The 2026 SaaS Boilerplate: Auth, Billing, Multi-Tenancy

The modern SaaS stack: Next.js 15 + Drizzle + Better Auth + Stripe

The Recommended Stack

Auth: The Comparison That Matters

Verdict: Better Auth for most teams. Clerk if you want zero auth code and have budget. Auth.js only if you need a very specific OAuth provider it supports.

Multi-Tenancy with Drizzle

Row-level tenancy is the right pattern for 95% of SaaS apps. Every table gets a tenantId column, and every query filters by it. Drizzle makes this type-safe:

// schema.ts - Row-level multi-tenancy
import { pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";

export const tenants = pgTable("tenants", {
  id: uuid("id").primaryKey().defaultRandom(),
  name: text("name").notNull(),
  slug: text("slug").notNull().unique(),
  plan: text("plan").notNull().default("free"),
  stripeCustomerId: text("stripe_customer_id"),
  createdAt: timestamp("created_at").defaultNow().notNull(),
});

export const projects = pgTable("projects", {
  id: uuid("id").primaryKey().defaultRandom(),
  tenantId: uuid("tenant_id").notNull().references(() => tenants.id),
  name: text("name").notNull(),
  createdAt: timestamp("created_at").defaultNow().notNull(),
});

// Tenant-scoped query helper
export function forTenant(db: DrizzleDB, tenantId: string) {
  return {
    projects: {
      list: () =>
        db.select().from(projects).where(eq(projects.tenantId, tenantId)),
      create: (data: { name: string }) =>
        db.insert(projects).values({ ...data, tenantId }).returning(),
    },
  };
}

// Usage in a server action
export async function getProjects() {
  const session = await auth();
  const tenantId = session.user.activeTenantId;
  return forTenant(db, tenantId).projects.list();
}

Stripe Webhook Handler

This handles the critical subscription lifecycle events. Put it in app/api/webhooks/stripe/route.ts:

import { headers } from "next/headers";
import Stripe from "stripe";
import { db } from "@/lib/db";
import { tenants } from "@/lib/schema";
import { eq } from "drizzle-orm";

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);

export async function POST(req: Request) {
  const body = await req.text();
  const sig = (await headers()).get("stripe-signature")!;

  let event: Stripe.Event;
  try {
    event = stripe.webhooks.constructEvent(
      body, sig, process.env.STRIPE_WEBHOOK_SECRET!
    );
  } catch {
    return new Response("Invalid signature", { status: 400 });
  }

  switch (event.type) {
    case "checkout.session.completed": {
      const session = event.data.object as Stripe.Checkout.Session;
      await db.update(tenants)
        .set({
          stripeCustomerId: session.customer as string,
          plan: "pro",
        })
        .where(eq(tenants.id, session.metadata!.tenantId));
      break;
    }
    case "customer.subscription.updated": {
      const sub = event.data.object as Stripe.Subscription;
      const plan = sub.status === "active" ? "pro" : "free";
      await db.update(tenants)
        .set({ plan })
        .where(eq(tenants.stripeCustomerId, sub.customer as string));
      break;
    }
    case "customer.subscription.deleted": {
      const sub = event.data.object as Stripe.Subscription;
      await db.update(tenants)
        .set({ plan: "free" })
        .where(eq(tenants.stripeCustomerId, sub.customer as string));
      break;
    }
  }

  return new Response("OK", { status: 200 });
}

Project Structure

├── app/
│   ├── (auth)/
│   │   ├── login/page.tsx
│   │   └── signup/page.tsx
│   ├── (dashboard)/
│   │   ├── layout.tsx          # Auth guard + tenant context
│   │   ├── projects/page.tsx
│   │   └── settings/
│   │       ├── billing/page.tsx
│   │       └── team/page.tsx
│   ├── api/
│   │   ├── auth/[...all]/route.ts   # Better Auth handler
│   │   └── webhooks/stripe/route.ts
│   ├── layout.tsx
│   └── page.tsx                # Landing page
├── components/
│   ├── ui/                     # shadcn/ui components
│   └── dashboard/
├── lib/
│   ├── auth.ts                 # Better Auth config
│   ├── db.ts                   # Drizzle client
│   ├── schema.ts               # Drizzle schema
│   └── stripe.ts               # Stripe helpers
├── drizzle/
│   └── migrations/
├── drizzle.config.ts
├── tailwind.config.ts
└── package.json

Deployment Cost Comparison

Recommendation: Start on Vercel (free) + Neon (free). Move to Railway or AWS when you need background jobs, cron, or more control. Don't over-engineer deployment for an MVP.

Open-Source Boilerplate Comparison

What NOT to Build Yourself

• Payment processing - Use Stripe. Period. Don't touch PCI compliance.
• Email delivery - Use Resend or Postmark. Building email infrastructure is a full-time job.
• File uploads - Use UploadThing or S3 presigned URLs. Don't stream files through your server.
• Search - Use Meilisearch or Algolia. Building full-text search on PostgreSQL works until it doesn't.
• Analytics - Use PostHog (self-hostable) or Plausible. Don't build event tracking from scratch.
• Feature flags - Use LaunchDarkly or Unleash. A JSON config file is not a feature flag system.