Ship your SaaS this weekend,
not next quarter.
Auth + billing + admin + OG images + PWA. Pre-wired Next.js 15 + Supabase + Lemon Squeezy. Drop it in, change 5 env vars, deploy.
14-day refund · MIT-style license · Updates included
Everything you need to take the first payment.
Auth
Supabase email/password auth with SSR cookies, confirmation callback, and reusable clients.
Billing
Lemon Squeezy checkout, signature-verified webhook, and is_pro flag — no Stripe required.
Admin
Email allowlist, dashboard endpoints, service-role separation, RLS examples.
OG Images
Edge runtime, route segments not query params, Satori gotchas worked around.
PWA
Manifest, service worker, installable shell, and safe-area-ready viewport metadata.
Toasts & Modals
Production-tested patterns. SSR-safe. Theme-aware.
Analytics
Vercel Analytics mounted with a typed custom-event helper.
Sentry
Optional client, server, and edge configuration with signed-in user context.
Reviews coming soon.
Forge Stack is in early launch — first reviews expected after the first paying customers. Want to be among them? Buy a license, build with it for a week, and email your honest take.
See it in production.
Not a tutorial repo. FitForge runs on this exact stack.
fitforgehq.com — the public-facing SaaS this stack powers
Drop it in. Ship.
Production-tested patterns you'll actually use on day one.
import crypto from 'node:crypto';
import { createClient } from '@supabase/supabase-js';
export async function POST(req: Request) {
const signingSecret = process.env.LEMONSQUEEZY_WEBHOOK_SECRET!;
const sig = req.headers.get('x-signature');
if (!sig) return new Response('no signature', { status: 400 });
const raw = await req.text();
const expected = crypto
.createHmac('sha256', signingSecret)
.update(raw).digest('hex');
if (!crypto.timingSafeEqual(
Buffer.from(sig.toLowerCase()),
Buffer.from(expected)
)) return new Response('mismatch', { status: 400 });
const { meta: { event_name }, data } = JSON.parse(raw);
// Verified — write to Supabase, grant product access, etc.
const supabase = createClient(
process.env.NEXT_PUBLIC_SUPABASE_URL!,
process.env.SUPABASE_SERVICE_ROLE_KEY!
);
await supabase.from('lemon_events').insert({
event_name, object_id: data.id, received_at: new Date().toISOString(),
});
return Response.json({ received: true, event: event_name });
}HMAC signature-verified Lemon Squeezy webhook. No Stripe, no SDK — just crypto and a Supabase insert.
Forge Stack is the same stack FitForge runs on.
Pick your tier.
Indie
- ✓1 commercial product
- ✓<$50K revenue
- ✓Email support
- ✓1 year of updates
Agency
- ✓White-label rights
- ✓Resell to clients
- ✓Direct Slack channel
- ✓Lifetime updates
All tiers include the full source code. 14-day refund, no questions asked.
Common questions.
What's the actual license?
MIT-style with a tier clause: Personal is non-commercial. Indie allows 1 commercial product. Team allows unlimited under $500K revenue. Agency allows white-label resale. See LICENSE.md in the repo for full text.
Will it work with my Supabase project?
Yes. Run the included migrations, set your env vars, deploy. Schema is intentionally minimal — you add your own tables for your product.
Do you provide support?
Yes. Email support is included. Higher tiers receive priority response times; support covers the starter itself, not custom app development.
What if I want a refund?
14 days, full refund, no questions. Just email me.
Will you keep updating it?
Yes. Next.js 15, Supabase SSR, Lemon Squeezy are all current as of July 2026. I push updates monthly.
Can I see it before buying?
The demo page links to FitForge, the production app that supplied the patterns, and includes live links for the starter login, signup, pricing, legal pages, and generated OG image.