Auth system (PRO) · Docs

Starter ProAuth

Authentication that actually shipsLink to section

Starter Free gives you auth screens and UX states.

Starter Pro gives you a production-ready authentication system for real SaaS products:

real users
real sessions
real providers
real token flows
real protected routes
real account lifecycle foundations

This is the layer that turns login pages into a working product system.

Ship auth once. Ship it right.

The cost of weak auth is usually paid later. Starter Pro helps you avoid that by starting from a stronger foundation.

Setup guide

One-time payment · Instant access after purchase

Core idea

Auth is not UI. Auth is lifecycle, security, state, redirects, provider rules, and trust.

What this solvesLink to section

Authentication is usually one of the first serious blockers before launch.

It looks simple at the UI level:

login
register
forgot password
OAuth buttons

But production auth also needs:

password hashing
session persistence
email verification
password reset tokens
provider account linking
protected route behavior
safe disconnect rules
rate limiting foundations
secure error handling

Starter Pro gives you a structured foundation for that layer so you do not rebuild the full lifecycle from scratch.

What is includedLink to section

Credentials auth

Email and password authentication with account creation, password validation, password reset, and password change foundations.

OAuth providers

Google and GitHub OAuth foundations with connected account patterns and safer provider lifecycle handling.

Verification and tokens

Email verification, reset password, token expiration, and recovery flows structured for production use.

Protected foundations

Session-aware UI, protected routes, auth-aware backend logic, and account safety patterns.

Auth flowsLink to section

Sign in flow

A production sign-in flow needs more than a form. It needs state, errors, redirects, and session creation.

email and password sign in
OAuth sign in
session creation
error-aware UX
redirect to protected app surface

Registration flow

Registration turns anonymous users into real accounts with a lifecycle that can support verification and onboarding.

real account creation
password validation
email verification-ready lifecycle
provider signup path
session-aware onboarding path

Password

Password lifecycle

Password flows need secure recovery, expiration-aware tokens, and clear account safety rules.

forgot password request
reset password token
expiration-aware recovery flow
in-session password change
add password for OAuth-only users

Providers

Connected accounts

Provider flows need connection, linking, disconnect, and fallback behavior so users do not get locked out.

Google account connection
GitHub account connection
provider linking patterns
safe disconnect rules
account fallback behavior

Starter Free vs Starter ProLink to section

Capability	Starter Free	Starter Pro
Auth screens	Included	Included
Credentials auth	Mocked	Real
Google OAuth	Not included	Real
GitHub OAuth	Not included	Real
Sessions	Mocked / partial	Real
Email verification	Not included	Real
Forgot password	UI only	Real flow
Reset password	UI only	Token-based
In-session password change	Not included	Included
OAuth account linking	Not included	Included
Safe provider disconnect rules	Not included	Included
Protected routes	Conceptual	Production-ready foundation
Rate limiting foundations	Not included	Included pattern

Simple distinction

Starter Free simulates auth. Starter Pro handles real users.

ArchitectureLink to section

Data model responsibilitiesLink to section

Starter Pro auth is designed around the structures a serious SaaS usually needs.

Typical auth responsibilities include:

Area	Purpose
User	Identity, email, profile image, verification state
Account	OAuth provider accounts and account linking
Session	Active user sessions
VerificationToken	Auth.js-compatible verification flows
UserToken	Email verification and password reset lifecycle
AuthAttempt	Audit and rate-limiting foundation

Why this matters

Production auth is not only about signing in. It is about storing enough state to make account lifecycle, recovery, and provider logic safe.

Protected routesLink to section

Auth becomes valuable when it protects real product surfaces.

Starter Pro is designed so the auth layer can protect:

dashboard
settings
billing
admin
customer data
plan-aware product areas

protected-routes.txt

/dashboard
/settings
/billing
/admin

A good protected route system should:

redirect anonymous users
preserve safe app boundaries
expose session-aware UI
avoid leaking private state
work with billing and backend ownership rules

Integration with billingLink to section

Auth and billing are connected in a real SaaS.

A customer is not just a payment record. A customer belongs to a user or organization.

That means auth must support:

account identity
customer ownership
subscription access
billing portal access
plan-aware feature gating

Why auth matters for revenue

You cannot reliably charge customers until you can reliably identify them.

Security rulesLink to section

Use these rules when adapting the authentication layer.

Prefer

server-side validation for authentication actions
short-lived tokens for recovery flows
generic forgot-password confirmation copy
clear session-aware redirects
provider disconnect rules that never lock users out

Avoid

revealing whether an email exists
allowing users to disconnect their only login method
trusting client-side authentication state for protected data
returning overly specific authentication errors
mixing authentication logic into unrelated product components

Decision guideLink to section

Starter Pro

Use Starter Pro auth when auth becomes real

Use Starter Pro when authentication is part of the launch foundation and not only a mocked screen.

real users need accounts
sessions must persist
OAuth providers matter
password reset must work
routes need protection
billing depends on identity
account lifecycle edge cases matter

Start setup

Starter Free

Stay on Free while validating UX

Stay on Starter Free when you are still testing the product surface and do not need real users yet.

you are still validating UX
you do not need real users yet
auth is not blocking progress
you are not preparing monetization

Upgrade when auth becomes real

Starter Free helps you design the auth surface. Starter Pro gives you the auth system behind it.

Implementation checklistLink to section

Before treating auth as launch-ready, validate:

credentials sign in
OAuth sign in
registration
email verification
forgot password
reset password
password change
protected route redirects
session-aware navigation
connected account behavior
provider disconnect rules
billing access ownership

Validation principle

Do not customize deeply before validating the default flows. Confirm the foundation first, then adapt the product.

Common questionsLink to section

Authentication is launch infrastructure.

Move to Starter Pro when login pages need to become a secure account system with sessions, providers, recovery, and protected access.

View pricing