VerifiedStack Lite

Production-grade auth & organizations starter for Next.js —
passkeys, 2FA, OAuth, multi-tenant orgs with RBAC, transactional email. MIT.

Live demo · Quickstart · Lite vs Core · Full kit

_{The identity-verification flow from VerifiedStack Core — running on the auth & organization foundation in this repo.}

---

Lite is the open-source base of VerifiedStack, the KYC-ready SaaS starter. It's the complete auth and organization layer the paid kit is built on — released whole, under MIT, because you should be able to read real code before trusting a starter with your sign-in flow. No crippled features, no login-to-download, no nag screens. What's here is finished.

What's inside

• Authentication (Better-Auth) — email/password with verification emails, passwordless sign-in via emailed one-time codes, Google & GitHub OAuth (buttons appear only when keys are configured), passkeys (WebAuthn), TOTP two-factor with backup codes, Cloudflare Turnstile bot protection, and rate limiting.
• Organizations — multi-tenant orgs with invitations, role-based access (owner / admin / reviewer / member), an onboarding flow, and member management. Sessions land users in their active organization server-side.
• Transactional email — react-email templates behind a pluggable transport: Resend, any SMTP relay, or console logging in development. The app runs with zero email configuration.
• Demo mode — DEMO_MODE=1 turns a deployment into a safe public sandbox: seeded accounts, one-click sign-in, frozen credentials on shared accounts, suppressed outbound email, nightly reset. It's exactly how demo.verifiedstack.app runs.
• Stack — Next.js 16 (App Router, RSC), TypeScript strict, Postgres + Drizzle ORM, Tailwind + shadcn/ui, pnpm workspaces. Ships as a monorepo with clean package seams (auth, db, email, config).

Quickstart

Everything runs in Docker — no local Node required.

git clone https://github.com/verifiedstack/verifiedstack-lite
cd verifiedstack-lite
cp .env.example .env   # defaults work out of the box
docker compose up      # postgres → migrations → app on localhost:3000

For development with hot reload:

docker compose -f docker-compose.yml -f docker-compose.dev.yml up

Optional demo/dev data (one org, two accounts):

docker compose run --rm seed

Prefer local Node? pnpm install, point DATABASE_URL at a Postgres, then pnpm db:migrate && pnpm dev.

Going to production

• Set a real BETTER_AUTH_SECRET (openssl rand -base64 32) and your public APP_URL.
• Turn on REQUIRE_EMAIL_VERIFICATION=1 and configure an email transport.
• Put a reverse proxy in front of the app container (it binds to localhost) and forward x-real-ip, or rate limiting will treat all traffic as one client.
• Vercel works too: import the repo, set the env vars, use a managed Postgres.

Lite vs Core

Lite is a complete auth starter — and deliberately not more. The paid kit, VerifiedStack Core, is this codebase plus the identity-verification layer for teams shipping regulated products:

	Lite (this repo)	Core
Email/password, OAuth, passkeys, email codes, TOTP 2FA	✅	✅
Organizations, invites, RBAC	✅	✅
Transactional email (Resend / SMTP / console)	✅	✅
Demo mode	✅	✅
KYC pipeline — provider-agnostic, mock provider included, documents never touch your servers	—	✅
Manual review queue, operable by a compliance analyst	—	✅
Append-only audit trail	—	✅
Stripe billing: tiers + metered per-verification usage	—	✅
Data retention, DSAR export, consent capture	—	✅
Updates	free forever	12 months, renewable

Contributing & support

This repo is assembled from our private monorepo by an exporter, so the code here always matches a paid release's foundation. Issues are welcome and triaged weekly. Bug-fix PRs are appreciated — they're applied upstream and ship here with the next release, so your commit may land rebased. Feature scope is deliberately tight: if it isn't auth, orgs, email, or demo mode, it probably belongs in a discussion first.

License

MIT — use it for anything, including commercial products.