Tech stack
The technologies and responsibilities behind the SaaS Boilerplate.
The stack is intentionally split by responsibility. Your browser app, API, shared contracts, provider adapters, and operational tooling can evolve independently without losing type safety.
Choose the layer you are working in
Work in apps/web for product screens, React Router routes, TanStack Query server state, and
narrowly scoped Zustand client state. Browser code never owns authorization or provider secrets.
| Layer | Technology | Why it is here |
|---|---|---|
| Web app | React 19, React Router, Vite+ | Fast client application with explicit route and module boundaries. |
| Client data | TanStack Query, Zustand | Server-state caching and narrowly scoped client state. |
| API | Bun, Hono, Hono RPC | A compact typed HTTP API and direct end-to-end contract inference. |
| Validation | Zod | Shared request and response schemas in packages/contracts. |
| Data | PostgreSQL 18, dbmate, parameterized SQL | Durable schema history without hiding database behavior behind an ORM. |
| Identity | Better Auth | Password, verification, reset, magic links, sessions, and optional Google OAuth. |
| Billing | Polar, Stripe, or Dodo Payments | One selected provider behind a normalized entitlement contract. |
| React Email, Resend | Typed templates, deterministic HTML, and local log fallback. | |
| Storage | Cloudflare R2, Amazon S3, or GCS | Owner-scoped, presigned uploads with server confirmation. |
| Observability | Pino, optional Sentry, Slack | Structured logs, protected error reporting, and operational alerts. |
| Quality | TypeScript, Vite+, Bun test, Playwright | Fast feedback plus deterministic workspace verification. |
What is deliberately not included
Version one does not include multi-tenant organizations, generic background jobs, durable queues, file malware scanning, or automatic compliance controls. Add those only when your product needs them and after choosing the right ownership and operational model.
Rate limits are shared
The included Hono endpoint limiters use atomic Postgres fixed windows, so configured budgets are shared across API replicas. Provider and infrastructure limits still need capacity and abuse proof before raising replica counts.
Continue with Project structure to see where each concern lives.