Multi-tenant SaaS foundation

Ship your product.
Not the plumbing.

Built for identity from day one.

A quiet, production-minded starting point for SaaS products that need secure users, clean tenant boundaries, and agent access.

Start building Read the guide

MIT licensed · self-hosted · your cloud

A preview of the project dashboard with navigation, project activity, filters, and a project table.

Built on boring, durable primitives

  • Next.js
  • Axum
  • Tokio
  • PostgreSQL
  • OAuth 2.1
  • MCP

The foundation

Everything around your idea,
already handled.

Keep the reliable parts predictable so your team can spend its attention on what customers actually buy.

01

Identity that is already serious

Password auth, generic social OIDC, and opaque browser sessions are wired into one clear flow.

02

Tenant boundaries by default

Workspaces, projects, roles, and scoped API keys keep every customer and environment in the right lane.

03

Agent access you can explain

OAuth 2.1, OIDC, protected-resource discovery, consent, and Streamable HTTP MCP ship together.

A short path to useful

Three boundaries.
One clear flow.

Your users sign in, choose their context, and authorize tools without leaking product-specific decisions across the stack.

  1. 01

    Create a workspace

    Give each customer a clean tenant boundary and a default project.

  2. 02

    Connect your product

    Use the Rust API from the web app, a service, or your own client.

  3. 03

    Authorize an agent

    Grant one project and only the scopes that the agent needs.

Security is the product

Sensible defaults,
visible boundaries.

Credentials are treated like credentials. Tenant context is explicit. Agent grants are narrow and inspectable.

Read the security model
Session storageOpaque & HTTP-only
API credentialsHashed at rest
Agent grantsProject scoped
AuthorizationOAuth 2.1 + OIDC
MCP transportStreamable HTTP

Questions, answered

The useful details.

What is included?

A Next.js app and landing page, an Axum and Tokio API, PostgreSQL persistence, OAuth/OIDC, scoped API keys, and a protected MCP endpoint.

Can I use my own identity provider?

Yes. The starter keeps the OIDC boundary generic so your provider and deployment choices stay yours.

Is this tied to one cloud?

No. The application and infrastructure stay separate, so you can point the same product at the cloud setup you already operate.

Start with the foundation

Build the part only you can build.

Identity, tenancy, and agent access are ready when you are.

Open the app Explore the docs