Auth is never just login
Sessions, password resets, email verification, two-factor, passkeys, API tokens, and rate limits all arrive together the moment you have paying users.
Products
The boring three months of a SaaS are already written.
Every subscription product needs the same foundation before it can charge anyone: sign-up, sessions, teams, roles, billing, transactional mail, a job queue, and somewhere for support to look things up. Stacks ships all of it, wired to the same models your product code uses.
What this always turns out to involve.
The work that arrives whether you planned for it or not.
Teams change every table
Retro-fitting an owning team onto a schema built for single users is the migration nobody enjoys. It is cheaper to have it from the start.
Billing leaks into everything
Plans gate features, invoices need storing, webhooks need to be idempotent, and dunning mail has to send itself.
Support needs a window
Without an admin surface, every refund and every "what did this account do" becomes a database console session.
What is already in the box.
All of it in the same install, typed against the rest of your application.
Accounts and teams
The useAuth trait adds the auth columns and passkeys; teams, invitations, and roles ship as first-party models with their own actions and routes.
Roles and gates
RBAC plus app/Gates.ts policies decide what a member of a team can do, checked the same way in a route, an action, and a view.
Billing
The billable trait puts customers, subscriptions, invoices, and payment methods on a model, with Stripe wired up and webhook handling included.
Lifecycle mail
Welcome, verification, receipt, and dunning mail are Mail classes rendered from STX templates and queued like any other job.
Admin dashboard
The built-in dashboard reads your models, so accounts, subscriptions, and jobs are browsable on day one without you building a back office.
Usage and limits
Rate limiting, feature flags, and queue-backed metering are configuration rather than a service you add later.
The layers it leans on.
Every one of these ships in the same install. Follow one to see what it covers.
From the command line.
Buddy scaffolds, runs, and ships this the same way it does the rest of the app.
buddy new my-saas
buddy migrate --auth
buddy dev
Next door to this.
Projects of this shape usually grow into one of these.