Skip to content
Aback Stack

Next.js 16 · Cloudflare Workers · D1

Ship your SaaS in days, not months

Aback Stack is the Next.js boilerplate with sign in, payments, email, a database and a dashboard already wired, tested and documented. Start at your product idea, not at the setup checklist.

Read the docs first
  • Pay once, every update included
  • Unlimited products, commercial licence
  • Every guide is public, read it before you buy

Built by Devvrat Hans to launch the Aback Group products. This site is built from it.

  • Next.js 16App Router, React 19, strict TypeScript
  • Cloudflare WorkersOpenNext, Cron Triggers, edge cache
  • D1Migrations, repositories, an in memory twin
  • PaymentsDodo Payments, Lemon Squeezy, Stripe
  • EmailResend, Postmark, SendGrid
  • Sign inPassword, email link, Google, GitHub, Microsoft

bun run verify

tests in the suite
1,400+
payment, email and sign in providers
9
interface components
38
variables needed to run it locally
0

// 01The problem

Every SaaS starts with the same plumbing

None of it is your product, and all of it has to work before anyone can pay you. It is the part that takes the longest to get right and the part users only notice when it breaks.

Building it yourself

  • Sessions that rotate on use and end on sign out
  • Sign in with a password, an email link, Google, GitHub and Microsoft
  • Checkout, a customer portal and signed, idempotent webhooks
  • Plans and entitlements checked on the server
  • Verification and password recovery emails that are delivered
  • Rate limits and bot protection on every public form
  • A database schema, migrations and a test double
  • Account deletion that erases every record
  • A sitemap, structured data and a social card per page
  • Dark mode, a component library and seven languages
  • Lint, type check, tests and a production build in one command

= the weeks before your first feature

With Aback Stack

terminal
bun installbun run verifylint, types, tests and build passedbun run devReady on http://localhost:3000

Every item on the left already works, with tests around it. The first thing you write is the part that is yours.

// 02What is inside

Everything wired, tested and documented

Each area is a working path with tests, not a folder of empty files. Pick a tab to see what you get and the code that does it.

Accounts people expect, sessions you can trust

  • Password sign in, single use email links and Google, GitHub or Microsoft OAuth.
  • Server side sessions in an httpOnly cookie, rotated on use and revoked on sign out.
  • Email verification, password recovery and self service account deletion.
  • An OAuth button only appears when its provider is fully configured.

Google, GitHub, Microsoft, credentials and email links

.env.local
# Offer the providers you configuredAUTH_PROVIDERS=google,githubGOOGLE_CLIENT_ID=...GITHUB_CLIENT_ID=...

Subscriptions and one-time sales behind one contract

  • Hosted checkout, the customer portal and plan changes.
  • Webhook signatures verified, events applied once and in order.
  • Access is written from a verified webhook, never from a redirect.
  • Switch vendors with one environment variable, not a refactor.

Dodo Payments, Lemon Squeezy, Stripe

src/services/projects/create-project.ts
const { snapshot } = await resolveUserEntitlements({ userId });const decision = evaluateEntitlementGuard({  snapshot,  requirements: [{    capabilityKey: "limits.projects.max_count",    comparator: "at_least",    minimumValue: projectCount + 1,  }],});

Transactional email that reaches the inbox

  • Verification, password recovery, sign in links and account notices.
  • One layout for every message, with every value escaped.
  • Without a provider, messages are logged locally instead of lost.
  • A missing provider in production fails loudly, not silently.

Resend, Postmark, SendGrid

.env.local
EMAIL_PROVIDER=resendEMAIL_API_KEY=...EMAIL_FROM=hello@yourproduct.com

Data on D1, with the same code in your tests

  • A schema with numbered migrations and parameterised queries.
  • Every repository has a D1 driver and an in memory driver.
  • The D1 drivers are tested against the real migrations on SQLite.
  • A daily Cron Trigger deletes expired sessions, tokens and rate limits.

Cloudflare D1, SQLite in the tests

terminal
bun run db:migrate:localApplied the migrations to the local D1 databasebun run testEvery test passed

Boundaries on the server, not promises in the UI

  • A same site guard on every state changing route.
  • Ownership scoped queries: an account only ever reads its own rows.
  • Rate limits on sign in, sign up, password recovery and email links.
  • One error envelope that never echoes a provider or database error.

Cloudflare Turnstile, optional

src/app/api/projects/route.ts
const guardFailure = resolveRequestGuardFailure(request);if (guardFailure) {  return createRequestGuardResponse(guardFailure);} const session = await resolveAuthSessionContextFromRequest({ request });if (!session.authenticated) {  return createErrorResponse("AUTHENTICATION_REQUIRED", ...);}

Pages search engines and social cards understand

  • Titles, descriptions and canonical URLs on every page.
  • A sitemap and robots rules generated from the routes.
  • Social cards rendered from the product identity, never stale.
  • Breadcrumb and FAQ structured data where they apply.

Next.js metadata, sitemap.ts, opengraph-image.tsx

A dashboard, settings and billing, already designed

  • 38 Aback UI components with one token set, in light and dark.
  • Dashboard, billing, profile, preferences and security screens.
  • Loading, empty, error and success states on every surface.
  • 7 interface languages, a command palette and keyboard focus that is visible.

Tailwind CSS 4, Radix primitives, Tabler icons

src/components/your-feature.tsx
import { Button, Card, Field } from "@/vendor/aback-ui";

Written so your AI agent builds it right the first time

  • AGENTS.md is the contract: scope, security and the definition of done.
  • The playbook says where code belongs and lists the traps that caused real bugs.
  • Recipes for a protected page, an API route, a table, an email and a plan limit.
  • One command proves a change, so a plausible diff becomes a checked one.

Claude Code, Cursor, GitHub Copilot

repository
AGENTS.md            the contractCLAUDE.md            imports the contractDESIGN.md            the design systemdocs/AGENT-PLAYBOOK.md.github/copilot-instructions.md

One payment, every update after it.

// 03Who it is for

Start the product you actually want to build

Anything with accounts and payments starts from the same foundation. Here is what it fits, and when it is the wrong choice.

  • A subscription SaaS

    Plans, trials, the customer portal, plan changes and limits that are checked on the server.

  • An AI tool with paid plans

    Accounts, billing and limits per plan, such as projects and seats, so the new code is the model call and its interface.

  • A product you sell once

    One-time checkout and signed order events behind the same payment contract. This site sells itself that way.

  • Client projects

    The licence covers products you build for clients, so every project starts from the same tested base.

Not for you if

  • You want a no-code builder. This is source code you own and change.
  • You need to host somewhere other than Cloudflare Workers. The kit is built for Workers and D1.
  • You want every framework and database as an option. There is one path, kept working.

// 04Built for AI

Codebase + your AI agent = a feature that ships

An agent is only as good as the codebase it reads. This one tells it where code belongs, which mistakes have already happened here and how to prove a change, so the first diff is close to the right one.

The rules travel with the code

AGENTS.md, DESIGN.md and the agent playbook are in the repository, so Claude Code, Cursor or Copilot read the same rules the maintainers follow.

Recipes, not guesses

A protected page, an API route, a new table, an email, a plan limit: each recipe lists every file the change has to touch.

A wrong change fails in seconds

Strict types, the test suite and bun run verify catch a plausible but broken diff before it reaches a user.

Read the AI agents guide

// 05Why it exists

Built to launch our own products first

Devvrat Hans
Devvrat HansFounder, Aback Group

Hey, I'm Devvrat.

Aback Group builds a family of products, and every one of them started the same way: sessions, webhooks, emails that land in spam, a pricing page, a dark mode. Weeks of work before the first feature, repeated for every launch.

So I built that foundation once, properly, with the tests and the rules to keep it right. The next Aback products start from it, and the site you are reading is built from it.

Aback Stack is that same repository. When I improve it for our own launches, you get the update with git pull.

// 06Pricing

Pay once. Ship as many products as you like.

One price, the whole repository and every update after it. No subscription and no seats.

Aback Stack

The production SaaS foundation on Next.js and Cloudflare, with every future update.

One-time payment

$199USD, once. No subscription.

  • Read access to the private GitHub repository
  • Every future update, delivered with git pull
  • A commercial licence for unlimited products of your own
  • Authentication, payments with Dodo, Stripe or Lemon Squeezy, email, D1 and the scheduled jobs
  • 1,400+ tests, the agent playbook and the full documentation
  • Email support for the kit itself

Pay once. Build unlimited products.

Payments, tax and receipts are handled by Dodo Payments, the merchant of record. The code is delivered as read-only access to a private GitHub repository. Read the licence before you buy.

How you get the code

  1. Pay once with Dodo Payments

    Dodo Payments is the merchant of record: it handles the card, the tax and the receipt.

  2. Connect your GitHub account

    The confirmation email from Dodo Payments links to your customer portal. Click Connect next to GitHub access.

  3. Accept the invitation

    GitHub invites you to the private repository with read access. Accept it, clone, and run bun run verify.

// 07FAQ

Frequently asked questions

What exactly do I get?

Read access to the private GitHub repository: the full source, the documentation, the test suite and the agent playbook. Every update published to the repository reaches you with git pull, and the licence lets you build as many products of your own as you like.

How do I get access after paying?

Dodo Payments emails your receipt with a link to your customer portal. Click Connect next to GitHub access and authorise your GitHub account, then accept the invitation GitHub sends you. If nothing arrives within a few minutes, check the spam folder or write to support.

Is it a subscription?

No. Aback Stack is $199, paid once. There is no renewal, and the updates keep arriving through the repository.

What is the stack?

Next.js 16 with the App Router, React 19 and strict TypeScript, Tailwind CSS 4 and the Aback UI components, deployed to Cloudflare Workers with D1 for data. Bun runs the scripts and the tests.

Do I need a Cloudflare account to try it?

Not to run it. Without configuration the kit uses an in memory store and logs email to the console, so bun run dev works on a fresh clone. You need Cloudflare when you deploy.

Does it work with AI coding agents?

It is written for them. AGENTS.md, the agent playbook and CLAUDE.md tell an agent where code belongs, how to make the common changes and how to prove them, so Claude Code, Cursor or Copilot extend the kit inside its architecture instead of around it.

Can I use it for client work?

Yes. The licence covers the products you build for yourself, your organisation or a client, commercially and for any number of end users. What it does not allow is passing the kit itself on, for example as another template or boilerplate.

Can my product use Stripe or Lemon Squeezy instead of Dodo?

Yes. The payments in the kit sit behind one contract, and the deployment picks Dodo Payments, Stripe or Lemon Squeezy with one environment variable. Email works the same way with Resend, Postmark or SendGrid.

Who processes the payment?

Dodo Payments, as the merchant of record. It takes the payment, calculates and remits the sales tax or VAT of your country and issues the receipt, so the invoice is valid for your business.

What about refunds?

Write to support@abackstack.com with your receipt. Refunds are processed through Dodo Payments, and a refund removes the repository access.

Another question? Write to us.

Start today

Your product, not the plumbing

Clone it tonight, run one command to prove it works, and spend tomorrow on the feature only you can build. $199 once, every update included.

Browse the documentation