Explore the starter
Install it, customize the product identity, verify local dependencies, seed a demo account, and open every shipped application.
Follow the quick startMIT licensed · Production-minded
The plumbing is done. Build the product.
Go from guided local setup to a deployable web app, admin console, and Content Studio—with replay-safe billing, private storage, durable work, observability, and restore-tested operations.
Evaluating the stack first? See when Sushi SaaS is a good fit.
One-command developmentSetup, doctor, unified runner, safe fixtures, and local Postgres, Redis, and Garage.
Replay-safe moneyIdempotent checkout, webhooks, ledger spends, and exactly-once compensation.
Deployable operationsPortable workers, containers, readiness, telemetry, backups, retention, and launch audits.
Tests as architectureLayering, auth gates, replay behavior, migrations, and DB constraints are executable.
Enter through the question you have now.
New adopters need different levels of detail. Start the complete stack, trace one paid workflow, or inspect the production controls before choosing what to keep.
Learn one complete feature
Follow the five-credit image task through authentication, entitlements, ledger replay, the durable worker, private output, and compensation.
Trace the reference workflowPrepare a real launch
Build hardened containers, inspect migrations and data integrity, run restore drills, and execute the launch-readiness audit.
Open the launch pathA backbone, not a demo.
The starter focuses on the parts that become expensive after launch: ownership, retries, reconciliation, operational access, and explicit boundaries.
Authentication & abuse controls
Verified email flows, OAuth, password recovery, MFA, Turnstile, Redis rate limits, and authentication event history.
Billing & entitlements
Stripe Prices drive checkout; lifecycle webhooks update organization subscriptions and capability checks.
Credit accounting
An append-only, traceable ledger connects purchases, grants, task spending, reversals, and balances.
Organizations & teams
Personal and shared workspaces, invitations, roles, last-owner protection, and pooled resources.
Storage & jobs
Private S3-compatible objects, signed access, generated outputs, lifecycle state, and a durable retryable database queue.
Operator console
A separately deployed admin application with MFA, read/write roles, job recovery, audit events, and billing visibility.
Content & lifecycle
An independently deployed Payload studio, signed marketing gateway, consent records, account exports, and delayed erasure.
Release operations
OpenTelemetry, structured logs, migration integrity, backups, restore drills, retention, containers, and launch checks.
Runnable reference workflow
One image request crosses the whole SaaS backbone.
The local image provider is deliberately simple. The value is the production-shaped chain around it: one request key, one five-credit spend, durable execution, private output, and a refund that can recover after a crash.
Read the complete implementation guideAuthorize
Resolve the member, organization, capability, quota, and same-origin boundary.
Reserve
Persist a fingerprinted task and a deterministic five-credit ledger spend.
Dispatch
Deduplicate a durable job that survives the original HTTP request.
Generate
Call the provider with a stable idempotency identity and bounded retries.
Store
Write and verify a private Garage/S3 object, then return a short-lived signed URL.
Compensate
On terminal failure, restore the spend exactly once before the task becomes failed.
One direction through the codebase.
Routes translate HTTP. Services own invariants. Models own queries. The database owns constraints. Tests stop those boundaries from quietly dissolving.
Routes
Authenticate, validate, and translate HTTP into a business operation.
Services
Coordinate invariants, idempotency, authorization, and side effects.
Models
Provide typed, tenant-aware persistence behind one query boundary.
Database
Enforce uniqueness, ownership, references, and durable state transitions.