verifiedstack-lite — Next.js SaaS Template

SHA-256: 1fde6913763e26f260f6039a8714b70cd9302ccdb09374eea7125543ea62fb20

2026-10-03T07:22:59.226Z

<p align="center">
  <img src="apps/web/public/logo.svg" alt="VerifiedStack" width="88" height="88" />
</p>

<h1 align="center">VerifiedStack Lite</h1>

<p align="center">
  Production-grade auth &amp; organizations starter for Next.js —<br />
  passkeys, 2FA, OAuth, multi-tenant orgs with RBAC, transactional email. MIT.
</p>

<p align="center">
  <a href="https://demo.verifiedstack.app">Live demo</a> ·
  <a href="#quickstart">Quickstart</a> ·
  <a href="#lite-vs-core">Lite vs Core</a> ·
  <a href="https://verifiedstack.app/?ref=github&utm_source=github&utm_medium=lite-readme">Full kit</a>
</p>

<p align="center">
  <img src=".github/verification-flow.gif" alt="A user completing identity verification, with the decision landing in the dashboard" width="820" />
</p>

<p align="center">
  <sub>The identity-verification flow from <a href="https://verifiedstack.app/?ref=github&utm_source=github&utm_medium=lite-readme">VerifiedStack Core</a> — running on the auth &amp; organization foundation in this repo.</sub>
</p>

---

Lite is the open-source base of [VerifiedStack](https://verifiedstack.app/?ref=github&utm_source=github&utm_medium=lite-readme),
the KYC-ready SaaS starter. It's the complete auth and organization layer the
paid kit is built on — released whole, under MIT, because you should be able to
read real code before trusting a starter with your sign-in flow. No crippled
features, no login-to-download, no nag screens. What's here is finished.

## What's inside

- **Authentication ([Better-Auth](https://better-auth.com))** — email/password
  with verification emails, **passwordless sign-in** via emailed one-time
  codes, Google & GitHub OAuth (buttons appear only when keys are
  configured), **passkeys** (WebAuthn), **TOTP two-factor** with backup
  codes, Cloudflare Turnstile bot protection, and rate limiting.
- **Organizations** — multi-tenant orgs with invitations, role-based access
  (owner / admin / reviewer / member), an onboarding flow, and member
  management. Sessions land users in their active organization server-side.
- **Transactional email** — react-email templates behind a pluggable
  transport: Resend, any SMTP relay, or console logging in development. The
  app runs with zero email configuration.
- **Demo mode** — `DEMO_MODE=1` turns a deployment into a safe public
  sandbox: seeded accounts, one-click sign-in, frozen credentials on shared
  accounts, suppressed outbound email, nightly reset. It's exactly how
  [demo.verifiedstack.app](https://demo.verifiedstack.app) runs.
- **Stack** — Next.js 16 (App Router, RSC), TypeScript strict, Postgres +
  Drizzle ORM, Tailwind + shadcn/ui, pnpm workspaces. Ships as a monorepo
  with clean package seams (`auth`, `db`, `email`, `config`).

## Quickstart

Everything runs in Docker — no local Node required.

```bash
git clone https://github.com/verifiedstack/verifiedstack-lite
cd verifiedstack-lite
cp .env.example .env   # defaults work out of the box
docker compose up      # postgres → migrations → app on localhost:3000
```

For development with hot reload:

```bash
docker compose -f docker-compose.yml -f docker-compose.dev.yml up
```

Optional demo/dev data (one org, two accounts):

```bash
docker compose run --rm seed
```

Prefer local Node? `pnpm install`, point `DATABASE_URL` at a Postgres, then
`pnpm db:migrate && pnpm dev`.

## Going to production

- Set a real `BETTER_AUTH_SECRET` (`openssl rand -base64 32`) and your public
  `APP_URL`.
- Turn on `REQUIRE_EMAIL_VERIFICATION=1` and configure an email transport.
- Put a reverse proxy in front of the app container (it binds to localhost)
  and forward `x-real-ip`, or rate limiting will treat all traffic as one
  client.
- Vercel works too: import the repo, set the env vars, use a managed
  Postgres.

## Lite vs Core

Lite is a complete auth starter — and deliberately not more. The paid kit,
**VerifiedStack Core**, is this codebase plus the identity-verification layer
for teams shipping regulated products:

| | Lite (this repo) | [Core](https://verifiedstack.app/?ref=github&utm_source=github&utm_medium=lite-readme) |
| --- | :-: | :-: |
| Email/password, OAuth, passkeys, email codes, TOTP 2FA | ✅ | ✅ |
| Organizations, invites, RBAC | ✅ | ✅ |
| Transactional email (Resend / SMTP / console) | ✅ | ✅ |
| Demo mode | ✅ | ✅ |
| KYC pipeline — provider-agnostic, mock provider included, documents never touch your servers | — | ✅ |
| Manual review queue, operable by a compliance analyst | — | ✅ |
| Append-only audit trail | — | ✅ |
| Stripe billing: tiers + metered per-verification usage | — | ✅ |
| Data retention, DSAR export, consent capture | — | ✅ |
| Updates | free forever | 12 months, renewable |

## Contributing & support

This repo is assembled from our private monorepo by an exporter, so the code
here always matches a paid release's foundation. Issues are welcome and
triaged weekly. Bug-fix PRs are appreciated — they're applied upstream and
ship here with the next release, so your commit may land rebased. Feature
scope is deliberately tight: if it isn't auth, orgs, email, or demo mode, it
probably belongs in [a discussion](https://github.com/verifiedstack/verifiedstack-lite/discussions)
first.

## License

[MIT](LICENSE) — use it for anything, including commercial products.