SSR-correct Supabase Auth
Email and password, magic link and OAuth, with middleware that re-verifies the user on every request.
FREE AND OPEN SOURCE
Free, open-source Next.js + Supabase starter
A barebones Next.js 16 and Supabase foundation for your next SaaS. It is free to clone, and built on the same patterns as the paid Nextbase kits.
- License
- MIT
- Framework
- Next.js 16 App Router
- Backend
- Supabase Postgres and Auth
- On GitHub
- 800+ stars
WHAT IS INCLUDED
Auth, RLS, typed server actions and a UI toolkit
RLS and versioned migrations
Row level security from day one, timestamped SQL migrations, and generated database types for end-to-end type safety.
Type-safe server actions
next-safe-action with Zod. Pre-built action and authAction clients validate and authenticate mutations by default.
Next.js 16 with Cache Components
App Router, Turbopack and explicit 'use cache' boundaries. Static by default, with Suspense loading states.
shadcn/ui and Tailwind v4
40+ Radix primitives and Tailwind CSS v4, already wired, so the usual week-one UI setup is done.
Turborepo monorepo
pnpm workspaces split apps/web and apps/database, with pipelined build, lint, test, typecheck and gen-types tasks.
Tests included
Vitest and Testing Library for units, Playwright for E2E, and a pgTAP scaffold for asserting RLS policies and triggers.
Open source and MIT licensed
Fork it, change it and ship it, including in commercial and client work. Attribution is appreciated but not required.
SETUP
Clone and run it
Fill in your Supabase project details after copying the example env files. For a hosted project, link it and run supabase db push instead of starting the local stack.
git clone https://github.com/imbhargav5/nextbase-nextjs-supabase-starter.git my-app
cd my-app
pnpm install
cp .env.local.example .env.local
cp .env.development.local.example .env.development.local
pnpm database#start
pnpm gen-types-local
pnpm devThe repository README has the full setup, test and deploy steps.
THE EXAMPLE APP
What you can try after setup
- Sign up and sign inLogin, sign-up, magic link and forgot-password screens, with email confirmation and OAuth callback pages.
- Open the dashboardAn authenticated app shell with a sidebar and breadcrumbs. Middleware protects these routes.
- Create private itemsA list, detail and create flow backed by RLS, so each user only sees their own rows.
NOT INCLUDED
What the free starter leaves out
The free starter keeps to the foundation. These parts ship in the paid kits.
- Stripe billing and subscriptions
- Workspaces, teams and member roles
- An application admin area
- Transactional email
- Agent connections (user and admin MCP)
FREE OR PAID
Free starter compared with the paid kit
| Feature | Free starter | Paid Supabase kit |
|---|---|---|
| Next.js App Router with Supabase Postgres and Supabase Auth | ||
| Email and password sign-in with email verification | ||
| Magic links and OAuth sign-in | Google, GitHub and Twitter buttons | Depends on the providers you configure |
| Row level security | Per-user policies | Workspace data protected by RLS |
| Versioned SQL migrations and generated types | ||
| Workspaces with members and workspace owners | ||
| Projects that belong to a workspace | ||
| Application admin area | ||
| User and admin MCP connections for agents | Read-only in v5 | |
| Stripe billing | Uses your own Stripe account | |
| Transactional email with Resend | ||
| TanStack version of the repo | TanStack + Supabase kit | |
| Unit tests (Vitest) and end-to-end tests (Playwright) | ||
| License | MIT | Commercial, per developer seat |
| Support | Community | 48-hour or 24-hour, by plan |
FAQ
Questions about the free starter
Is the starter really free?
Yes. It is MIT licensed, so you can use it for personal projects, client work, internal tools and commercial products without buying anything.
How is it maintained?
The source is public on GitHub. Releases are cut with Changesets, and bugs and questions go to GitHub issues with a reproducible scenario. Pull requests are welcome.
Where can I deploy it?
On any Node 22+ host; Vercel is the simplest. Set the same environment variables as production secrets, point your domain at the deployment, and add <your-domain>/auth/callback to the Supabase project's allowed redirect URLs.
When should I move to the paid kit?
When your product needs workspaces with members, billing, an admin area or transactional email. The paid Next.js + Supabase kit includes them. The comparison table above lists each difference.
Can I remove shadcn/ui, Tailwind or TanStack Query?
Yes. It is your codebase, and the architecture does not depend on any one of them.