Built-in email and Microsoft SSO authentication, including OAuth callback and magic link login in the development environment
Next.jsReactStarter
nextjs-supabase-starter — Next.js Starter Template
By levyan76
A full-stack starter template based on Next.js 16 and Supabase. The README states it includes built-in authentication, RLS role permissions, i18n, rate limiting, feature flags, testing, CI, and Docker configuration.
Explore the design
Compare the page layouts and mobile experience. Open any screenshot for a closer look.
Desktop homepage1 / 2
Desktop captureTop of page
Actual screenshot captured by the server browser.
All pages & views 2
Screenshots show visual appearance; interactive behavior may differ.
Recorded 2026-10-14View source
What stands out
A quick read of the recorded project description.
Role-based access control via RLS and JWT app_metadata, which the README states cannot be forged by the client
FR/EN routing and language switching provided by next-intl, including common translation keys
Sliding window rate limiting, with in-memory fallback and support for connecting to Upstash
Includes 67 Vitest unit tests and Playwright E2E tests, as well as a GitHub Actions CI workflow
Provides multi-stage Docker builds, non-root user, and standalone output configuration
Template Details
This template is aimed at developers who need to quickly set up a Next.js + Supabase application with a backend. The README describes it as including email and Microsoft SSO login, role-based access control via RLS and JWT app_metadata, FR/EN next-intl routing, sliding window rate limiting, structured logging, database-driven feature flags, as well as 67 Vitest unit tests and Playwright E2E tests. The project also provides GitHub Actions CI, multi-stage Docker builds, Husky and lint-staged pre-commit hooks, Dependabot configuration, and security response headers.
The quick start steps given in the README include: clone the repository, copy .env.local.example and fill in the Supabase URL and keys, run npm install, start local Supabase with npx supabase start and db reset to apply migrations and seed data, run npm run dev, and finally visit /setup to create the first administrator. You can also use the new-app script under scripts to copy the template.
The README does not state the template's actual runtime performance, production deployment details, or backend integration methods other than Supabase; these must be based on the actual repository code.
Next.jsReactStarter
Is it right for your project?
Use Cases
- Need to quickly start a Next.js + Supabase backend application with authentication and role permissions
- Want to build a multilingual site starting from FR/EN bilingual routing
- Need to directly use infrastructure such as rate limiting, structured logging, and database feature flags in the project
- Want to refer to a full-stack project structure that includes unit tests, E2E tests, and CI configuration
Suitable For
- Developers familiar with Next.js App Router and Supabase
- Teams needing customizable authentication and permission starter code
- Engineering teams wanting to use Docker and CI workflows as a project starting point
Getting started & customization
Use these recorded setup notes alongside the repository instructions for your chosen version.
- 1
After cloning the repository, copy .env.local.example to .env.local and fill in at least NEXT_PUBLIC_APP_NAME and the Supabase URL and keys
- 2
Run npm install to install dependencies
- 3
Running Supabase locally requires Docker; use npx supabase start and npx supabase db reset to apply migrations and seed data
- 4
Run npm run dev to start the development server, default port 3000
- 5
Visit /setup for the first time to create an administrator; this endpoint is only available before the first administrator is created
License & source material
Usage conditions & limitations
Free to use · keep license noticeThis entry covers the free version under the MIT license in the public repository; the free scope is the code of this version and does not mean external services or third-party assets are free.
Must comply with when using
- Free use, modification, commercial use, and distribution of this version's code are permitted.
- When distributing copies or substantial portions of the code, retain the original author's copyright notice and the full MIT license notice.
- The code is provided as is; warranties and limitations of liability are governed by the original license and applicable law.
Additional costs & items to verify
- Demo images, fonts, icons, and other third-party assets must be checked against their respective licenses and cannot be judged solely by the code's MIT license.
- External services such as domains, hosting, databases, payments, or AI may incur additional charges.
- Running Supabase locally requires a Docker environment; without Docker installed, the local database cannot be started following the README steps.
- Before use, .env.local must be configured, filling in at least NEXT_PUBLIC_APP_NAME and the Supabase URL and keys.
- Authentication features include Microsoft SSO; using this login method depends on Microsoft's OAuth service.
- Rate limiting uses an in-memory fallback by default; connecting to Upstash in production requires additional configuration of an external service.
View Original Text Basis
Permission is hereby granted, free of charge
Original License Text
# 4. Start Supabase locally (requires Docker)
Original README
# Edit .env.local — at minimum: NEXT_PUBLIC_APP_NAME, Supabase URL + keys
Original README
| 🔐 Auth (email + Microsoft SSO) | + OAuth callback, magic link logging in dev |
Original README
https://github.com/levyan76/nextjs-supabase-starter/blob/main/LICENSEhttps://github.com/levyan76/nextjs-supabase-starter/blob/main/README.md| 🚦 Rate limiting | Sliding window, in-memory fallback, Upstash-ready |
Original README
Compiled by DeepSeek based on repository license and README ·2026-10-14. Results only cover the materials read; dependencies, images, fonts, and subsequent term changes are subject to their respective original texts.
Project checks & description sources
Template Information
- Source platforms
- GitHub
- Documentation and maintenance reference score
- More documented · 85 / 100
- Technologies
- Next.js · React
- Website type
- Starter
How this score is calculated
Our heuristic uses license records (up to 30), a demo link (12), a preview (10), stars (15), recorded maintenance (15), description completeness (8), feature records (5) and classification data (5). It is not a code, security or performance test, or a Google score. A link does not establish tested functionality.
What to verify for this project
- Repository update recorded
- 2026-07-20
- Screenshot last checked
- 2026-10-14
A demo link is listed. Check it with your own content and viewport sizes; its presence does not confirm that forms, authentication or payments work.
The catalog identifies Next.js as the primary stack. Check the actual dependency manifest and lockfile for versions and hosting requirements. These notes use recorded metadata, not a code audit or a deployment test.
Use a selection guide →How this description was prepared
AI-assisted description based on catalog records and repository material. Repository authors are not automatically the reviewers of this description.
Review declaration: codex-user-requested-batch-review-20261015 · 2026-10-15
Inspect the recorded source material
SHA-256: 05250ec3389cb780d3ca6dcf501d1805af573c313bb6b547226fb7a6d3b08b1f
2026-10-14T20:27:14.512Z
Source file / repository<div align="center">
# nextjs-supabase-starter
**Production-grade Next.js 16 + Supabase starter** — auth, RLS, i18n, rate limiting, feature flags, tests, CI, Docker. Ready to ship.
[](https://github.com/levyan76/nextjs-supabase-starter/actions/workflows/ci.yml)
[](LICENSE)
[](https://nextjs.org)
[](https://react.dev)
[](https://supabase.com)
[](https://www.typescriptlang.org)
[](https://tailwindcss.com)
[English](./README.md) · [Français](./README.fr.md)
</div>
---
## Why this starter
Most "Next.js + Supabase" boilerplates give you auth and stop there. This one ships with the boring-but-critical plumbing every real app needs — so you can focus on what makes yours different.
| You get on day 1 | Without writing it yourself |
| ------------------------------- | -------------------------------------------------------- |
| 🔐 Auth (email + Microsoft SSO) | + OAuth callback, magic link logging in dev |
| 👮 Role-based access | RLS + JWT `app_metadata`, non-spoofable client-side |
| 🌍 i18n routing (FR/EN) | `next-intl`, locale switcher, all generic keys included |
| 🚦 Rate limiting | Sliding window, in-memory fallback, Upstash-ready |
| 📊 Structured logging | JSON in prod, colored in dev, named events |
| 🚩 Feature flags | DB-backed, React hook, no redeploy needed |
| 🧪 67 unit tests + E2E | Vitest + Playwright, all green |
| 🛡️ Security headers | CSP env-aware, HSTS, X-Frame-Options, Permissions-Policy |
| 🤖 CI/CD | GitHub Actions: lint + typecheck + test + build + E2E |
| 📦 Docker | Multi-stage, non-root user, standalone output |
| 🧹 Pre-commit hooks | Husky + lint-staged (eslint --fix + prettier) |
| 📈 Dependabot | Weekly grouped bumps, ignore Next/React majors |
---
## Quick start
```bash
# 1. Clone
git clone https://github.com/levyan76/nextjs-supabase-starter.git my-app
cd my-app
rm -rf .git && git init -b main
# 2. Configure
cp .env.local.example .env.local
# Edit .env.local — at minimum: NEXT_PUBLIC_APP_NAME, Supabase URL + keys
# 3. Install
npm install
# 4. Start Supabase locally (requires Docker)
npx supabase start
npx supabase db reset # applies migrations + seed
# 5. Run
npm run dev # → http://localhost:3000
# 6. Set up the first admin
# Visit http://localhost:3000/setup
```
### Or use the scaffold script
```powershell
# Windows
.\scripts\new-app.ps1 -AppName "my-app" -Port 3001
```
```bash
# Linux / macOS
./scripts/new-app.sh my-app 3001
```
The script copies the template into a sibling folder, renames `package.json`, configures the port, fills `.env.local`, and creates a clean git init.
---
## Architecture
```
app/ # Next.js App Router
├── [locale]/
│ ├── (auth)/ # login, callback, setup
│ └── (dashboard)/ # admin/, client/, profile/, settings/
└── api/setup/route.ts # First-admin creation endpoint
components/
├── dashboard/ # layout, header, sidebar
└── ui/ # 32 shadcn/ui components
lib/
├── auth/roles.ts # ROLES, PERMISSIONS, isAdmin, canAccess
├── server/
│ ├── auth.ts # requireUser, requireAdminRole
│ ├── action-response.ts # ActionResponse<T>, withActionResponse
│ ├── rate-limit.ts # Sliding window (memory or Upstash)
│ ├── logger.ts # Structured JSON / colored dev logs
│ └── feature-flags.ts # isEnabled(key)
├── supabase/{client,server,types}.ts
├── i18n/{routing,request}.ts
├── pdf/ # @react-pdf/renderer document base
└── validations/ # zod schemas
middleware.ts # Rate limit → i18n → auth → admin guard
supabase/
├── migrations/ # 5 migrations (profiles, audit, flags, JWT refresh)
└── seed.sql # Dev users + flags
tests/
├── unit/ # 67 Vitest tests
└── e2e/ # Playwright (auth + home)
```
---
## Stack
| Layer | Choice |
| ------------- | -------------------------------------------------- |
| Framework | Next.js 16 (App Router, Server Actions) |
| Runtime | React 19.2 |
| Styles | Tailwind 4 + shadcn/ui + `tw-animate-css` |
| UI primitives | Radix UI (individual `@radix-ui/react-*` packages) |
| Auth + DB | Supabase (`@supabase/ssr` + `supabase-js`) |
| i18n | next-intl 4 (FR/EN) |
| Forms | react-hook-form 7 + zod 4 |
| Data | TanStack Query 5 |
| PDF | @react-pdf/renderer 4 |
| Charts | recharts 3 |
| Drag & drop | @dnd-kit |
| Canvas | Konva 10 |
| CSV | papaparse + json2csv |
| Tests | Vitest 4 + Playwright 1.60 |
| Lint / Format | ESLint 9 + Prettier 3 |
| Container | Docker multi-stage (node 22-alpine) |
---
## Security
| Control | Status |
| ---------------------------------------------------------- | ----------------- |
| RLS on all tables | ✅ |
| JWT `role` synced server-side via Postgres trigger | ✅ non-spoofable |
| `.env.local` git-ignored | ✅ |
| Service-role key server-only | ✅ |
| CSP env-aware | ✅ strict in prod |
| HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy | ✅ |
| Rate limiting per IP + per route | ✅ |
| Open redirect prevention (`?redirect=`) | ✅ |
| Password policy (min 8, upper, digit, special) | ✅ |
| `/setup` idempotent (blocked after first admin) | ✅ |
If you find a vulnerability, please email [[email protected]](mailto:[email protected]) — don't open a public issue.
---
## Scripts
```bash
npm run dev # dev server on port 3000
npm run build # production build
npm run typecheck # tsc --noEmit
npm run lint # eslint .
npm run format # prettier --write
npm test # Vitest (one-shot)
npm run test:watch # Vitest watch mode
npm run test:coverage # HTML coverage report
npm run test:e2e # Playwright (headless)
npm run test:e2e:ui # Playwright UI mode
npm run generate:schema # regen Supabase types
npm run supabase:reset # reapply migrations + seed
```
---
## Customizing for your app
1. **Brand** → `.env.local`: `NEXT_PUBLIC_APP_NAME`, `NEXT_PUBLIC_LOGO_PATH`, `NEXT_PUBLIC_BRAND_PRIMARY`
2. **Domain tables** → new migration `supabase/migrations/000XX_<feature>.sql`
3. **Navigation** → add items in `components/dashboard/sidebar/sidebar.tsx`
4. **Pages** → new routes under `app/[locale]/(dashboard)/`
5. **Server actions** → use the `withActionResponse()` pattern from `lib/server/action-response.ts`
6. **Feature flags** → `INSERT INTO feature_flags (key, enabled, description) VALUES (...)`
7. **i18n** → add keys to `messages/en.json` and `messages/fr.json`
8. **Roles** → extend `PERMISSIONS` in `lib/auth/roles.ts`
---
## Contributing
See [CONTRIBUTING.md](./CONTRIBUTING.md) — short workflow + standards.
## License
MIT © Yan Levasseur. See [LICENSE](./LICENSE).
Explore similar templates
Compare previews and descriptions within the same stack and category.
Next.js SaaS Starter
The official Next.js SaaS starter template, integrating email/password authentication, Stripe Checkout subscriptions, a dashboard with user/team CRUD, basic Owner/Member RBAC, and activity logging.
Next.js · SaaS
Next.js Commerce
Vercel's officially maintained Next.js App Router ecommerce starter with deep Shopify integration, offering a complete product catalog, cart, and checkout flow. Core logic is modular for swapping backends, and community provider versions exist for BigCommerce, Medusa, and Saleor.
Next.js · E-commerce
Next-js-Boilerplate
A developer-first Next.js 16 starter with Tailwind CSS 4 and TypeScript, supporting both App Router and Page Router.
Next.js · Starter
tailwind-nextjs-starter-blog
A Next.js and Tailwind CSS blog starter template using Contentlayer for Markdown/MDX, with built-in SEO, code highlighting, and tags. It targets personal technical blogs and migration from Jekyll/Hugo to React, and supports one-click Vercel deployment.
Next.js · Blog
next-forge
next-forge is a Turborepo-based Next.js template maintained by Vercel, positioned as a starting point for SaaS products.
Next.js · Starter
SaaS-Boilerplate
SaaS-Boilerplate is an open-source SaaS starter template built with Next.js App Router, React 19, TypeScript, Tailwind CSS, and Shadcn UI.
Next.js · SaaS