[{"data":1,"prerenderedAt":1562},["ShallowReactive",2],{"blog-shipfast-login-auth-authorization":3,"related-shipfast-login-auth-authorization":359},{"id":4,"title":5,"author":6,"body":7,"category":6,"date":344,"description":345,"draft":346,"extension":347,"image":6,"meta":348,"navigation":349,"path":350,"seo":351,"stem":352,"tags":353,"__hash__":358},"blog\u002Fblog\u002Fshipfast-login-auth-authorization.md","ShipFast Login: Why Auth Isn't Your Real Problem",null,{"type":8,"value":9,"toc":327},"minimark",[10,14,19,22,30,33,37,45,56,74,77,105,109,112,115,118,127,131,138,145,152,156,159,162,165,169,172,210,214,223,226,230,233,242,245,249,281,285,288,292,301,305,318],[11,12,13],"p",{},"Search for \"shipfast login\" and you land in two different worlds: shipping companies with tracking dashboards, and startup boilerplates promising a login page out of the box. If you are a developer, you are almost certainly after the second one — the auth that comes bundled with a SaaS starter. But here is the thing nobody puts on the landing page: the login page is the easy part. What comes after it is where launches quietly die.",[15,16,18],"h2",{"id":17},"the-login-page-isnt-your-problem","The Login Page Isn't Your Problem",[11,20,21],{},"You can build a login form in an afternoon. Email field, password field, a button. Every boilerplate ships one, and they all look roughly the same. So why do developers still lose weeks to auth?",[11,23,24,25,29],{},"Because authentication — proving who someone is — is a solved problem. ",[26,27,28],"strong",{},"Authorization"," — deciding what that person is allowed to do, on every request, forever — is not. That is where the time goes. Session refresh, token expiry, per-row access rules, plan-gated features, revocation across devices. None of it shows up in a screenshot.",[11,31,32],{},"There is a false choice that traps a lot of builders here: roll your own auth (and inherit a security surface you will never fully test) or hand everything to a vendor and accept lock-in. The better answer is to lean on a provider for identity and keep authorization in a layer you control and understand. On a Nuxt + Supabase stack, that layer is the database itself.",[15,34,36],{"id":35},"row-level-security-as-your-real-auth-layer","Row-Level Security as Your Real Auth Layer",[11,38,39,40,44],{},"Row-level security (RLS) is the part people skip and the part that matters most. Instead of scattering ",[41,42,43],"code",{},"if (user.id === row.owner)"," checks across your application code, you write the rule once as a Postgres policy, and the database enforces it on every query.",[11,46,47,48,55],{},"That is a fundamentally different security posture than middleware-based auth. Middleware guards a route. RLS guards the data. If someone bypasses your route guard — and someone eventually will — a properly configured RLS policy still returns nothing. As the ",[49,50,54],"a",{"href":51,"rel":52},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fdatabase\u002Fpostgres\u002Frow-level-security",[53],"nofollow","Supabase docs on RLS"," put it, policies are the answer to \"which rows can this user see or change.\"",[11,57,58,59,63,64,67,68,73],{},"The right order is to set up RLS ",[60,61,62],"em",{},"before"," you build your first login page. Define your tables, write policies that scope every row to ",[41,65,66],{},"auth.uid()",", and test them with the anon key before any UI exists. We walk through this ordering in detail in ",[49,69,72],{"href":70,"rel":71},"https:\u002F\u002Fboiledplate.ai\u002Fblog\u002Fnuxt-supabase-stripe-saas-boilerplate",[53],"what it actually takes to wire up a Nuxt, Supabase and Stripe SaaS"," — auth is the fast part, RLS is the part you forget.",[11,75,76],{},"Common RLS mistakes that break in production:",[78,79,80,84,102],"ul",{},[81,82,83],"li",{},"Enabling RLS but forgetting to write a policy — the table now returns nothing to everyone, including you.",[81,85,86,87,90,91,94,95,94,98,101],{},"Writing a ",[41,88,89],{},"SELECT"," policy but no ",[41,92,93],{},"INSERT","\u002F",[41,96,97],{},"UPDATE",[41,99,100],{},"DELETE"," policy, so writes silently fail.",[81,103,104],{},"Using the service-role key on the client \"just to get it working,\" which bypasses RLS entirely.",[15,106,108],{"id":107},"building-login-that-survives-real-users","Building Login That Survives Real Users",[11,110,111],{},"Now the login page. Social login via Google sign-in removes password management from your plate and converts better, but you inherit an OAuth redirect flow that has to work in staging and production with different callback URLs. Email\u002Fpassword is fully under your control but means you own reset flows, verification, and rate limiting.",[11,113,114],{},"Magic links look elegant in a demo and fail in production more than people admit: corporate mail scanners pre-fetch the link and burn the token before the user clicks, links expire while the email sits in a queue, and users open them on a different device than the one they started on. Google sign-in plus a password fallback is the boring combination that survives real users.",[11,116,117],{},"Session management is where the real work hides. JWTs expire. Refresh tokens rotate. The cycle developers forget to test is the invisible refresh: a user leaves a tab open for an hour, the access token expires, and the next action either silently refreshes or dumps them back to login. Test that path explicitly — leave a session idle past expiry and confirm it recovers without a re-login.",[11,119,120,121,126],{},"And if you sell in the EU, signup is not just auth. You may need a GDPR consent step, and for one-time digital purchases a withdrawal-rights waiver. We covered encoding that into Stripe Checkout in ",[49,122,125],{"href":123,"rel":124},"https:\u002F\u002Fboiledplate.ai\u002Fblog\u002Fstripe-checkout-consent-collection-german-withdrawal-waiver",[53],"the German withdrawal waiver post"," — it is exactly the kind of plumbing that has nothing to do with a login form and everything to do with shipping legally.",[15,128,130],{"id":129},"private-routes-and-dashboard-access-control","Private Routes and Dashboard Access Control",[11,132,133,134,137],{},"The classic boilerplate pattern is a ",[41,135,136],{},"usePrivate"," composable that redirects unauthenticated visitors to the login page. It exists because you do not want to rewrite the same guard on every protected page.",[11,139,140,141,144],{},"But be clear about what that guard does. A client-side route guard is a ",[26,142,143],{},"user experience",", not a security boundary. It stops honest users from seeing a broken screen. It stops nothing else. Anyone can disable JavaScript, hit your API directly, or replay a request.",[11,146,147,148,151],{},"Real protection lives in two places: RLS on the data, and server-side validation on every protected API call. Your dashboard is usually the first private route you build, and the common pitfall is guarding the ",[60,149,150],{},"page"," while leaving its API endpoints open. Guard both, and let the database have the final word.",[15,153,155],{"id":154},"user-state-management-across-sessions","User State Management Across Sessions",[11,157,158],{},"Once someone is logged in, you have to hold their state without hammering the database on every render. The tradeoff is a local store (fast, but can drift from the truth) versus live Supabase queries (always correct, chattier).",[11,160,161],{},"Two problems bite here. First, rehydration on app load: if you wait for the session to resolve before rendering anything, users see a blank screen; if you render optimistically, you flash the wrong state. The fix is a resolved-but-loading auth state your components can read. Second, keeping the store in sync with database changes — subscribe to auth state changes so a logout in one place propagates everywhere.",[11,163,164],{},"Handle token expiry gracefully. The goal is an invisible refresh in the background, with a fall back to re-login only when the refresh token itself is dead.",[15,166,168],{"id":167},"account-management-features-behind-login","Account Management Features Behind Login",[11,170,171],{},"Login is the door. Everyone forgets the rooms behind it:",[78,173,174,180,192,198,204],{},[81,175,176,179],{},[26,177,178],{},"Profile pages"," where data ownership is enforced by RLS, not by a hidden form field.",[81,181,182,185,186,191],{},[26,183,184],{},"A billing dashboard"," showing subscription status and letting users update payment methods — best delegated to Stripe's customer portal rather than rebuilt. We cover this in ",[49,187,190],{"href":188,"rel":189},"https:\u002F\u002Fboiledplate.ai\u002Fblog\u002Fstripe-subscriptions-nuxt-supabase",[53],"how to set up Stripe subscriptions",".",[81,193,194,197],{},[26,195,196],{},"Email preferences"," where consent state is tied to the authenticated user.",[81,199,200,203],{},[26,201,202],{},"Team or org access"," if you grow past solo accounts — a whole second layer of authorization.",[81,205,206,209],{},[26,207,208],{},"Logout and session revocation across devices",", so a \"sign out everywhere\" button actually invalidates tokens.",[15,211,213],{"id":212},"moving-beyond-login-the-forgotten-plumbing","Moving Beyond Login: The Forgotten Plumbing",[11,215,216,217,222],{},"This is the work that never makes a feature list. Password reset flows need email delivery, expiring tokens, and rate limiting so nobody floods your inbox — there is a reason a starter ships a dedicated ",[49,218,221],{"href":219,"rel":220},"https:\u002F\u002Fboiledplate.ai\u002Freset-password",[53],"reset-password page",". Email verification has to be a deliberate decision: required for some products, friction for others.",[11,224,225],{},"Account deletion and data purging are GDPR obligations, not nice-to-haves. Detecting compromised sessions and forcing re-auth matters the moment you handle anything sensitive. And two-factor authentication is worth adding for high-value accounts — just know it complicates recovery, so plan the \"I lost my phone\" path before you ship it.",[15,227,229],{"id":228},"integration-patterns-auth-billing","Integration Patterns: Auth + Billing",[11,231,232],{},"Auth and billing are the same problem wearing two hats. A protected route should not just ask \"is this user logged in?\" but \"does this user's plan permit this?\" That means subscription status has to be readable at auth time, ideally as a column your RLS policies can check.",[11,234,235,236,241],{},"The rule that keeps this honest: Stripe webhooks are the source of truth for billing state, never the browser. We wrote a whole piece on why ",[49,237,240],{"href":238,"rel":239},"https:\u002F\u002Fboiledplate.ai\u002Fblog\u002Fstripe-webhooks-source-of-truth",[53],"your checkout success page should not touch your billing state"," — the tab-closed-before-redirect bug is one every first SaaS ships.",[11,243,244],{},"Cancellation is the tricky edge: you preserve the user's login but revoke their access at period end. Refunds and downgrades are the same shape — auth stays, entitlements change. Get this wrong and you either lock out paying customers or feed freeloaders.",[15,246,248],{"id":247},"auth-architecture-mistakes-and-how-to-avoid-them","Auth Architecture Mistakes (And How to Avoid Them)",[78,250,251,257,263,269,275],{},[81,252,253,256],{},[26,254,255],{},"Trusting client-side success responses"," instead of webhooks. The browser can lie, close, or crash.",[81,258,259,262],{},[26,260,261],{},"Storing secrets where agents and deploys can't reliably read them."," Keep service-role keys server-side and out of client bundles.",[81,264,265,268],{},[26,266,267],{},"Session tokens that live too long."," Short access tokens, rotating refresh tokens.",[81,270,271,274],{},[26,272,273],{},"Caching permissions without invalidation."," A cancelled user who keeps access for an hour is a bug.",[81,276,277,280],{},[26,278,279],{},"Not testing logout on every browser tab at once."," Open three tabs, log out in one, confirm the others react.",[15,282,284],{"id":283},"typescript-end-to-end-auth-type-safety","TypeScript End-to-End: Auth Type Safety",[11,286,287],{},"A typed stack catches auth bugs at compile time instead of in production. Type your user context once at the database boundary and let it flow through to components. Infer auth state in middleware so a route can't accidentally treat an anonymous visitor as a user. When your Supabase types are generated from the schema, RLS-adjacent shapes stay in sync with the tables they protect.",[15,289,291],{"id":290},"deploying-auth-without-breaking-it","Deploying Auth Without Breaking It",[11,293,294,295,300],{},"Production auth breaks in ways staging hides. Environment secrets have to be set correctly for the live domain. OAuth callback URLs and Stripe keys differ between staging and production — test both flows in a real staging environment before launch. Session persistence should survive a deploy, and zero-downtime updates should never log everyone out. A few of our own deploy-time footguns, like ",[49,296,299],{"href":297,"rel":298},"https:\u002F\u002Fboiledplate.ai\u002Fblog\u002Four-blog-canonically-pointed-at-localhost",[53],"a canonical URL pointing at localhost",", came from exactly this gap between local and production config.",[15,302,304],{"id":303},"the-agent-ready-auth-contract","The Agent-Ready Auth Contract",[11,306,307,308,311,312,317],{},"If a coding agent is going to extend your auth — and increasingly it is — it needs one documented way to do data access. That is what an ",[41,309,310],{},"AGENTS.md"," contract provides: conventions so an agent adds a feature without quietly bypassing RLS or inventing a second auth pattern. We make the case for ",[49,313,316],{"href":314,"rel":315},"https:\u002F\u002Fboiledplate.ai\u002Fblog\u002Fconventions-for-ai-coding-agents",[53],"writing conventions for the agent, not the next hire",". Then test agent-generated auth changes the same way you'd test your own: idle sessions, expired tokens, logout across tabs.",[11,319,320,321,326],{},"The login page was never the project. The plumbing behind it is. If you'd rather not rebuild all of it by hand, that is exactly the gap ",[49,322,325],{"href":323,"rel":324},"https:\u002F\u002Fboiledplate.ai",[53],"BoiledPlate"," was built to close — Supabase auth with RLS, Stripe billing, and the edge cases already wired.",{"title":328,"searchDepth":329,"depth":329,"links":330},"",3,[331,333,334,335,336,337,338,339,340,341,342,343],{"id":17,"depth":332,"text":18},2,{"id":35,"depth":332,"text":36},{"id":107,"depth":332,"text":108},{"id":129,"depth":332,"text":130},{"id":154,"depth":332,"text":155},{"id":167,"depth":332,"text":168},{"id":212,"depth":332,"text":213},{"id":228,"depth":332,"text":229},{"id":247,"depth":332,"text":248},{"id":283,"depth":332,"text":284},{"id":290,"depth":332,"text":291},{"id":303,"depth":332,"text":304},"2026-08-30","ShipFast login is easy. The real challenge is authorization. Learn why row-level security matters more than the login page itself.",false,"md",{},true,"\u002Fblog\u002Fshipfast-login-auth-authorization",{"title":5,"description":345},"blog\u002Fshipfast-login-auth-authorization",[354,355,356,357],"authentication","authorization","saas","row-level-security","q5KmhwMZ1iQoAFURDAopAIWNEUrSJO5P30lhja0A8ho",[360,750,1217],{"id":361,"title":362,"author":6,"body":363,"category":6,"date":738,"description":739,"draft":346,"extension":347,"image":6,"meta":740,"navigation":349,"path":741,"seo":742,"stem":743,"tags":744,"__hash__":749},"blog\u002Fblog\u002Fshipfast-saas-boilerplate-comparison.md","ShipFast vs BoiledPlate: SaaS Boilerplate Comparison",{"type":8,"value":364,"toc":719},[365,368,372,375,378,382,390,393,410,413,417,420,428,432,435,438,442,451,460,467,471,474,482,486,494,497,501,509,513,521,525,528,532,540,543,547,550,553,557,560,564,567,571,690,693,697,700,704],[11,366,367],{},"ShipFast made \"launch in days, not weeks\" a rallying cry, and for good reason: a Next.js boilerplate with auth, Stripe, and battle-tested UI components saves real time. But if you've actually shipped a SaaS, you know the template is the easy part. The weeks disappear in the wiring — webhook idempotency, RLS policies, refund flows, EU consent. This is where an AI-native starter changes the math. Here's an honest comparison of ShipFast against BoiledPlate, and why the plumbing is the whole game.",[15,369,371],{"id":370},"what-shipfast-does-and-what-it-doesnt","What ShipFast Does (And What It Doesn't)",[11,373,374],{},"ShipFast is a Next.js SaaS boilerplate. It ships authentication, Stripe payments, a UI component library, email scaffolding, and sensible defaults. It's popular because it's genuinely good at what it is: a code template you clone and customize.",[11,376,377],{},"What it doesn't do is provision anything. You still create your Stripe products, configure webhooks, verify signatures, design your database schema, write RLS policies, set up Google OAuth, and wire your environment variables by hand. ShipFast hands you the code. The infrastructure is your job. For teams comfortable with that setup overhead, that's a fair trade.",[15,379,381],{"id":380},"the-real-problem-with-manual-saas-setup","The Real Problem With Manual SaaS Setup",[11,383,384,385,389],{},"Choosing a stack takes an afternoon. Wiring four services into something trustworthy takes weeks. We know because we ",[49,386,388],{"href":70,"rel":387},[53],"logged every edge case it took"," to make ours reliable.",[11,391,392],{},"The list is longer than it looks:",[78,394,395,398,401,404,407],{},[81,396,397],{},"Stripe product creation, price objects, webhook endpoints, signature verification",[81,399,400],{},"Supabase schema design, migrations, and RLS policies that actually isolate tenants",[81,402,403],{},"Google OAuth setup, redirect URIs, token handling",[81,405,406],{},"Transactional email (Resend or SendGrid) that sends exactly once",[81,408,409],{},"Testing all of it before a real customer hits it",[11,411,412],{},"Most boilerplates, ShipFast included, leave you at the starting line of this list.",[15,414,416],{"id":415},"boiledplate-agent-driven-provisioning-not-just-code","BoiledPlate: Agent-Driven Provisioning, Not Just Code",[11,418,419],{},"BoiledPlate is an AI-native Nuxt + Supabase starter whose setup runs itself. Instead of handing you a template to customize, an AI coding agent interviews you — name, languages, theme, billing model — then reshapes the entire codebase with deterministic patches and provisions your services.",[11,421,422,423,427],{},"In a single session, your agent creates Stripe products and webhooks, stands up a Supabase database with row-level security, and configures Google sign-in. As the ",[49,424,426],{"href":323,"rel":425},[53],"homepage"," puts it: your coding agent doesn't just write the code — it provisions the services. That's the categorical difference from a code-only template.",[15,429,431],{"id":430},"nuxt-supabase-stripe-why-this-stack-works-together","Nuxt + Supabase + Stripe: Why This Stack Works Together",[11,433,434],{},"The stack is deliberate. Nuxt's server routes map cleanly onto webhook handlers. Supabase RLS enforces billing state at the database layer, not in fragile client-side logic. Stripe webhooks are the source of truth for subscription state. TypeScript strict mode runs end to end, so fewer surprises reach production.",[11,436,437],{},"Next.js, ShipFast's foundation, is excellent — but it tends to demand more glue code to reach the same guarantees, especially around server-side billing state.",[15,439,441],{"id":440},"idempotent-webhooks-the-plumbing-nobody-talks-about","Idempotent Webhooks: The Plumbing Nobody Talks About",[11,443,444,445,450],{},"Webhook delivery matters more than UI elegance, because a dropped or duplicated event corrupts billing state silently. Stripe ",[49,446,449],{"href":447,"rel":448},"https:\u002F\u002Fdocs.stripe.com\u002Fwebhooks#handle-duplicate-events",[53],"explicitly recommends"," handling duplicate events, because it will send them.",[11,452,453,454,459],{},"BoiledPlate's webhook handling is idempotent by design: repeated Stripe events don't double-apply side effects, signatures are verified to block replay attacks, and refund flows don't corrupt subscription state. We wrote about the harder version of this problem — ",[49,455,458],{"href":456,"rel":457},"https:\u002F\u002Fboiledplate.ai\u002Fblog\u002Fthe-github-invite-is-the-product-building-a-stripe-webhook-where-delivery-throws",[53],"a Stripe webhook where some failures must throw and some never should"," — because the difference between a retry and a permanent failure is where real bugs live.",[11,461,462,463,466],{},"A related principle: ",[49,464,240],{"href":238,"rel":465},[53],". The webhook is the source of truth. The success page is just a redirect.",[15,468,470],{"id":469},"row-level-security-database-enforced-billing","Row-Level Security: Database-Enforced Billing",[11,472,473],{},"Client-side permission checks are suggestions. RLS is enforcement. BoiledPlate enforces multi-tenant isolation at query time, so a query that would leak another tenant's data is simply impossible to write, not merely discouraged by middleware.",[11,475,476,477,481],{},"This also carries into compliance. EU rules around German withdrawal waivers and consent flows aren't optional if you sell there, and we encoded one directly into ",[49,478,480],{"href":123,"rel":479},[53],"Stripe Checkout's consent_collection",". Database-enforced billing plus correct consent is the unglamorous part that keeps you out of trouble.",[15,483,485],{"id":484},"agent-consistency-the-agentsmd-contract","Agent Consistency: The AGENTS.md Contract",[11,487,488,489,493],{},"Coding agents drift without conventions. Ask Claude the same question twice and you may get two different data-access patterns. BoiledPlate ships an AGENTS.md contract: one documented way to read secrets and access data, so agent output stays consistent. We argue you should ",[49,490,492],{"href":314,"rel":491},[53],"write your conventions for the agent, not the next hire"," — the agent reads them every session.",[11,495,496],{},"Deterministic patches make customization repeatable, and semantic, agent-readable release notes let your agent understand what changed. Updates are opt-in, applied to your customized code without a merge-hell rewrite.",[15,498,500],{"id":499},"billing-edge-cases-that-bite-you-later","Billing Edge Cases That Bite You Later",[11,502,503,504,508],{},"Subscriptions aren't binary. They transition: active, grace period, past due, canceled. Layer in refund idempotency, double-refund prevention, proration on mid-cycle plan changes, and failed-payment dunning retries, and you have a matrix that's easy to get wrong. Manual setup means debugging these at 2 AM after a customer complaint. BoiledPlate's ",[49,505,507],{"href":188,"rel":506},[53],"Stripe subscription setup"," handles these transitions as designed behavior, not afterthoughts.",[15,510,512],{"id":511},"transactional-email-and-seo-not-afterthoughts","Transactional Email and SEO: Not Afterthoughts",[11,514,515,516,520],{},"Email verification and receipts affect churn, so Resend is integrated, not bolted on later — including sending exactly once, which is harder than it sounds. On SEO, starter kits routinely ship broken defaults. We shipped one ourselves: ",[49,517,519],{"href":297,"rel":518},[53],"our blog told Google its canonical URL was localhost:3000",". BoiledPlate ships JSON-LD structured data, correct og:url canonicals, and a prerendered Markdown blog — correct by default, customizable after.",[15,522,524],{"id":523},"internationalization-from-day-one","Internationalization from Day One",[11,526,527],{},"Four languages ship out of the box. This matters because adding i18n later means refactoring every string, route, and email template. Retrofitting is the \"we'll translate later\" trap that never gets untrapped. Building on top of existing i18n is cheap; grafting it on afterward is not.",[15,529,531],{"id":530},"free-vs-paid-boiledplate-lite-vs-pro","Free vs. Paid: BoiledPlate Lite vs. Pro",[11,533,534,539],{},[49,535,538],{"href":536,"rel":537},"https:\u002F\u002Fboiledplate.ai\u002Fblog\u002Ffree-nuxt-supabase-saas-boilerplate",[53],"BoiledPlate Lite"," is free and MIT-licensed: the same Nuxt 4, Supabase, Stripe, and Resend app, minus the AI tooling. You clone it and wire it by hand — much like using ShipFast, but Vue-based instead of React.",[11,541,542],{},"Pro is €159 one-time, with lifetime updates and instant delivery via GitHub. It includes the agent-driven provisioning: the interview, the deterministic patches, the whole set-itself-up experience. Honestly: Lite is more work, Pro is instant. Pick Lite if you enjoy the wiring or want to inspect everything first; pick Pro if you'd rather ship product.",[15,544,546],{"id":545},"dashboard-theming-deployment-and-typescript","Dashboard Theming, Deployment, and TypeScript",[11,548,549],{},"Theming is part of the interview: pick a preset (Warm Studio, Clean SaaS, Midnight Pro, Sharp Enterprise) or describe your own colors in plain language, and the agent maps it onto the codebase. Deployment runs in minutes to Vercel, Netlify, or self-hosted — and because the agent interview handles environment variables and provisioning, the classic first-run friction (missing keys, misconfigured webhooks) largely disappears.",[11,551,552],{},"TypeScript strict mode is enforced, not optional. The cost is more upfront friction; the benefit is catching edge cases before production instead of after.",[15,554,556],{"id":555},"github-delivery-the-product-is-your-code","GitHub Delivery: The Product Is Your Code",[11,558,559],{},"When you buy Pro, you get a GitHub repo. That's the product. Your code, in your control, from day one — no locked-in SaaS platform, no managed builder holding your app hostage. This is the opposite of \"no-code\" platforms where you rent your product forever.",[15,561,563],{"id":562},"honest-gaps-and-trade-offs","Honest Gaps and Trade-Offs",[11,565,566],{},"BoiledPlate uses Nuxt, so if you're committed to Next.js or React, ShipFast is the better fit. Supabase is opinionated — no swapping in Firebase. Stripe is non-negotiable for the subscription logic. And it's not a visual builder; you're still coding. If you need a different payment processor or a fundamentally different stack, build from scratch.",[15,568,570],{"id":569},"comparison-at-a-glance","Comparison at a Glance",[572,573,574,592],"table",{},[575,576,577],"thead",{},[578,579,580,583,586,589],"tr",{},[581,582],"th",{},[581,584,585],{},"ShipFast",[581,587,588],{},"BoiledPlate Pro",[581,590,591],{},"Building alone",[593,594,595,610,623,636,649,662,676],"tbody",{},[578,596,597,601,604,607],{},[598,599,600],"td",{},"Framework",[598,602,603],{},"Next.js",[598,605,606],{},"Nuxt 4",[598,608,609],{},"Your choice",[578,611,612,615,618,621],{},[598,613,614],{},"Provisions services",[598,616,617],{},"No",[598,619,620],{},"Yes (agent)",[598,622,617],{},[578,624,625,628,631,633],{},[598,626,627],{},"Auth + RLS",[598,629,630],{},"Auth",[598,632,627],{},[598,634,635],{},"DIY",[578,637,638,641,644,647],{},[598,639,640],{},"Idempotent webhooks",[598,642,643],{},"Manual",[598,645,646],{},"Built-in",[598,648,635],{},[578,650,651,654,657,660],{},[598,652,653],{},"i18n",[598,655,656],{},"Add-on",[598,658,659],{},"4 languages",[598,661,635],{},[578,663,664,667,670,673],{},[598,665,666],{},"Delivery",[598,668,669],{},"Code template",[598,671,672],{},"GitHub repo",[598,674,675],{},"—",[578,677,678,681,684,687],{},[598,679,680],{},"Time to launch",[598,682,683],{},"Days",[598,685,686],{},"A session",[598,688,689],{},"Weeks+",[11,691,692],{},"Over 12 months, the cost of ownership isn't the license fee — it's the maintenance and update friction. Semantic release notes and opt-in patches keep that low.",[15,694,696],{"id":695},"who-should-pick-boiledplate-and-who-shouldnt","Who Should Pick BoiledPlate (And Who Shouldn't)",[11,698,699],{},"BoiledPlate is ideal for Nuxt-comfortable developers, teams using AI coding agents, and billing-heavy products where the webhook and RLS work would otherwise eat weeks. It's sized for teams of one to three, not enterprise procurement. Accept the trade-offs — Vue, Supabase, Stripe, no swaps — and it's a fast path. Reject them and ShipFast or a from-scratch build serves you better.",[15,701,703],{"id":702},"conclusion-plumbing-done-shipping-starts","Conclusion: Plumbing Done, Shipping Starts",[11,705,706,707,712,713,718],{},"The framework is not what slows you down. ShipFast is right that you can launch fast — but a code template still leaves the ",[49,708,711],{"href":709,"rel":710},"https:\u002F\u002Fboiledplate.ai\u002Fblog\u002Fhow-to-ship-saas-fast",[53],"plumbing as the project",". BoiledPlate automates that plumbing so you own the product, not the setup: one agent session provisions Stripe, Supabase with RLS, and Google sign-in, then hands you your code via GitHub. Skip the weeks of wiring and start shipping. Browse the ",[49,714,717],{"href":715,"rel":716},"https:\u002F\u002Fboiledplate.ai\u002Fblog",[53],"blog"," for the edge cases we hit so you don't have to.",{"title":328,"searchDepth":329,"depth":329,"links":720},[721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737],{"id":370,"depth":332,"text":371},{"id":380,"depth":332,"text":381},{"id":415,"depth":332,"text":416},{"id":430,"depth":332,"text":431},{"id":440,"depth":332,"text":441},{"id":469,"depth":332,"text":470},{"id":484,"depth":332,"text":485},{"id":499,"depth":332,"text":500},{"id":511,"depth":332,"text":512},{"id":523,"depth":332,"text":524},{"id":530,"depth":332,"text":531},{"id":545,"depth":332,"text":546},{"id":555,"depth":332,"text":556},{"id":562,"depth":332,"text":563},{"id":569,"depth":332,"text":570},{"id":695,"depth":332,"text":696},{"id":702,"depth":332,"text":703},"2026-09-07","Compare ShipFast and BoiledPlate SaaS templates. Learn which boilerplate handles auth, Stripe, and infrastructure best for your Next.js project.",{},"\u002Fblog\u002Fshipfast-saas-boilerplate-comparison",{"title":362,"description":739},"blog\u002Fshipfast-saas-boilerplate-comparison",[745,746,747,748],"shipfast","saas boilerplate","next.js","saas development","KhX3NSHLjAPepGO0fWifUvLcdlXA5piVm6wtgmZeFJk",{"id":751,"title":752,"author":6,"body":753,"category":6,"date":1206,"description":1207,"draft":346,"extension":347,"image":6,"meta":1208,"navigation":349,"path":1209,"seo":1210,"stem":1211,"tags":1212,"__hash__":1216},"blog\u002Fblog\u002Fshipfast-reviews-honest-comparison.md","ShipFast Reviews: Honest Comparison vs BoiledPlate",{"type":8,"value":754,"toc":1159},[755,758,762,765,769,772,777,780,784,787,791,798,802,811,815,818,822,825,829,837,841,845,853,857,860,864,873,877,880,884,888,891,895,902,906,909,913,917,924,928,931,935,943,947,951,960,964,967,971,977,981,984,988,992,1000,1004,1007,1011,1014,1018,1023,1028,1038,1044,1048,1054,1060,1066,1069,1073,1076,1080,1083,1087,1094,1098,1103,1112,1115,1119,1156],[11,756,757],{},"If you search \"shipfast reviews,\" you get a split screen. Product Hunt and TrustPilot praise the clean code and fast landing page. Reddit threads call it \"not worth $200\" and note you could copy the marketing components from Tailwind UI. Both are right, because they're measuring different things. This comparison ignores the marketing on either side and looks at what actually eats your launch weeks: the plumbing between services.",[15,759,761],{"id":760},"what-this-article-covers","What This Article Covers",[11,763,764],{},"We'll compare ShipFast and BoiledPlate on the work that survives contact with a real, paying product — webhooks, refunds, row-level security, EU consent — not on how fast you can put a hero section on a page. Full disclosure: this site runs on BoiledPlate. We'll be specific about where each tool wins.",[15,766,768],{"id":767},"the-shipfast-landscape","The ShipFast Landscape",[11,770,771],{},"ShipFast is a Next.js boilerplate that ships auth, Stripe, email, and a polished set of landing components. Reviews are genuinely positive on structure and speed. The recurring criticism is that you're paying mostly for UI you could assemble yourself.",[773,774,776],"h3",{"id":775},"landing-page-marketing-components","Landing Page & Marketing Components",[11,778,779],{},"Pre-built UI is table stakes now. Every serious starter ships a hero, pricing table, and testimonials block. It's nice, but it isn't the thing that decides whether you launch this month or next quarter.",[773,781,783],{"id":782},"code-quality-structure","Code Quality & Structure",[11,785,786],{},"Reviewers praise ShipFast's \"clear code.\" That matters right up until you need to change billing logic. Clear code you don't understand is still code you'll rewrite. The real test is what happens when you customize.",[773,788,790],{"id":789},"speed-to-launch-claims","Speed-to-Launch Claims",[11,792,793,794,797],{},"\"Ship in days\" usually means ship a ",[60,795,796],{},"landing page"," in days. Shipping a deployed product that takes money, verifies webhooks, and doesn't leak one user's data to another is a different measurement — and it's the one that matters.",[15,799,801],{"id":800},"the-plumbing-problem-shipfast-solves-and-doesnt","The Plumbing Problem ShipFast Solves (And Doesn't)",[11,803,804,805,810],{},"Starter kits earn their price by wiring the slowest pieces: auth and payments. That's real value. As we've ",[49,806,809],{"href":807,"rel":808},"https:\u002F\u002Fboiledplate.ai\u002Fblog\u002Fnuxt-saas-boilerplate-for-ai-agents",[53],"written before",", the parts were never the problem — bolting them to each other was what ate the weekends.",[773,812,814],{"id":813},"auth-payments-are-just-the-start","Auth & Payments Are Just the Start",[11,816,817],{},"Wiring Stripe Checkout is easy. Wiring a webhook that agrees with your database, handles retries idempotently, and processes refunds correctly is the actual project. Most reviews never test this because most demos never take a real payment.",[773,819,821],{"id":820},"where-most-starters-fall-short","Where Most Starters Fall Short",[11,823,824],{},"The gaps show up later: row-level security policies, multi-plan billing with upgrades and downgrades, and legal edge cases like EU withdrawal consent. These don't appear in a landing-page demo, so they don't appear in most reviews either.",[773,826,828],{"id":827},"boiledplates-angle-agent-driven-setup","BoiledPlate's Angle: Agent-Driven Setup",[11,830,831,832,836],{},"BoiledPlate's difference isn't more components — it's that ",[49,833,835],{"href":323,"rel":834},[53],"your coding agent provisions the services",". It interviews you (name, languages, theme, billing model), then applies deterministic patches to reshape the codebase and set up Stripe products, webhooks, a Supabase database with RLS, and Google sign-in in one session.",[15,838,840],{"id":839},"stack-comparison-tech-choices-matter","Stack Comparison: Tech Choices Matter",[773,842,844],{"id":843},"nextjs-vs-nuxt","Next.js vs. Nuxt",[11,846,847,848,852],{},"ShipFast is Next.js. BoiledPlate is Nuxt 4. Both are excellent. The honest truth from our ",[49,849,851],{"href":709,"rel":850},[53],"ship-fast breakdown",": the framework is not what slows you down. Pick the one you already know.",[773,854,856],{"id":855},"firebase-vs-supabase-postgres","Firebase vs. Supabase + Postgres",[11,858,859],{},"ShipFast commonly pairs with MongoDB\u002FSupabase options; BoiledPlate is Supabase-first. The distinction that matters is row-level security enforced at query time in Postgres, versus security rules bolted on at the application layer. RLS is baked in, not an afterthought.",[773,861,863],{"id":862},"stripe-integration-depth","Stripe Integration Depth",[11,865,866,867,872],{},"This is where boilerplates separate. Signature verification, idempotent handlers, and failure recovery are the difference between billing that works in a demo and billing that survives production. Stripe's own ",[49,868,871],{"href":869,"rel":870},"https:\u002F\u002Fdocs.stripe.com\u002Fapi\u002Fidempotent_requests",[53],"documentation on idempotent requests"," exists precisely because retries are the norm, not the exception.",[773,874,876],{"id":875},"email-resend-vs-sendgrid-vs-custom-smtp","Email: Resend vs. SendGrid vs. Custom SMTP",[11,878,879],{},"Sending an email is simple. Sending exactly one email, once, on a webhook that might fire twice, is not. BoiledPlate uses Resend for transactional email with that duplicate problem in mind.",[15,881,883],{"id":882},"the-real-cost-of-customization","The Real Cost of Customization",[773,885,887],{"id":886},"deterministic-patches-vs-manual-merge-hell","Deterministic Patches vs. Manual Merge Hell",[11,889,890],{},"Buy a boilerplate, customize it heavily, and the next update becomes a git conflict you dread. BoiledPlate ships semantic, agent-readable release notes and opt-in updates so you can pull new features without merge hell.",[773,892,894],{"id":893},"agentsmd-consistency-for-ai-coders","AGENTS.md: Consistency for AI Coders",[11,896,897,898,191],{},"Coding agents drift. Ask Claude to add a feature twice and you get two different data-access patterns. BoiledPlate ships an AGENTS.md contract documenting one way to do data access and secrets, so ",[49,899,901],{"href":314,"rel":900},[53],"agent output stays consistent",[773,903,905],{"id":904},"multi-language-support-from-day-one","Multi-language Support From Day One",[11,907,908],{},"i18n is a tax you pay forever if you bolt it on late. Four languages ship from day one, so you're not hunting the five places a new locale string has to land before the build stops complaining.",[15,910,912],{"id":911},"billing-edge-cases-nobody-mentions","Billing Edge Cases Nobody Mentions",[773,914,916],{"id":915},"eu-consent-laws-german-withdrawal-waivers","EU Consent Laws & German Withdrawal Waivers",[11,918,919,920,923],{},"Selling digital goods in the EU means handling withdrawal rights. German law, for example, requires an explicit waiver before instant delivery. BoiledPlate encodes this into ",[49,921,480],{"href":123,"rel":922},[53]," — and treats the webhook, not the success page, as the source of truth.",[773,925,927],{"id":926},"refund-workflows-subscription-state","Refund Workflows & Subscription State",[11,929,930],{},"Refunds and cancellations arrive as webhooks that can be delivered more than once. Idempotent handlers that update subscription state exactly once are what keep your database honest.",[773,932,934],{"id":933},"multi-plan-subscription-management","Multi-Plan Subscription Management",[11,936,937,938,942],{},"Downgrades, cancellations, grace periods, dunning — these are the five decisions behind real ",[49,939,941],{"href":188,"rel":940},[53],"Stripe subscriptions on Supabase",". A single-plan demo never has to answer them.",[15,944,946],{"id":945},"code-quality-red-flags","Code Quality Red Flags",[773,948,950],{"id":949},"json-ld-hydration-crashes","JSON-LD Hydration Crashes",[11,952,953,954,959],{},"Structured data that returns 200 from curl but 500 in Chrome is a real class of bug — we hit exactly that with a ",[49,955,958],{"href":956,"rel":957},"https:\u002F\u002Fboiledplate.ai\u002Fblog\u002Fthe-page-that-returned-200-on-the-server-and-500-in-the-browser-a-json-ld-tempor",[53],"JSON-LD source-order issue",". Ask whether a kit's SEO works in the browser, not just the server.",[773,961,963],{"id":962},"canonical-urls-ogurl-tags","Canonical URLs & og:url Tags",[11,965,966],{},"Prerendered Markdown blogs need correct canonicals. It's the kind of quiet bug that ships to production and silently costs you rankings.",[773,968,970],{"id":969},"peer-dependency-hell","Peer Dependency Hell",[11,972,973,974,191],{},"The Nuxt ecosystem and Supabase SDK versions can fight. A well-maintained kit pins and tests these so you don't spend a day on ",[41,975,976],{},"npm install",[773,978,980],{"id":979},"typescript-strictness","TypeScript Strictness",[11,982,983],{},"Loose types hide billing bugs. BoiledPlate is typed end to end in strict mode, so a mismatched Stripe payload fails at compile time, not at 2 a.m.",[15,985,987],{"id":986},"product-delivery-mechanics","Product Delivery Mechanics",[773,989,991],{"id":990},"github-invites-vs-clone-and-wire","GitHub Invites vs. Clone-and-Wire",[11,993,994,995,999],{},"BoiledPlate Pro delivers via instant GitHub invite — ",[49,996,998],{"href":456,"rel":997},[53],"the invite is literally the product",", triggered by a Stripe webhook where some failures must throw and some must never.",[773,1001,1003],{"id":1002},"webhook-driven-updates","Webhook-Driven Updates",[11,1005,1006],{},"Because delivery is version-controlled, new features arrive as opt-in updates rather than a fresh download you have to re-customize.",[773,1008,1010],{"id":1009},"licensing-commercial-use","Licensing & Commercial Use",[11,1012,1013],{},"BoiledPlate Lite is MIT-licensed and free. Pro is a one-time purchase with lifetime updates. Both are yours to ship commercially.",[15,1015,1017],{"id":1016},"pricing-reality-check","Pricing Reality Check",[11,1019,1020,1022],{},[26,1021,585],{},": one-time cost, fixed Next.js stack, clear billing.",[11,1024,1025,1027],{},[26,1026,588],{},": €159 one-time, lifetime updates, agent-provisioned services, instant GitHub delivery.",[11,1029,1030,1032,1033,1037],{},[26,1031,538],{},": free, MIT-licensed. ",[49,1034,1036],{"href":536,"rel":1035},[53],"Clone and wire it manually"," — no updates, no support.",[11,1039,1040,1043],{},[26,1041,1042],{},"Hidden costs both miss",": your time debugging Stripe webhooks, EU consent flows, and RLS policies. That's the real invoice, and no landing page pays it down.",[15,1045,1047],{"id":1046},"who-should-use-what","Who Should Use What",[11,1049,1050,1053],{},[26,1051,1052],{},"Choose ShipFast if"," you want a Next.js landing page plus basic Stripe fast and don't need billing complexity yet.",[11,1055,1056,1059],{},[26,1057,1058],{},"Choose BoiledPlate Lite if"," you're happy wiring Supabase and Stripe by hand, want MIT freedom, and treat learning as part of the goal.",[11,1061,1062,1065],{},[26,1063,1064],{},"Choose BoiledPlate Pro if"," you value agent-provisioned services, multi-plan billing, and not maintaining plumbing code — and you're fine on Nuxt + Supabase.",[11,1067,1068],{},"The real decision is framework lock-in versus stack compatibility, and setup speed versus customization safety.",[15,1070,1072],{"id":1071},"common-pitfalls-both-kits-cant-solve","Common Pitfalls Both Kits Can't Solve",[11,1074,1075],{},"No template writes your core features. Webhook debugging still takes time even with idempotent handlers. Boilerplate RLS policies get you started but you'll redesign them as your data model grows. And email deliverability — Resend, SendGrid, or SMTP — has failure modes no starter can eliminate. Starter kits end where product work begins.",[15,1077,1079],{"id":1078},"seo-production-readiness","SEO & Production Readiness",[11,1081,1082],{},"BoiledPlate ships JSON-LD, canonicals, and og:url out of the box, plus a prerendered Markdown blog. ShipFast focuses its SEO story on the landing page. The metrics that decide the outcome are bundle size, time-to-interactive, and deployment time — not how many components ship.",[15,1084,1086],{"id":1085},"the-agent-factor-why-it-matters-now","The Agent Factor: Why It Matters Now",[11,1088,1089,1090,1093],{},"Coding agents changed which part is slow. Writing the code got fast; keeping it consistent and correct across a real integration didn't. AGENTS.md contracts keep agents on-brand with your conventions, and deterministic patches let agents do what they're best at: repeatable, rule-based customization. When you evaluate any 2026 starter, ask whether it's built to work ",[60,1091,1092],{},"with"," Claude and Cursor — not around them.",[15,1095,1097],{"id":1096},"verdict-which-saves-you-the-most-time","Verdict: Which Saves You the Most Time?",[11,1099,1100,1102],{},[26,1101,585],{}," gets you to a visual MVP — landing page, basic auth, Stripe — in hours.",[11,1104,1105,1107,1108,1111],{},[26,1106,588],{}," gets you to a ",[60,1109,1110],{},"provisioned, billing-ready"," product: services wired, webhooks tested, RLS applied, in one setup session.",[11,1113,1114],{},"The honest answer: measure time-to-revenue, not time-to-landing-page. If your next step is a marketing page, ShipFast is fine. If it's live billing that survives EU law and duplicate webhooks, that's a different tool.",[15,1116,1118],{"id":1117},"what-to-do-right-now","What To Do Right Now",[78,1120,1121,1127,1138,1144],{},[81,1122,1123,1126],{},[26,1124,1125],{},"Comparing starters?"," Download both free versions, run the setup, and time your real deploy.",[81,1128,1129,1132,1133,1137],{},[26,1130,1131],{},"Care about webhook safety?"," Read up on why ",[49,1134,1136],{"href":238,"rel":1135},[53],"your success page shouldn't touch billing state"," before you pick anything.",[81,1139,1140,1143],{},[26,1141,1142],{},"Working with agents?"," Evaluate the AGENTS.md contract — lock-in through consistency beats lock-in through code.",[81,1145,1146,1149,1150,1155],{},[26,1147,1148],{},"Launching in the EU?"," Test your consent workflow before your first paying customer, not after your first complaint. The EU's ",[49,1151,1154],{"href":1152,"rel":1153},"https:\u002F\u002Feuropa.eu\u002Fyoureurope\u002Fcitizens\u002Fconsumers\u002Fshopping\u002Fguarantees-returns\u002Findex_en.htm",[53],"consumer withdrawal rules"," are not optional.",[11,1157,1158],{},"The stack was never the hard part. Choose the kit that pays down the plumbing.",{"title":328,"searchDepth":329,"depth":329,"links":1160},[1161,1162,1167,1172,1178,1183,1188,1194,1199,1200,1201,1202,1203,1204,1205],{"id":760,"depth":332,"text":761},{"id":767,"depth":332,"text":768,"children":1163},[1164,1165,1166],{"id":775,"depth":329,"text":776},{"id":782,"depth":329,"text":783},{"id":789,"depth":329,"text":790},{"id":800,"depth":332,"text":801,"children":1168},[1169,1170,1171],{"id":813,"depth":329,"text":814},{"id":820,"depth":329,"text":821},{"id":827,"depth":329,"text":828},{"id":839,"depth":332,"text":840,"children":1173},[1174,1175,1176,1177],{"id":843,"depth":329,"text":844},{"id":855,"depth":329,"text":856},{"id":862,"depth":329,"text":863},{"id":875,"depth":329,"text":876},{"id":882,"depth":332,"text":883,"children":1179},[1180,1181,1182],{"id":886,"depth":329,"text":887},{"id":893,"depth":329,"text":894},{"id":904,"depth":329,"text":905},{"id":911,"depth":332,"text":912,"children":1184},[1185,1186,1187],{"id":915,"depth":329,"text":916},{"id":926,"depth":329,"text":927},{"id":933,"depth":329,"text":934},{"id":945,"depth":332,"text":946,"children":1189},[1190,1191,1192,1193],{"id":949,"depth":329,"text":950},{"id":962,"depth":329,"text":963},{"id":969,"depth":329,"text":970},{"id":979,"depth":329,"text":980},{"id":986,"depth":332,"text":987,"children":1195},[1196,1197,1198],{"id":990,"depth":329,"text":991},{"id":1002,"depth":329,"text":1003},{"id":1009,"depth":329,"text":1010},{"id":1016,"depth":332,"text":1017},{"id":1046,"depth":332,"text":1047},{"id":1071,"depth":332,"text":1072},{"id":1078,"depth":332,"text":1079},{"id":1085,"depth":332,"text":1086},{"id":1096,"depth":332,"text":1097},{"id":1117,"depth":332,"text":1118},"2026-09-06","ShipFast reviews show strong UI, but we compare the real plumbing: webhooks, refunds, row-level security. See where each wins for your launch.",{},"\u002Fblog\u002Fshipfast-reviews-honest-comparison",{"title":752,"description":1207},"blog\u002Fshipfast-reviews-honest-comparison",[745,1213,1214,1215],"saas-boilerplate","product-launch","developer-tools","Q4PpgO8pPBa8LSQemFXLN2iC-oz1VDxk1hgcQZCBCo8",{"id":1218,"title":1219,"author":6,"body":1220,"category":6,"date":1552,"description":1553,"draft":346,"extension":347,"image":6,"meta":1554,"navigation":349,"path":1555,"seo":1556,"stem":1557,"tags":1558,"__hash__":1561},"blog\u002Fblog\u002Fshipfast-repo-free-comparison.md","ShipFast Repo Free: Real Comparison vs Paid Alternatives",{"type":8,"value":1221,"toc":1532},[1222,1225,1228,1232,1239,1242,1244,1255,1258,1262,1265,1279,1282,1286,1289,1301,1304,1308,1314,1317,1323,1327,1350,1354,1357,1365,1374,1378,1381,1392,1396,1403,1411,1415,1418,1426,1430,1448,1451,1455,1458,1462,1465,1469,1472,1476,1479,1483,1486,1503,1506,1510,1513,1517,1529],[11,1223,1224],{},"Search \"shipfast repo free\" and you'll find tutorials promising a production SaaS in five minutes, forks of forks with stale READMEs, and forum threads arguing about whether the original is even worth $129. Underneath the noise is a real question founders are trying to answer: can a free repo actually get me to a shipped product, or does \"free\" just mean I do the hard part myself?",[11,1226,1227],{},"This is an honest comparison. ShipFast and BoiledPlate are both boilerplates, but they solve different halves of the problem and target different stacks. Here's what each actually gives you — and where the gaps hide.",[15,1229,1231],{"id":1230},"why-this-matters","Why This Matters",[11,1233,1234,1235,191],{},"Picking a framework is the easy part. Next vs. Nuxt, Firebase vs. Supabase — you can settle that debate in an afternoon by choosing what you already know. The ",[49,1236,1238],{"href":709,"rel":1237},[53],"framework is not what slows you down",[11,1240,1241],{},"What slows you down is the wiring between services: Stripe webhooks that survive retries, row-level security that isn't an afterthought, refund flows, EU consent, transactional email that sends exactly once. Free repos exist, but \"free\" often means the boilerplate structure is done and the plumbing — the part that eats weeks — is left as an exercise for you. Most comparisons skip this entirely and compare landing pages.",[15,1243,768],{"id":767},[11,1245,1246,1247,1250,1251,1254],{},"ShipFast started as a Next.js template for indie makers and grew into an ecosystem. The original is a paid one-time license (around $129), and there are numerous free clones circulating on GitHub — ",[41,1248,1249],{},"krishna-praveen\u002Fshipfast-template-1",", ",[41,1252,1253],{},"vietanhdev\u002Fshipfast",", and others — each with varying maintenance and no guarantee the upstream stays alive.",[11,1256,1257],{},"The short answer to \"is there a free ShipFast repo\": yes, there are free forks. But they're community mirrors, not the maintained original, and the original itself is not free. The audience has also shifted — from solo indie hackers toward AI-powered teams shipping generative AI products.",[15,1259,1261],{"id":1260},"what-free-shipfast-clones-actually-give-you","What Free ShipFast Clones Actually Give You",[11,1263,1264],{},"A typical free clone hands you:",[78,1266,1267,1270,1273,1276],{},[81,1268,1269],{},"A React\u002FNext.js project structure",[81,1271,1272],{},"An authentication scaffold — but you wire Stripe webhooks yourself",[81,1274,1275],{},"A blog template and basic styling",[81,1277,1278],{},"Deploy instructions that get a dev server running",[11,1280,1281],{},"What they don't give you: service provisioning, email infrastructure, AI agent integration, or deterministic patching. The documentation usually assumes you already know the boring part — the integration work between services. That assumption is the whole game.",[15,1283,1285],{"id":1284},"the-hidden-cost-of-ship-in-5-minutes","The Hidden Cost of \"Ship in 5 Minutes\"",[11,1287,1288],{},"Five minutes gets you a local dev server. It does not get you production.",[11,1290,1291,1292,1295,1296,1300],{},"The gap between ",[41,1293,1294],{},"npm run dev"," and a live product that takes money is where the weeks go. As we've ",[49,1297,1299],{"href":70,"rel":1298},[53],"written about wiring a Nuxt + Supabase + Stripe stack",", each service demands real work: Supabase RLS, Stripe webhooks, Google OAuth, and email that doesn't double-send. Webhook idempotency and refund flows are almost never templated. Multi-currency, EU VAT consent, and subscription state management are left to you.",[11,1302,1303],{},"Those are exactly the parts that prevent revenue loss — and exactly the parts a \"5 minute\" clone skips.",[15,1305,1307],{"id":1306},"boiledplates-different-approach","BoiledPlate's Different Approach",[11,1309,1310,1313],{},[49,1311,325],{"href":323,"rel":1312},[53]," is a different bet on a different stack: Nuxt + Supabase + Stripe, not Next.js + Firebase + Stripe.",[11,1315,1316],{},"The bigger difference is setup. Instead of you adapting to the boilerplate, the boilerplate adapts to you. Your coding agent interviews you — name, languages, theme, billing model — then reshapes the codebase with deterministic patches. In a single session it provisions services: Stripe products and webhooks, a Supabase database with RLS, Google sign-in.",[11,1318,1319,1320,1322],{},"An ",[41,1321,310],{}," contract ships with it, documenting one consistent way to access data and secrets so coding agents don't drift. And because updates arrive as deterministic patches, your customizations survive framework upgrades instead of dying in a merge conflict.",[15,1324,1326],{"id":1325},"side-by-side-what-gets-shipped","Side-by-Side: What Gets Shipped",[78,1328,1329,1335,1344],{},[81,1330,1331,1334],{},[26,1332,1333],{},"Free ShipFast clone",": UI boilerplate, auth skeleton, deploy instructions. You wire the rest.",[81,1336,1337,1343],{},[26,1338,1339],{},[49,1340,1342],{"href":536,"rel":1341},[53],"BoiledPlate Lite (free, MIT)",": The same app as the paid version — Nuxt 4, Supabase, Stripe, Resend — with RLS configured, email wired, and i18n in place. You wire it up by hand.",[81,1345,1346,1349],{},[26,1347,1348],{},"BoiledPlate Pro (€159 one-time)",": All of the above plus agent-driven setup, instant delivery via GitHub, and lifetime updates.",[15,1351,1353],{"id":1352},"the-webhook-architecture-gap","The Webhook Architecture Gap",[11,1355,1356],{},"This is where free repos quietly betray you. Many include a Stripe webhook endpoint but no idempotency. Refund flows are hardcoded or missing.",[11,1358,1359,1360,1364],{},"That matters because Stripe retries. A retry loop hitting a non-idempotent handler can turn one subscription into five charge records — or five actual side effects. BoiledPlate's webhooks are signature-verified and idempotent, so repeated deliveries don't duplicate charges or drop refunds. We wrote up the real design trade-offs in ",[49,1361,1363],{"href":456,"rel":1362},[53],"a Stripe webhook where some failures throw and some never do",", because delivery semantics are the product, not a detail.",[11,1366,1367,1368,1373],{},"Stripe's own ",[49,1369,1372],{"href":1370,"rel":1371},"https:\u002F\u002Fdocs.stripe.com\u002Fwebhooks",[53],"webhook documentation"," is explicit that endpoints must be idempotent. Templates that ignore that are handing you a landmine.",[15,1375,1377],{"id":1376},"ai-agent-integration-the-silent-feature","AI Agent Integration: The Silent Feature",[11,1379,1380],{},"With a free repo, every change a coding agent suggests requires manual review — the agent has no map of your conventions, so it guesses.",[11,1382,1383,1384,1386,1387,1391],{},"BoiledPlate's ",[41,1385,310],{}," defines how agents read database conventions, handle secrets, and apply patches. That means an agent can update the codebase without destroying your customizations. It's the difference between ",[49,1388,1390],{"href":314,"rel":1389},[53],"writing conventions for the agent"," and hoping the agent behaves. Paid templates tend to lock you in; free ones leave you doing manual patching forever. A documented contract is the third path.",[15,1393,1395],{"id":1394},"billing-that-survives-reality","Billing That Survives Reality",[11,1397,1398,1399,191],{},"Most templates hardcode billing logic or skip the edge cases. BoiledPlate handles multi-plan subscriptions, proration, refunds, and consent laws — including things like a ",[49,1400,1402],{"href":123,"rel":1401},[53],"German withdrawal waiver encoded into the pay button",[11,1404,1405,1406,1410],{},"Supabase RLS prevents billing data from leaking across accounts, so you don't hand-roll row isolation. And Stripe webhooks are the ",[49,1407,1409],{"href":238,"rel":1408},[53],"source of truth for billing state"," — not the client-side success page a user might never reach.",[15,1412,1414],{"id":1413},"the-i18n-and-seo-difference","The i18n and SEO Difference",[11,1416,1417],{},"ShipFast clones ship English boilerplate; internationalization is an add-on project you scope later. BoiledPlate includes four languages from day one — not just translated strings, but routing.",[11,1419,1420,1421,1425],{},"On SEO, JSON-LD structured data and canonical URLs are handled, which sounds trivial until a malformed JSON-LD block ",[49,1422,1424],{"href":956,"rel":1423},[53],"returns 200 from curl and 500 in Chrome",". The blog is prerendered, not client-side rendered.",[15,1427,1429],{"id":1428},"open-source-vs-paid-the-real-trade-off","Open-Source vs. Paid: The Real Trade-Off",[78,1431,1432,1438,1443],{},[81,1433,1434,1437],{},[26,1435,1436],{},"Free ShipFast fork",": Learn by tinkering, maintain your own fork, deal with stale PRs and a possibly-vanishing upstream.",[81,1439,1440,1442],{},[26,1441,538],{},": Fork it, own it — but updates are manual merges.",[81,1444,1445,1447],{},[26,1446,588],{},": Instant GitHub delivery, deterministic updates, lifetime patches.",[11,1449,1450],{},"None of these are \"free forever\" if your time has value.",[15,1452,1454],{"id":1453},"when-free-repos-make-sense","When Free Repos Make Sense",[11,1456,1457],{},"Reach for a free clone when you're learning Next.js fundamentals, building a one-off where billing and scaling don't matter, working on a team with engineers dedicated to integration, or running a stack nothing like Nuxt + Supabase + Stripe. Match the repo to the stack you actually want to learn.",[15,1459,1461],{"id":1460},"when-boiledplate-pays-for-itself","When BoiledPlate Pays for Itself",[11,1463,1464],{},"BoiledPlate earns its keep when you're a founding team of one or two who need to ship fast and stay alive on billing, plan to iterate with Claude or other agents, are crossing borders (EU VAT, GDPR consent, multi-currency), want updates without merge conflicts, and are already comfortable with Supabase + Stripe.",[15,1466,1468],{"id":1467},"the-real-question-what-costs-more","The Real Question: What Costs More?",[11,1470,1471],{},"Three weeks of plumbing for a solo founder is €3,000–€6,000 in opportunity cost, easily. BoiledPlate Pro at €159 pays for itself if it ships you a month earlier. And a free repo plus two weeks of debugging that ends in \"I never launched\" is the most expensive option of all.",[15,1473,1475],{"id":1474},"stack-alignment-matters","Stack Alignment Matters",[11,1477,1478],{},"ShipFast lives in the Next.js\u002FReact\u002FFirebase world. BoiledPlate lives in the Nuxt\u002FVue\u002FSupabase world. Pick based on what your team already knows, not on marketing. Both are valid tools; the wrong stack choice costs more than either license.",[15,1480,1482],{"id":1481},"how-to-evaluate-for-your-situation","How to Evaluate for Your Situation",[11,1484,1485],{},"Ask yourself:",[78,1487,1488,1491,1494,1497,1500],{},[81,1489,1490],{},"Do you use Supabase, or are you willing to learn it?",[81,1492,1493],{},"Have you solved webhook idempotency before?",[81,1495,1496],{},"Do you want agent-driven setup or manual control?",[81,1498,1499],{},"Will you need post-launch updates without breaking customizations?",[81,1501,1502],{},"Is i18n a day-one requirement or a nice-to-have?",[11,1504,1505],{},"Your answers point clearly at one option or the other.",[15,1507,1509],{"id":1508},"the-honest-gaps-both-sides","The Honest Gaps (Both Sides)",[11,1511,1512],{},"BoiledPlate assumes Nuxt comfort — Next.js developers will struggle. Free ShipFast clones lack maintenance, and the original could change or disappear. Neither handles advanced needs like multi-tenancy, fine-grained permissions, or marketplace mechanics out of the box. And both require you to understand your stack, not escape it.",[15,1514,1516],{"id":1515},"what-to-do-next","What to Do Next",[11,1518,1519,1520,1524,1525,1528],{},"Clone a free ShipFast repo, spin it up locally, and note what breaks the moment you try to take real money. Then read ",[49,1521,1523],{"href":715,"rel":1522},[53],"BoiledPlate's blog"," to understand the integration philosophy and where the plumbing actually lives. Ask the one question that matters: ",[60,1526,1527],{},"will this still work when I need to pivot my billing model?"," That's the real test.",[11,1530,1531],{},"And budget time, not just money. Free plus your 100 hours was never cheap.",{"title":328,"searchDepth":329,"depth":329,"links":1533},[1534,1535,1536,1537,1538,1539,1540,1541,1542,1543,1544,1545,1546,1547,1548,1549,1550,1551],{"id":1230,"depth":332,"text":1231},{"id":767,"depth":332,"text":768},{"id":1260,"depth":332,"text":1261},{"id":1284,"depth":332,"text":1285},{"id":1306,"depth":332,"text":1307},{"id":1325,"depth":332,"text":1326},{"id":1352,"depth":332,"text":1353},{"id":1376,"depth":332,"text":1377},{"id":1394,"depth":332,"text":1395},{"id":1413,"depth":332,"text":1414},{"id":1428,"depth":332,"text":1429},{"id":1453,"depth":332,"text":1454},{"id":1460,"depth":332,"text":1461},{"id":1467,"depth":332,"text":1468},{"id":1474,"depth":332,"text":1475},{"id":1481,"depth":332,"text":1482},{"id":1508,"depth":332,"text":1509},{"id":1515,"depth":332,"text":1516},"2026-09-05","Compare free ShipFast repos with paid versions. Discover what's included, what's missing, and whether free boilerplates actually save you time.",{},"\u002Fblog\u002Fshipfast-repo-free-comparison",{"title":1219,"description":1553},"blog\u002Fshipfast-repo-free-comparison",[1213,745,1559,1560],"nextjs-template","startup-tools","Cm7S2UaRyIX991FkInVn7DNk5qWK4lHDovHuVSSS1Wo",1788742314800]