SaaStart

auth0-saas-starter

Auth0's B2B SaaS starter (Vercel's "SaaStart: Auth0 + Next.js SaaS Starter Kit" template) — sign-up that creates an organization, members, invitations and roles, self-service SSO (OIDC and SAML) with SCIM provisioning, MFA enrollment and per-organization security policies, all kept in an Auth0 tenant through its Management API, with no database of its own — running on Cloudflare Workers + Static Assets through @opennextjs/cloudflare, and packaged as an Orun baseline: one command takes a new site from nothing to live on stage and prod, in its own repository, under its own name.

The template's code is the code. What the port adds is the Workers build, the monorepo wrapper, a test package and the deploy contract; what it changes is what Workers and a fresh, unattended deployment force:

• upstream's tenant-bootstrap CLI, which created everything anew on every run and wrote .env.local, is an idempotent command the owner runs once per environment, storing the tenant's configuration as Orun secrets;
• the build inlines only the tenant's domain and hands the rest to the Worker as Worker secrets;
• the site renders a "connect Auth0" notice until a tenant is set up;
• the three Auth0 clients are built on first use;
• upstream's edge middleware is kept, because OpenNext cannot bundle Next 16's Node.js proxy.ts for this SDK;
• the template's Heap analytics snippet is gone.

What the baseline adds is everything needed to make a copy of it somebody else's — built the way cirrus-baseline is.

See specs/epics/auth0-saas-starter for the design, the milestones and the as-built status, including every departure.

Instantiating a site

git clone --depth 1 --branch <baseline-tag> https://github.com/sourceplane/auth0-saas-starter
cd auth0-saas-starter
orun new --blueprint repo-blueprint.yaml --out ~/sites/acme-notes --run-hooks --resume \
  --set reponame=acme-notes --set productname="Acme Notes" \
  --set githuborg=acme-inc --set subdomain=<workers-dev-subdomain>

Or, once the platform's registry lists it, from the Orun console (Baselines → auth0-saas-starter → Build). Two phases — 01-product (the repository created, then the whole site in one pull request, deployed to stage and prod and smoke-tested) and 03-docs (the live deployment recorded) — each landing one pull request in the new repository. BOOTSTRAP.md is the operator guide; docs/phases/ has a page per phase.

The new repository receives the site only — the app, its tests, its CI, its tooling, a README and an AGENTS.md of its own and its operating contract — renamed throughout to the site's name, repository and Cloudflare Worker. None of this repository's machinery ships. Auth0 is the owner's to connect afterwards (the site's README, "Connect Auth0"): no platform brokers it, so the card asks for no Auth0 credential, and the site goes live with a "connect Auth0" notice where sign-up would be. The owner's pnpm auth0:bootstrap --env <env> sets a tenant up and stores its configuration; a redeploy connects the site.

What is here (the site)

Getting started

pnpm install
pnpm typecheck
pnpm lint
pnpm test
pnpm build            # next build + opennextjs-cloudflare build → apps/web/.open-next

The build needs no tenant: without one the site is the "connect Auth0" site. With a tenant set up for localhost (pnpm auth0:bootstrap --local, which writes apps/web/.env.local), pnpm --filter @app/web dev is the template as Auth0 ships it.

How it maps to Vercel

CI