home/store/Crypto SaaS Starter Kit Crypto SaaS Starter Kit
The exact Next.js + Supabase + crypto-payments stack behind degenjournal.xyz — extracted, cleaned, MIT-licensed.
I built degenjournal.xyz — a crypto trading journal with magic-link auth, crypto checkout, and read-only on-chain wallet imports — and kept hitting the same wall every crypto SaaS hits: the boring plumbing that every project needs and no boilerplate does well for crypto specifically.
So I extracted it. This is the real auth, payment, and wallet-reading code that runs in production at degenjournal.xyz — genericised, documented, and MIT-licensed. Not a toy. Not AI-generated filler. The actual stack, proven by a live app you can go use right now.
And the payment paths have been through an adversarial code audit — the kind of review that catches the money bugs you only find in production. Two real ones got fixed and baked into the kit: ledger-based webhook idempotency (a duplicate payment notification can't double-grant) and a lifetime-plan guard (a one-time customer can't be silently downgraded). You get the hardened version, with the reasoning written up in the guide.
The stack
Next.js 16React 19TypeScriptSupabase (Postgres + RLS)NowPayments (crypto)Lemon Squeezy (card)Helius (Solana)Hyperliquid APITailwind CSS v4Vercel (deploy + cron)
See it running
The kit powers the live app below. A full code walkthrough video drops at launch.
▶
2-min code walkthrough
dropping at launch
What's included — public MIT repo
Free and open. The $29 adds the Pro repo + guide below.
✓ Supabase magic-link auth
Passwordless email auth via @supabase/ssr — server client, browser client, middleware session refresh, and the /auth/callback exchange. Sign-in/out wired end to end.
✓ Plan-gated routes pattern
A clean free/pro/lifetime entitlements model: a single source-of-truth entitlements map, a server-side requirePro() guard, a <ProGate> client component, and a /api/account/plan endpoint.
✓ NowPayments crypto checkout
Hosted crypto checkout (USDC/SOL/ETH/BTC) — invoice creation lib, a per-plan checkout route, and an IPN webhook that verifies the HMAC signature before granting access. Hardened: a payment-ledger makes the webhook idempotent (no double-grant on retries) and a guard prevents downgrading a lifetime customer.
✓ Helius Solana wallet read
Read-only Solana wallet reader — paste any address, pull its swap history from Helius. No wallet connection, no private keys, never touches funds.
✓ Hyperliquid wallet read
Read-only Hyperliquid perp reader against the public info endpoint — paged userFills with a polite rate cap. No API key, no signing.
✓ users table + RLS migrations
SQL migrations for a users table and row-level-security policies where the client can read its own row but only the service role can grant plan upgrades — the pattern that makes self-upgrade impossible.
✓ Pricing / signup / dashboard scaffolds
Working /pricing, /signup, and /dashboard pages wired to the auth + plan + checkout flow above, in a dark Tailwind theme you can restyle.
✓ .env.example + README
Every required key documented (Supabase, Helius, NowPayments) and a step-by-step setup README that gets you running locally and deployed to Vercel.
Private Pro repo — unlocked with purchase
Collaborator access auto-granted to your GitHub after checkout.
★ Lemon Squeezy card-payment webhook
The full signature-verified, idempotent LS webhook that's the only thing that can upgrade a user — subscription + lifetime handling, all events.
★ Plan-expiration daily cron
A Vercel cron route that expires lapsed passes so access actually ends when it should.
★ Webhook signature verification + idempotency
The constant-time HMAC verification helper and the append-only payment-ledger pattern that makes re-delivered webhooks safe — the exact fix from the audit, with the single-column footgun it replaces explained.
★ Trade-import pipeline patterns
The reusable importer pattern: fetch → normalise → dedupe by tx → upsert under the user's id (RLS-scoped), shared across the Solana and Hyperliquid importers.
Be clear-eyed — what this is not
- •It is not a no-code product — you'll need to be comfortable with TypeScript, Next.js and SQL.
- •It does not include DegenJournal's product-specific UI (journal, AI sentiment scoring, scorecards) — those stay proprietary.
- •Crypto checkout requires your own NowPayments account; card checkout requires your own Lemon Squeezy account. The kit wires the integration; you bring the merchant accounts.
Who this is for
✓Indie hackers shipping a crypto or web3 SaaS who don't want to rebuild auth, payments, and on-chain reads from scratch.
✓Developers who want crypto checkout that actually works — signature-verified, idempotent webhooks — instead of gluing it together from docs at 2am.
✓Anyone who'd rather start from production-proven code (live at degenjournal.xyz) than from an untested boilerplate.
vs. other starter kits
Most Next.js starter kits (ShipFast, Makerkit, and friends) are built Stripe-first — great for cards, but none ship a verified, idempotent crypto-payment webhook out of the box. This kit is crypto-native: NowPayments checkout, HMAC-verified IPN, a payment-ledger that survives duplicate notifications, plus read-only Solana/Hyperliquid wallet imports. It's the part those kits leave you to figure out alone — and it's already running in production.
FAQ
Is this real code or AI-generated boilerplate?
Real code. Every module is extracted from degenjournal.xyz, which is live and built on exactly this stack. The auth, crypto checkout, and wallet-reading code is the same code running in production.
What do I actually get for $29?
The public repo is MIT and free to anyone. The $29 gets you collaborator access to the private Pro addon repo (card-payment webhook, expiration cron, import pipeline patterns) plus the ~50-page implementation guide PDF. Launch price; it goes to $49 after the first 30 days.
Is the payment code actually safe?
It's been through an adversarial code audit and the fixes are baked in: webhook signatures are HMAC-verified before anything happens, idempotency uses an append-only payment ledger (so a duplicate or delayed payment notification can't grant twice), a guard stops a lifetime customer being downgraded, and plan state is service-role-only behind RLS so no user can self-upgrade. The guide walks through each of these and why the naive version is wrong. It's not a third-party security certification — it's the same hardening the live app runs.
How do I get the private repo access?
At checkout you enter your GitHub username. The moment payment clears, a webhook adds you as a collaborator on the private Pro repo automatically. Check your GitHub notifications for the invite.
What's the license?
The public starter repo is MIT — use it in commercial projects, no attribution required. The private Pro repo is licensed for your own projects (not for resale as a competing kit).
Does it lock me into any vendor?
Auth is Supabase, crypto checkout is NowPayments, card is Lemon Squeezy, Solana data is Helius — all swappable. The code uses plain fetch against documented APIs (no heavy SDKs) so you can see and change every integration.
What's the refund policy?
The full public repo is MIT and free, so you can inspect the code quality before buying — the $29 is for the private Pro repo + guide, which are delivered immediately on payment. Because access is granted instantly and payment is in crypto (final once on-chain), purchases are non-refundable. If a Pro file is genuinely missing or broken, email us and we'll fix it or refund — we want this to be the kit you recommend.
Ship your crypto SaaS this weekend, not next month.
Get the kit · $29 →Pay with crypto today. $29 launch price — first 30 days, then $49.
