Subscription Payments

subscription-payments

Vercel's Next.js Subscription Payments Starter — Supabase Auth with cookie sessions through @supabase/ssr, a Postgres schema of users, customers, products, prices and subscriptions kept in sync by Stripe webhooks, Stripe Checkout to subscribe and the Customer Portal to manage — running on Cloudflare Workers + Static Assets through @opennextjs/cloudflare, with a Supabase project per environment provisioned by Terraform and its schema applied by the db-migrate runner through Orun — the way the Lumen baseline does it — and packaged as an Orun baseline: one command takes a new product from nothing to live on stage and prod, in its own repository, under its own name, in ONE landing.

The template's code is the code, moved to Next 16 / React 19 with only the changes Next 16 and Workers force. What a fresh, unattended deployment forces on top: the app reads its Supabase project from ONE wiring document per environment (WIRING_SUPABASE: the URL and anon key the build inlines, and the service-role key the deploy pushes to the Worker as a secret — never a var or a bundle); the Stripe client exists only once a key does, so the app deploys, signs users up and in and renders the account page with no Stripe account, while pricing shows the template's sample plans and says checkout is not connected and the webhook answers 503; and every table in public keeps upstream's row-level security, checked by a migration of its own. What the baseline adds is everything needed to make a copy of it somebody else's — built the way cirrus-baseline builds a product, in one landing. See specs/epics/subscription-payments for the design, the milestones and the as-built status, including every departure.

Instantiating a product

git clone --depth 1 --branch <baseline-tag> https://github.com/sourceplane/subscription-payments
cd subscription-payments
orun new --blueprint repo-blueprint.yaml --out ~/products/acme-pay --run-hooks --resume \
  --set reponame=acme-pay --set productname="Acme Cloud" \
  --set githuborg=acme-inc --set subdomain=<workers-dev-subdomain>

Or, once the platform's registry lists it, from the Orun console (Baselines → subscription-payments → Build). Two phases: 01-product creates the repository, mints the four brokered credentials (Cloudflare and Supabase) and lands the whole product as one pull request, whose convergence on main provisions and deploys it per environment in a fixed order —

supabase ──▶ db-migrate ──▶ web

— each edge mode: enforced on a push to main and advisory on a pull request; then 02-docs records the live deployment from probed facts. The Supabase organization needs room for two projects (stage and prod; its free plan allows exactly two active ones). BOOTSTRAP.md is the operator guide; docs/phases/ has a page per phase.

The new repository receives the product only — the app, the Terraform root, the migrations, the tests, its CI, its tooling, a README of its own and its operating contract — renamed throughout to the product's name, repository, Worker and Supabase project. None of this repository's machinery ships. Stripe is the owner's to connect afterwards (the product's README, "Connect Stripe"): no platform brokers it, so the card asks for no Stripe key. Neither is Supabase Auth's email: the project signs new users straight in until its owner gives it SMTP (the product's README, "Supabase Auth email").

What is here (the product)

Getting started

pnpm install
pnpm run wire:fixture   # re-render apps/web/wrangler.jsonc from its template (committed; this changes nothing)
pnpm typecheck
pnpm lint
pnpm test
pnpm build              # packages/db → dist; next build + opennextjs-cloudflare build → apps/web/.open-next

The build needs no Supabase project and no Stripe account. Running it locally — the Supabase CLI's stack or a hosted project, .env.local, next dev or wrangler dev, the Stripe CLI — is in the product's README (.baseline/product/README.md), which is what a product built from here carries.

How it maps to Vercel

CI