Documentation
Guides, comparisons, and resources for building multi-tenant SaaS applications with SvelteKit.
Products
Browse all products →Product Documentation
Multi-tenant Authentication
How to model organizations, memberships, invites, and role enforcement at the application layer.
RBAC & Role Hierarchy
Three roles with strict hierarchy enforced server-side. The capability matrix and enforcement points.
Invite Link Flow
Single-use hashed invite tokens with expiry and atomic claim. Race-condition-safe by construction.
Seat Billing Adapter
Pluggable BillingAdapter interface for merchant-of-record checkout.
Append-Only Audit Log
Audit trail design: append-only by construction, no update or delete path.
Hashed Session Auth
Database-backed sessions with hashed tokens for revocation.
Rate Limiting Login
Sliding-window failed-attempt rate limiter with pre-hash blocking.
Sell Software Without Stripe
Merchant-of-record options for developers in countries where Stripe isn't available.
SaaS Starter Evaluation Checklist
Six-dimension evaluation framework for choosing a SaaS starter.
Multi-Tenant Starter Checklist
Production readiness checklist for multi-tenant SaaS starters.
Drizzle ORM Migrations in SvelteKit
Schema-first database management with Drizzle Kit: migrations, type-safe queries, and SQLite specifics.
Multi-Tenant Database Design
Shared-database tenant isolation patterns: tenant_id columns, membership scoping, and when to outgrow.
SvelteKit Session Management
Server-side sessions with hashed tokens, httpOnly cookies, and database-backed revocation.
SvelteKit Hooks & Middleware
Server-side request handling with hooks.server.ts: auth, sessions, and multi-tenant resolution.
Testing SvelteKit with Vitest
Unit tests, integration tests, and HTTP-level patterns from a 77-test suite.
SQLite for Production SaaS
When and how to use SQLite for multi-tenant applications: WAL mode, isolation, and ceiling awareness.
SvelteKit Environment Variables
Public vs private, static vs dynamic, .env files, Cloudflare Workers secrets, and startup validation.
SvelteKit Error Handling
fail(), error(), redirect(), and the errorToFail mapper: typed error patterns for form actions.
Supabase Starter: Architecture
Thin routes → framework-free services → rbac/billing seams → supabase/client.ts. Service-role vs user-scoped clients and RLS defense-in-depth (service-only: you wire the route layer).
Supabase Starter: RBAC & RLS
Three roles, one capability matrix, and a strict hierarchy enforced server-side at the app layer and again via Supabase Row Level Security.
Supabase Starter: Seat Billing
Pluggable BillingAdapter for merchant-of-record checkout, enforced at invite acceptance with seat-limit error codes.
Supabase Starter: Testing
Six Vitest suites (75 tests) against an in-memory fake Supabase client — no database, no network. RLS checks via supabase start.
Supabase Starter: Versioning
Semantic Versioning, Keep a Changelog, and the release process for the Supabase starter.
Guides
How to Build Multi-Tenant SaaS
Step-by-step guide to building a production-ready multi-tenant SaaS with SvelteKit.
SvelteKit SaaS Boilerplate
What you actually need in a SaaS boilerplate — and what free starters skip.
Multi-Tenant SvelteKit Template
How to implement organizations, RBAC, seat billing, and audit logging.
License Agreement
End User License Agreement for the starter kit.