LastSaaS

Every SaaS product needs the same boring foundation: user accounts, teams, roles, authentication, admin dashboards, billing, usage limits, branding, webhooks, API keys. Historically, building that foundation meant weeks of plumbing before you could write a single line of your actual product.

LastSaaS eliminates that. Fork it, point an AI agent at it, and start building your product on top of a foundation that already handles:

- Multi-tenant isolation with role-based access
- JWT authentication with refresh token rotation
- Google, GitHub, and Microsoft OAuth integration
- Magic link passwordless authentication
- MFA/TOTP with recovery codes
- Email verification and password resets
- Team invitations and member management
- Stripe billing with subscriptions, per-seat pricing, trials, and credit bundles
- Plan entitlements and billing enforcement middleware
- White-label branding with custom themes, logos, landing pages, and custom pages
- API key authentication (admin and user scopes)
- Outgoing webhooks with 19 event types and HMAC-SHA256 signing
- Credit-based usage tracking (subscription + purchased buckets)
- Promotion codes and coupon management via Stripe
- Product analytics dashboard (conversion funnel, KPIs, retention cohorts, engagement metrics)
- Telemetry event system with Go SDK and REST API for custom event tracking
- A full admin interface for managing everything
- Built-in API documentation (HTML and Markdown)
- Real-time system health monitoring
- Financial metrics dashboard (revenue, ARR, DAU, MAU)
- MCP (Model Context Protocol) server for AI-powered admin access
- CLI tools for server administration
- Auto-versioning with database migrations
- Production deployment on Fly.io

This is open-source infrastructure for the agentic era of software — where the person with the idea is also the person who ships it. The codebase follows consistent patterns that AI agents navigate fluently, so you can keep evolving it the same way it was built.

If you're evaluating SaaS boilerplates, you've probably looked at ShipFast, Supastarter, MakerKit, SaaS Pegasus, and Gravity. Here's why technical founders choose LastSaaS instead.

Free and open-source.ShipFast costs $169, MakerKit runs $199–599, Supastarter starts at $299, SaaS Pegasus charges $249/year, and Gravity is under $1K. LastSaaS is MIT-licensed — fork it, ship it, never pay a license fee. You own the code completely.

Go backend, not another Next.js project.ShipFast, Supastarter, MakerKit, and Gravity are all JavaScript/TypeScript stacks. SaaS Pegasus uses Django. LastSaaS pairs a Go backend with a React + TypeScript frontend — giving you compiled-binary deployment, low memory footprint (a 14MB Alpine container), and the concurrency model that Go is known for. If your SaaS will handle real traffic or you want a backend that isn't a Node.js monolith, this matters.

Genuine multi-tenancy.ShipFast has no multi-tenancy at all. SaaS Pegasus and Gravity offer basic team features but not true tenant isolation. LastSaaS gives you full multi-tenant architecture: tenant-scoped data isolation, three-tier RBAC (owner/admin/user), team invitations, ownership transfer, per-tenant activity logs, and per-tenant billing. This is the difference between "users can collaborate" and "each customer gets their own isolated workspace."

White-label branding built in.Most boilerplates give you a theme toggle at best. LastSaaS includes a full white-label system: custom app name, logo, colors, fonts, landing page, custom pages, CSS injection, favicon, configurable navigation with entitlement gating, and auth page customization. If you're building a platform where customers see your brand (not yours-plus-a-framework), this saves weeks.

Outgoing webhooks, not just Stripe webhooks.None of the alternatives — ShipFast, Supastarter, MakerKit, SaaS Pegasus, or Gravity — include an outgoing webhook system. LastSaaS ships with 19 event types across billing, team lifecycle, user lifecycle, credits, and security events, with HMAC-SHA256 signing, delivery tracking, and test events. Your customers can integrate with your platform from day one.

API keys with scoped access.ShipFast, Supastarter, and MakerKit don't include API key management. LastSaaS provideslsk_-prefixed API keys with admin and user authority scopes, SHA-256 hashed storage, and last-used tracking — ready for your customers to build integrations.

Health monitoring and financial dashboards.No competing boilerplate includes system health monitoring. LastSaaS collects CPU, memory, disk, HTTP, and MongoDB metrics every 60 seconds across all nodes, with 8 real-time charts, threshold alerting, and 30-day retention. The financial dashboard gives you revenue, ARR, DAU, and MAU time-series out of the box.

MCP server for AI-native operations.This is unique to LastSaaS. A built-in Model Context Protocol server with 32 read-only tools lets you connect Claude (or any MCP-compatible AI) directly to your running application. Query your ARR trend, investigate error spikes, audit API keys, or review system health — all in natural language. No other SaaS boilerplate offers agentic admin access.

Built for AI-assisted development.LastSaaS was built entirely through conversation with Claude Code, and the codebase is designed to keep being built that way. Consistent patterns, clear naming, and a structure AI agents navigate fluently. Fork it, point an agent at it, describe your product, and keep going. The competing boilerplates were built for manual development — LastSaaS is built for the way software is made now.

- Root tenant (system admin) + customer tenants
- Users belong to tenants via memberships
- Roles:owner,admin,userwith hierarchical permissions
- Team invitations with email notifications
- Ownership transfer between members
- Per-tenant activity log
- Tenant settings self-service

- Subscription planswith monthly and annual billing (configurable annual discount %)
- Pricing models: flat-rate or per-seat (with included seats, min/max seat limits)
- Free trialswith configurable trial days per plan and trial abuse prevention
- Credit bundlesfor one-time purchases
- Dual credit buckets: subscription credits (reset or accrue) + purchased credits
- Stripe Checkout(redirect-based) for payment collection
- Stripe Billing Portalfor customer self-service (payment methods, invoices)
- Multi-currency supportwith configurable default currency
- Stripe Taxautomatic tax calculation
- Promotion codes and coupons— create and manage via admin UI, linked to Stripe
- Invoice generation— sequential invoice numbers, PDF download, tax breakdown
- Transaction history— per-tenant and admin-wide with search and filtering
- Financial metrics— revenue, ARR, DAU, MAU time-series with charting
- Billing enforcement middleware— blocks expired subscriptions from paid features
- Entitlement middleware— gate features based on plan (boolean and numeric entitlements)
- Billing waiverfor special accounts (root tenant, demo accounts)
- Admin subscription management— cancel, modify, reassign plans
- Refund and dispute handling— webhook handlers forcharge.refunded,charge.dispute.created,charge.dispute.closed

- Custom app name, tagline, and logo (text, image, or both modes)
- Theme colors (primary, accent, background, surface, text) with auto-generated shade palettes
- Custom fonts (body and heading)
- Custom landing page with configurable HTML
- Custom pages served at/p/{slug}with SEO metadata
- Custom CSS injection
- Custom head HTML injection (analytics, meta tags)
- Favicon upload
- Media library for image/asset management
- Configurable navigation sidebar with entitlement-gated items
- Auth page customization (login/signup headings and subtext)
- Dashboard HTML customization
- Open Graph image support

- Create API keys withlsk_prefix
- Two authority levels:admin(auto-resolves root tenant) anduser(requires X-Tenant-ID)
- SHA-256 hashed storage — raw key shown only at creation
- Last-used timestamp tracking
- Admin UI for key management
- Supports both JWT and API key authentication on all endpoints

- 19 event types across 5 tiers:

- Billing: subscription.activated, subscription.canceled, payment.received, payment.failed
- Team lifecycle: member.invited, member.joined, member.removed, member.role_changed, ownership.transferred
- User lifecycle: user.registered, user.verified, user.deactivated
- Credits & billing: credits.purchased, plan.changed, tenant.created, tenant.deactivated
- Audit & security: user.deleted, tenant.deleted, api_key.created, api_key.revoked

- Dashboardwith user/tenant counts, health overview, and business metrics
- User management— list, search, view profiles, edit, suspend, impersonate, delete with ownership preflight
- Tenant management— list, view, edit, plan assignment, status control, subscription management
- Financial overview— transaction history across all tenants, revenue/ARR/DAU/MAU charts
- Product analytics— conversion funnel, SaaS KPIs, retention cohorts, engagement metrics, custom event explorer
- Plan management— create, edit, archive, entitlements, per-seat configuration, trial days
- Credit bundle management— create, edit, sort, activate/deactivate
- Promotions— create and manage Stripe promotion codes and coupons
- Branding editor— theme colors, logos, fonts, landing page, custom pages, CSS, navigation
- API key management— create, view, revoke
- Webhook management— create, edit, delete, test, view delivery history
- Announcements— publish system-wide announcements
- System log viewerwith severity filtering, search, and user filtering
- Configuration variable editor(strings, numbers, enums, templates)
- In-app messaging— send messages to individual users
- Root members— manage the admin team with invitations and role changes
- CSV exportfor users and tenants
- Admin impersonation— log in as any user for debugging
- System health monitoring(see below)
- Integration health checks— MongoDB, Stripe, Resend, Google OAuth status
- Three-tier admin access:user(read-only),admin(read-write),owner(destructive operations)

- Automatic node registration with heartbeat (30s interval)
- Metrics collection every 60s: CPU, memory, disk, network, HTTP request stats, MongoDB stats, Go runtime
- HTTP metrics middleware with percentile latency tracking (p50/p95/p99)
- Threshold-based alerting (configurable warning/critical levels)
- 30-day automatic data retention via MongoDB TTL indexes
- Real-time dashboard with 8 time-series charts (Recharts)
- Aggregate, all-nodes overlay, and single-node filter modes
- Time range selection: 1h, 6h, 24h, 7d, 30d
- Integration health panel (MongoDB, Stripe, Resend, Google OAuth connectivity)

- Profile editing (display name, email)
- Theme preference (light/dark)
- Password management
- MFA setup and management
- Session viewer with remote revocation
- Account deletion with data cleanup
- Data export (GDPR-friendly)
- Billing management (plan selection, credit purchases, invoice history, PDF download)
- Onboarding flow

- Interactive HTML API reference at/api/docswith expandable endpoint details
- Markdown API reference at/api/docs/markdownfor integration in external docs
- Comprehensive webhook event reference with payload descriptions
- Auto-versioned from the VERSION file

- 32 read-only toolsacross 14 categories — no write operations, safe by design
- 2 resources—lastsaas://dashboardandlastsaas://healthfor automatic context
- API key authentication— requires a root-tenant API key, same auth as the admin API
- Stdio transport— runs locally, compatible with Claude Desktop and Claude Code

- About— software version and environment
- Dashboard— user/tenant counts, health overview
- Tenants— list with filtering, detailed view with members
- Users— list with search, detailed view with auth methods and memberships
- Financial— transaction history, revenue/ARR/DAU/MAU time-series metrics
- Logs— full-text search with severity/category/date filters, severity counts
- Health— current system metrics, time-series health data, node list, integration status
- Config— list and inspect runtime configuration variables
- Plans— plan details, entitlement keys, credit bundles
- Announcements— list published and draft announcements
- Promotions— Stripe promotion codes with coupon details
- Security— API key inventory (previews only), root tenant members
- Webhooks— webhook configs, event type reference, delivery history

- Security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
- Rate limiting on authentication endpoints
- Request body size limits
- NoSQL injection protection (regex input escaping)
- XSS protection via DOMPurify for injected HTML
- Trusted proxy IP resolution (Fly-Client-IP)
- Webhook signature verification (Stripe inbound, HMAC-SHA256 outbound)
- Idempotent webhook processing via unique event ID index
- System log injection detection with automatic critical alerts
- Refresh token rotation with family-based revocation

- Dockerized multi-stage build (Go + Node + Alpine)
- Fly.io deployment with auto-stop/auto-start machines
- SPA serving from the Go binary (no separate web server needed)
- CORS, security headers, rate limiting
- Graceful shutdown with connection draining
- Auto-versioning with database migration on startup
- Version notification messages to admin users after upgrades

git clone https://github.com/jonradoff/lastsaas.git cd lastsaas

- Database name— the project identity (two projects sharing a name share the same user base)
- MongoDB URI— your Atlas connection string ormongodb://localhost:27017
- JWT secrets— auto-generated
- Google OAuth credentials— optional, press Enter to skip
- Resend API key— optional, press Enter to skip
- App name and email settings

It writes a.envfile and copies the config template.

set -a && source .env && set +a cd backend go run ./cmd/server

The server starts onhttp://localhost:4290.

set -a && source .env && set +a cd frontend npm install npm run dev

The frontend starts onhttp://localhost:4280.

Run the CLI setup to create the root tenant and admin account:

This creates the root tenant (your admin organization) and the owner account. You can now log in athttp://localhost:4280.

Stripe integration is optional but required for paid subscriptions, credit bundle purchases, and invoice generation. If you skip this section, LastSaaS works as a free-tier-only platform.

Go toStripe Dashboard → Developers → API keysand copy:

- Publishable key(starts withpk_test_orpk_live_)
- Secret key(starts withsk_test_orsk_live_)

Go toStripe Dashboard → Developers → Webhooks → Add endpoint:

- Endpoint URL:https://your-domain.com/api/billing/webhook

- For local development with the Stripe CLI:stripe listen --forward-to localhost:4290/api/billing/webhook

- checkout.session.completed
- invoice.paid
- invoice.payment_failed
- customer.subscription.updated
- customer.subscription.deleted
- charge.refunded
- charge.dispute.created
- charge.dispute.closed

After creating the endpoint, copy theSigning secret(starts withwhsec_).

STRIPE_SECRET_KEY=sk_test_... STRIPE_PUBLISHABLE_KEY=pk_test_... STRIPE_WEBHOOK_SECRET=whsec_...

Once the backend is running with Stripe configured:
- Log in as the root tenant owner
- Go toAdmin → Plansand create your subscription plans
- Set pricing, billing intervals, trial days, entitlements, and credit allocations
- Optionally createcredit bundlesunder Admin → Credit Bundles
- Optionally createpromotion codesunder Admin → Promotions

Stripe Products and Prices are created automatically when customers check out — you don't need to configure anything in the Stripe Dashboard beyond the API keys and webhook.
- Switch tolive modein the Stripe Dashboard
- Create a new webhook endpoint with your production URL and the same 8 events
- Update your production environment variables with the live keys and webhook secret

- dev.example.yaml/prod.example.yaml— committed templates
- dev.yaml/prod.yaml— your actual configs (gitignored)

SetLASTSAAS_ENV=devorLASTSAAS_ENV=prodto select which config to load. Defaults todev.

Secrets are referenced as${ENV_VAR}in YAML and expanded from environment variables at load time. Default values use${VAR:default}syntax.

lastsaas/ backend/ cmd/ server/main.go Entry point (HTTP server, route wiring) lastsaas/main.go CLI administration tool + MCP server config/ YAML config files internal/ api/handlers/ HTTP handlers (auth, admin, tenant, billing, branding, webhooks, etc.) apicounter/ API call counters for integration health auth/ JWT, password hashing, Google/GitHub/Microsoft OAuth, TOTP MFA config/ Config loader with env variable expansion configstore/ Runtime configuration (DB-backed, cached) db/ MongoDB connection, collections, indexes email/ Resend email service with templates events/ Internal event emitter (drives webhook deliveries) health/ System health monitoring service middleware/ Auth, tenant, RBAC, rate limiting, metrics, security, billing enforcement models/ All data models planstore/ Plan seeding stripe/ Stripe service (Checkout, Billing Portal, Customers, Prices, Subscriptions) syslog/ System logging service with injection detection telemetry/ Telemetry event collection, Go SDK, and PM analytics queries version/ Version management and auto-migration frontend/ src/ api/client.ts Axios API client with token refresh components/ Layout, AdminLayout, BrandingThemeInjector, shared components contexts/ Auth, Tenant, and Branding React contexts pages/ admin/ Admin interface (dashboard, users, tenants, plans, billing, branding, etc.) admin/health/ Health monitoring components and charts app/ Customer-facing pages (dashboard, billing, team, settings, activity) app/settings/ User settings tabs (profile, security, MFA, sessions, billing) auth/ Login, signup, MFA challenge, magic link, verification, password reset public/ Landing page and custom pages types/index.ts TypeScript type definitions scripts/ setup.sh Interactive setup script Dockerfile Multi-stage production build fly.toml Fly.io deployment config VERSION Current version number

LastSaaS includes built-in, self-hosted API documentation:

- Interactive HTML reference:GET /api/docs— expandable endpoint cards with request/response examples
- Markdown reference:GET /api/docs/markdown— for embedding in external documentation

The documentation is generated from code and always matches the running version. It covers all endpoints, parameters, request/response formats, and all 19 webhook event types with payload descriptions.

The MCP server lets AI assistants query your admin data in natural language. It proxies read-only requests to the LastSaaS admin API using an API key.
- A running LastSaaS instance (local or deployed)
- A root-tenant API key — create one inAdmin → API Keyswithadminauthority

Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.jsonon macOS):