# boxyhq/saas-starter-kit: An Enterprise Next.js SaaS Boilerplate

> A TypeScript and Next.js starter kit that wires SAML SSO, directory sync, Stripe billing, audit logs and webhooks into one codebase. It is aimed at teams selling to businesses, and it is heavier than a generic SaaS template.

**boxyhq/saas-starter-kit** — 🔥 Enterprise SaaS Starter Kit - Kickstart your enterprise app development with the Next.js SaaS boilerplate 🚀

- Repository: https://github.com/boxyhq/saas-starter-kit
- Website: https://boxyhq.com/blog/enterprise-ready-saas-starter-kit
- Stars: 4,940 · Forks: 1,234
- Language: TypeScript
- License: Apache-2.0
- Published: 2026-09-23 · Updated: 2026-09-23 · Language: en
- Canonical page: https://hysenlabs.com/projects/boxyhq-saas-starter-kit

## Who boxyhq/saas-starter-kit is built for

Most SaaS templates solve the same small set of problems: signup, login, a dashboard, a Stripe checkout. This one targets a narrower buyer. The README describes it as "the Open Source Next.js SaaS boilerplate for Enterprise SaaS app development", and the dependency list backs that up. It ships SAML Jackson for SAML SSO and Directory Sync, Svix for webhook orchestration, Retraced for audit logs, and Stripe for payments. Those are the features that appear on an enterprise procurement checklist, and they are the ones a solo developer usually postpones until a large customer asks for them.

The intended user is a small product team selling to companies rather than individuals. If your first customer will ask "do you support SSO with Okta" before signing, the value is in the SSO, directory sync and audit log layers, not in the login page. If your customers are consumers paying monthly by card, the same layers are overhead you will carry and never switch on.

## How the pieces fit together

The repository is a Next.js application in TypeScript, styled with Tailwind CSS, with Prisma as the ORM against Postgres. The layout confirms the split: pages/ and components/ for the UI, lib/ and models/ for logic and data access, prisma/ for the schema and seed script, locales/ for translations, and tests/ for Playwright end-to-end specs. Authentication runs through NextAuth.js, configured in pages/api/auth/[...nextauth].ts, with a Prisma adapter storing sessions and accounts.

Two design choices stand out. First, Jackson is embedded by default, so SSO works without a separate service; the .env.example shows commented JACKSON_URL, JACKSON_EXTERNAL_URL, JACKSON_API_KEY, JACKSON_PRODUCT_ID and JACKSON_WEBHOOK_SECRET variables for pointing at a self-hosted or hosted Jackson instead. Second, third-party services are optional at the edges. Svix, Retraced, Mixpanel and the OpenTelemetry metrics exporter all have empty or commented environment variables in .env.example, which suggests the app runs without them and degrades to no webhooks, no audit trail and no metrics.

## Installing it and getting the dev server up

The README lists Node.js 18 or later, PostgreSQL, npm and Docker Compose as prerequisites. The bundled docker-compose.yml starts only a database, nothing else, which keeps the local loop short. The README's setup steps are to fork the repository, clone your fork, enter the directory and install dependencies.

```bash
git clone https://github.com/<your_github_username>/saas-starter-kit.git
cd saas-starter-kit
npm install
```

Next, copy .env.example to .env and fill it in. The README's step 4 is "Set up your .env file", and the example file carries the keys you need. NEXTAUTH_SECRET should be a random 32-character value; the file itself suggests generating one with openssl rand -base64 32. The DATABASE_URL must match the credentials in docker-compose.yml, where the user and password are both admin and the database is saas-starter-kit.

```bash
docker compose up -d
cp .env.example .env
```

The dev script runs Next.js on port 4002, and NEXTAUTH_URL and APP_URL in .env.example both point at http://localhost:4002, so the defaults line up.

```bash
npm run dev
```

You should see the Next.js dev server start and the app respond at http://localhost:4002. The build script is worth noting because it is not a plain Next build: it runs prisma generate and prisma db push before next build, so the database schema is pushed as part of the build rather than through a separate migration step.

## The enterprise features are the reason to pick it

SAML Jackson handles SSO and directory sync. The README says it "Provides SAML SSO, Directory Sync", and the implementation sits in the authentication files. The .env.example adds a detail that matters in practice: GROUP_PREFIX, described as a way to prefix SSO groups so they do not collide with other groups, with boxyhq-admin resolving to admin. That is the kind of mapping problem that only appears once a real identity provider is feeding you groups.

Svix emits events on user and team CRUD operations, per the README, so downstream systems can react to changes. Retraced records who did what and when. Both are the sort of capability that enterprise buyers ask about during security review, and both are wired in rather than left as an exercise. The .env.example also exposes CONFIRM_EMAIL and DISABLE_NON_BUSINESS_EMAIL_SIGNUP, two switches that exist because business signups and consumer signups have different verification needs.

## Where it will fight you

The stack is opinionated and the opinions are load-bearing. Postgres is required, Prisma is the data layer, and NextAuth.js owns authentication. Swapping the database or the auth provider is not a configuration change; it is a rewrite of the parts that touch sessions, accounts and teams. Teams that already have an auth system, or that have standardized on a different ORM, will spend their time removing code rather than adding it.

The external services are a second constraint. Svix, Retraced and the OpenTelemetry exporter are configured through environment variables, and the README does not document what happens to webhook delivery, audit logging or metrics when those variables are empty. The app may start, but the enterprise features that justified choosing this kit may be silently absent. There is also no documented rollback procedure, and no migration history beyond prisma db push, which the build script runs against whatever database it is pointed at. Treat the build step as something to inspect before running it against production data.

The maintenance signal deserves a plain statement. The last push to the repository was on 2026-07-20, and the most recent tagged release is v1.6.0 from 2024-12-24. The repository is not archived, but the gap between the last release and the last commit is worth understanding before you plan upgrades.

## How it differs from a generic SaaS boilerplate

A general-purpose Next.js SaaS template typically gives you authentication, a dashboard, a subscription checkout and email. It assumes your customers are individuals and that "SSO" means Google or GitHub login. boxyhq/saas-starter-kit assumes the opposite: your customers are organizations, they arrive with an identity provider, and they will ask for an audit trail. That is why SAML Jackson, Svix and Retraced are in the dependency list rather than optional add-ons.

The practical difference shows up in the data model and the environment file. There is a GROUP_PREFIX setting for mapping identity provider groups, a JACKSON_PRODUCT_ID for scoping SSO connections, and a team-level flow rather than a user-level one. A generic template would leave all of that to you. The trade-off is that you inherit a heavier dependency tree and more moving parts on day one, including services you may not enable until your third customer.

## Licence and upgrade cost

The project is Apache-2.0, which permits commercial use, modification and distribution, and includes a patent grant. The README does not describe any additional terms, and the repository carries a LICENSE file at the top level. The bundled third-party services are separate products with their own terms: Svix, Retraced and Stripe are not covered by the Apache licence, and the .env.example points SVIX_URL at https://api.eu.svix.com, which is a hosted endpoint rather than something you run yourself. If you self-host Retraced instead, you take on operating it.

Upgrade cost tracks the dependency list. Major versions of @boxyhq/saml-jackson, @prisma/client and @sentry/nextjs will each need attention, and the release history shows a v1.5.x series through 2024 followed by v1.6.0 in December 2024. The repository has a release-it configuration and a release script that merges main into a release branch, so versioning is deliberate. Before upgrading, check whether the Prisma schema changed, because the build script pushes the schema rather than applying a migration.

## Conclusion

Adopt boxyhq/saas-starter-kit if you are building a B2B product and would otherwise spend weeks wiring SAML SSO, SCIM-style directory sync, audit logs and Stripe subscriptions yourself, and you are willing to run Postgres plus optional external services. Do not adopt it for a consumer app or a single-tenant internal tool: the enterprise surface is dead weight there, and the stack assumes Next.js pages, Prisma and a relational database. Before committing, run npm install and npm run dev against the bundled docker-compose Postgres, then open the SAML SSO setup flow under a team and confirm it works with the identity provider your first customer actually uses. If your buyer's IdP is not on that list, the kit has not saved you the integration you needed.

## FAQ

### What is boxyhq/saas-starter-kit?

It is an open source Next.js SaaS boilerplate in TypeScript, described in its README as being for enterprise SaaS app development. It bundles SAML SSO and directory sync through SAML Jackson, webhooks through Svix, audit logs through Retraced, Stripe payments, and Playwright end-to-end tests.

### Is boxyhq/saas-starter-kit free to use?

The repository is licensed under Apache-2.0, which allows commercial use and modification. The third-party services it integrates with, such as Stripe, Svix and Retraced, are separate products with their own terms and are not covered by that licence.

### What do I need installed before running boxyhq/saas-starter-kit?

The README lists Node.js 18 or later, PostgreSQL, npm and Docker Compose as prerequisites. The bundled docker-compose.yml starts a postgres:16.4 container with the user and password both set to admin and the database named saas-starter-kit.

### Which port does boxyhq/saas-starter-kit run on?

The dev and start scripts both pass --port 4002 to Next.js, and NEXTAUTH_URL and APP_URL in .env.example point at http://localhost:4002. The docker-compose database publishes port 5432.

### Can I use boxyhq/saas-starter-kit without running SAML Jackson separately?

Yes. Jackson is embedded by default, and the .env.example keeps JACKSON_URL, JACKSON_EXTERNAL_URL, JACKSON_API_KEY, JACKSON_PRODUCT_ID and JACKSON_WEBHOOK_SECRET commented out for the case where you want to point at a self-hosted or hosted Jackson instead.

## Sources

- [boxyhq/saas-starter-kit on GitHub](https://github.com/boxyhq/saas-starter-kit)
- [License: Apache-2.0](https://github.com/boxyhq/saas-starter-kit/blob/main/LICENSE)
- [Project website](https://boxyhq.com/blog/enterprise-ready-saas-starter-kit)
- [README](https://github.com/boxyhq/saas-starter-kit/blob/main/README.md)
- [Releases](https://github.com/boxyhq/saas-starter-kit/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/boxyhq-saas-starter-kit