Paddle Billing

paddle-billing

Paddle's Next.js starter kit (Vercel's Paddle Billing Subscription Starter) — a three-tier pricing page localized by Paddle.js, an inline Paddle Checkout, Supabase Auth with cookie sessions through @supabase/ssr, a dashboard of the customer's subscriptions and payments read from Paddle's API, and the webhook that keeps Paddle's customers and subscriptions in Postgres — running on Cloudflare Workers + Static Assets through @opennextjs/cloudflare, with a Supabase project per environment provisioned by Terraform and its schema applied by the db-migrate runner through Orun, the way subscription-payments does it for Stripe, and packaged as an Orun baseline: one command takes a new product from nothing to live on stage and prod, in its own repository, under its own name — in ONE landing.

The template's code is the code, moved to Next.js 16 with only the changes Next.js 16 and Workers force. What a fresh, unattended deployment forces on top: the app reads its Supabase project from ONE wiring document per environment (WIRING_SUPABASE: the URL and anon key the build inlines, and the service-role key the deploy pushes to the Worker as a secret — never a var or a bundle); Paddle's keys are the owner's own optional secrets, so the app deploys, signs users up, in and in as guests and renders the dashboard with no Paddle account, while pricing shows the plans with a notice instead of prices, checkout and the dashboard's Paddle views say Paddle is not connected, and the webhook answers 503; and both tables in public keep upstream's row-level security, checked by a migration of its own. What the baseline adds is everything needed to make a copy of it somebody else's, built the way cirrus-baseline is. See specs/epics/paddle-billing for the design, the milestones and the as-built status, including every departure.

Instantiating a product

git clone --depth 1 --branch <baseline-tag> https://github.com/sourceplane/paddle-billing
cd paddle-billing
orun new --blueprint repo-blueprint.yaml --out ~/products/acme-pay --run-hooks --resume \
  --set reponame=acme-pay --set productname="Acme Cloud" \
  --set githuborg=acme-inc --set subdomain=<workers-dev-subdomain>

Or, once the platform's registry lists it, from the Orun console (Baselines → paddle-billing → Build). Two phases: 01-product creates the repository, mints the four brokered credentials (Cloudflare and Supabase) and lands the whole product as one pull request, whose convergence on main provisions and deploys it per environment in a fixed order —

supabase ──▶ db-migrate ──▶ web

— each edge mode: enforced on a push to main and advisory on a pull request; then 02-docs records the live deployment from probed facts. The Supabase organization needs room for two projects (stage and prod; its free plan allows exactly two active ones). BOOTSTRAP.md is the operator guide; docs/phases/ has a page per phase.

The new repository receives the product only — the app, the Terraform root, the migrations, the tests, its CI, its tooling, a README of its own and its operating contract — renamed throughout to the product's name, repository, Worker and Supabase project. None of this repository's machinery ships. Paddle is the owner's to connect afterwards (the product's README, "Connecting Paddle"): no platform brokers it, so the card asks for no Paddle key. Neither is GitHub sign-in, nor Supabase Auth's email: the project signs new users straight in until its owner gives it SMTP (the product's README, "Supabase Auth email").

What is here (the product)

Getting started

pnpm install
pnpm run wire:fixture   # re-render apps/web/wrangler.jsonc from its template (committed; this changes nothing)
pnpm typecheck
pnpm lint
pnpm test
pnpm build              # packages/db → dist; next build + opennextjs-cloudflare build → apps/web/.open-next

The build needs no Supabase project and no Paddle account. Running it locally — the Supabase CLI's stack or a hosted project, .env.local, next dev or wrangler dev, a Paddle sandbox — is in the product's README (.baseline/product/README.md), which is what a product built from here carries.

How it maps to Vercel

CI