month ago

Major rewrite: NX 23 monorepo
Cloudflare Workers deployment
Drizzle ORM + D1 migration
AES-256-GCM encryption

Roadmap

Coming soon — already included in your license.

Authentication v2 with MFA

Team management & RBAC

Notification system

CLI scaffolding tool

AI integration helpers

Multi-tenant support

FAQ

Questions? Answered.

Start free. SaaS LaunchKit Core is MIT-licensed and lives on GitHub — Google OAuth, sessions, encrypted tokens, and a dashboard, no purchase required. Clone it, run it, see the code quality for yourself. When you need payments, product catalogs, or a commercial license, upgrade to Pro.

Core covers authentication end to end. Pro adds everything needed to charge people: Razorpay orders and webhooks, a product catalog, an orders table, a fuller dashboard, direct support, and a commercial license for client work. See the full comparison table above.

Yes. Pro is built on the same auth foundation as Core, so moving from one to the other is additive, not a rewrite. Buy Pro whenever you're ready to add payments.

After purchase, a lifetime-valid product key appears on your dashboard. Use it to download the full source code — every version, every update, unlimited times. You get 6 shared packages, 9 API endpoints, 4 database tables, 20+ security features, 3 CI/CD workflows, and complete documentation. You own the code.

Yes. Your product key never expires. Every future release — framework upgrades, new features, security patches — appears in your dashboard alongside every past version, at no extra cost. This is a one-time payment, not a subscription.

Yes. The commercial license allows unlimited personal and client projects. Build and deploy as many SaaS products as you want. No royalties.

Months of architecture decisions, security hardening (PKCE, HMAC-SHA256, AES-256-GCM, rate limiting, CSP headers), payment integration (Razorpay with webhooks), and deployment configs — all pre-built and tested. You start at 80%, not 0%.

Full documentation included: Architecture.md (599 lines), SETUP.md (8-step guide), LICENSES.md, and EULA.md template. For additional support, book a discovery call or email adnan@adnanbuilds.online.

100%. Every file is yours. Modify the branding config, database schema, API routes, UI components, or deployment targets. No vendor lock-in.

Reviews

What builders are saying.

Reviews (0)

Loading reviews...