Auth, billing, email and workflows. One SDK, one console.
Turn on sign-in methods, plans, emails and automations in the console, then call them from your React app with one npm package.
Dashboard
AcmeLaunch day. One console for the whole backend. Sign-ups are arriving and every one is already an event.
A demo workspace for a fictional company. Yours will look different. Open the real one
Production products built on BuildBase
All 6 are ours. We built the platform for them first, and every module on this page runs their sign-in, billing and email today.
Turn it on in the console. It is in your app.
Sign-in methods are configuration, not code. Enable a provider and your hosted sign-in page has it, on your own domain, with sessions handled.
- OAuth 2.0 with Google, LinkedIn, GitHub, Microsoft and Apple, and one OpenID Connect or OAuth 2.0 provider of your own
- Magic links and email sign-in codes, without a password
- Passkey (WebAuthn) sign-in
- SMS sign-in codes through your own provider: text message, WhatsApp or voice call, with your Twilio account or a signed webhook
Sign in to Acme
Trial to paid, without a webhook handler
Plans, trials, proration, invoices and quotas run in the module. Your app asks one question: can this workspace do this right now?
- Subscription plans with versioning
- Free trials with automatic conversion
- Usage-based and seat-based billing
- Credit system with ledger tracking
Subscription
Day 12 of 14
Write it once. It sends itself to the right people.
Templates with merge tags, audiences that keep themselves current, and open and click tracking on every send.
- HTML, Markdown, and plain text templates
- Open and click tracking, with mail scanner clicks filtered out
- Bounce and complaint handling for Mailgun and Amazon SES senders, pausing a campaign before it hurts your sender
- Unsubscribe groups, preference centers, and one-click unsubscribe
Subject {{first_name}}, your trial ends in {{trial_ends_in}}
Hi {{first_name}}, your {{plan}} trial ends in {{trial_ends_in}}. Keep your workspace by adding a card.
Unsubscribe group · open and click tracking on
120
Sent
73
Opened
22
Clicked
Every event in your product can start a workflow
A failed payment, a new signup, a form submission. Build the response once in the visual builder and it runs every time, with retries.
- Visual drag-and-drop workflow editor
- Event-based triggers across users, billing, email, forms and more
- Conditional branching and A/B splits
- Wait-for-event steps with timeout
Permissions your UI can read
Define roles in the console, then wrap the button. The SDK resolves what this person may do in this workspace and renders or hides it.
- Built-in admin, editor and viewer permission sets, and the workspace's creator always has everything
- WhenPermission, WhenRoles and WhenWorkspaceRoles for gating UI
- usePermissions() for checks in code
- Your own app permissions next to the built-in ones
Full access to settings, billing, members, and data
Everything that happens, delivered to your endpoint
Subscribe to the events you care about. Each delivery is signed, retried on failure and kept in a delivery log.
- 129 events across users, workspaces, billing, credits, workflows, audience and email
- Subscribe an endpoint to specific events, or to all of them
- HMAC-SHA256 signatures, verified and parsed in one call with parseWebhookEvent()
- Failed deliveries retried with exponential backoff
x-buildbase-signature · signed, retried with backoff, every delivery logged
The 13-vendor stack you don't have to assemble
Every SaaS needs the same backend. The usual way to get it is a subscription per capability, a webhook contract per vendor, and glue code you own forever.
Auth alone typically takes 3-6 weeks to build well, and every vendor on the list is another monthly bill - we published the math. BuildBase ships the same list as 20 integrated modules behind one SDK, so the first thing you build is your product.
Additional modules
The other 14. Every one is on every plan.
User & Audience Management
User profiles, smart lists, and attribute-based audience segmentation.
Access Control (RBAC)
Role-based permissions at the org and workspace level.
Credits & Usage Metering
Credit packs, a transaction ledger, expiry, and per-plan quotas with overage billing.
Feature Flags
Plan-tied workspace flags and user flags targeted by user, list or tag.
Push Notifications
Web push with VAPID keys generated for you, device subscriptions and campaign delivery counts.
Forms & Data Collection
Forms on a collection schema, with a public submit endpoint and workflow triggers on submission.
Content Management
Blog posts, docs, FAQs, testimonials, and reusable rich-content blocks.
Analytics & Reporting
User growth, email performance, click trends and geographic data.
Tracking & Tags
Analytics and ad tags configured in the console, installed by the SDK.
Webhooks & Events
129 subscribable events with signatures, retries and delivery logs.
Short Links
Short links you can repoint, with a click log and destination safety checks.
Collections & Custom Data
Custom data schemas with versioned records and a token-authenticated REST API.
Slack & Team Notifications
Slack alerts for signups, payments, and workflow events.
Assets & Media
Image uploads with captured dimensions and public or private URLs.
One price for the whole backend
From $49/mo for everything on this page. The plans differ in how much you can run, never in what you can use.
- All 20 modules on every plan. You pay for scale, not features.
- 7-day free trial, no credit card.
- Users, emails and workflow runs are allowances, not meters. Going over does not produce a bill.
- Storage is the one exception: $0.10 per GB-month beyond the plan allowance.
- Pay yearly and get twelve months for the price of ten.
Prices in USD. Verified 9 September 2026.
Shipping every week
The most recent release. Every week we ship is written up.
Two-step sign-in, phone and wallet sign-in, and a sign-in page in eight languages
Sign-in grows from a few methods to most of what people expect: two-step sign-in, email and phone codes, Apple and a provider of your own, usernames, wallets, guests and device codes, with bot protection and sign-up rules in front of them. The hosted sign-in page speaks eight languages and carries each app's own name, logo and words. Feature flags targeted at tags or set to allow everyone now turn on in the SDK, a short outage at a webhook endpoint no longer switches it off, and a workflow's delayed steps keep their timing.
- AuthenticationTwo-step sign-in. People add an authenticator app such as Google Authenticator or 1Password, get ten single-use backup codes, and are asked for a 6-digit code after their first step. Set the policy to Off, Optional or Required under Authentication > Security. A device the person chooses to trust skips the code for up to 90 days unless you change the window, a passkey that checked a fingerprint or PIN counts as both steps, and an admin can reset someone's second step from their page in the console. You can also allow a code by text message, through your own SMS provider, beside the app and never instead of it.
- AuthenticationEmail and password works end to end on the hosted page: one form with Forgot password?, a 6-digit reset code, and a reset that also lifts the sign-in lockout. Passwords found in a known breach are refused on sign-up, reset and change, checked against Pwned Passwords with only the first five characters of the password's hash leaving the server.
- AuthenticationEmail sign-in codes. A Magic Link method can send a 6-digit code, a link or both, and a code can create the account too, with the address already verified. A code is the better choice when people read their mail on a phone and sign in on a laptop.
- AuthenticationPhone sign-in. People sign in or sign up with a 6-digit code by text message, WhatsApp or voice call, sent through your own Twilio account or a signed webhook of yours, so your provider bills you and BuildBase never does. The SMS tab sets a daily cap with an early warning, sends a test, and keeps a 30-day delivery log without the full number or the code.
Pick your framework
Each guide adds BuildBase to an app you already have: install, sign-in, reading the session on the server, then teams and billing.
The server SDK runs on Node.js, Bun, Deno and Cloudflare Workers. All build guides
Start from working code
Clone a starter that is already wired to BuildBase, or install the Claude skill and let Claude do the integration in your own app.
Integrate the SDK with Claude
buildbase@buildbase-skills
Takes a Next.js app from npm install to a working sign-in, then covers workspaces, billing, feature flags, quotas, credits, notifications, webhooks and calling BuildBase from a non-Node backend.
In Claude Code:
Any agent (Cursor, Codex, Copilot and others), from a shell:
Then ask Claude: “Add BuildBase auth to my Next.js app.”
Other ways to install, including claude.aiNext.js starter
buildbase-app/nextjs-starter
A Next.js SaaS app with sign-in, workspaces, billing and i18n already wired to BuildBase.
Agent + MCP starter
buildbase-app/nextjs-agent-mcp-starter
An agent-first Next.js app: a live MCP server with agent OAuth, from one config.
Self-hosted starter
buildbase-app/self-hosted-starter
The Docker Compose stack for running BuildBase on your own servers.
Frequently Asked Questions
Common questions about BuildBase.
Do I have to use every feature?
No. Turn on only what you need - auth and billing now, email or workflows later. Some modules build on others: billing and credits belong to workspaces, forms store into collections, and workflows send email through the email module.
How long does integration take?
Install the SDK, wrap your app in a provider, and call hooks. Sign-in runs on a hosted, white-label auth portal, and pre-built screens cover workspace settings, so the first screens need no UI of your own.
How is data secured?
AES-256 encryption at rest, TLS 1.3 in transit, role-based access control, and per-tenant data isolation. Built for GDPR, CCPA, and SOC 2 readiness.
Can I migrate away later?
Partly. Audience contacts export as CSV and each workflow exports as JSON from the console, and subscriptions and payments sit in your own Stripe account. Passwords, passkeys and workspaces do not export, and moving off means replacing the SDK hooks and components in your code.
What frameworks does BuildBase support?
The React SDK works with Next.js, Vite, React Router / Remix, TanStack Start and any other React web app. The Server SDK and REST APIs are framework-agnostic - Express, NestJS, Fastify, Hono, Astro, or anything else.