Build guides
Step-by-step walkthroughs for shipping real features with @buildbase/sdk.
35 posts · page 2 of 3
BuildBase on Vite: add auth, teams and billing to a React SPA with no server
Add authentication to a Vite React app with no server of its own: three small functions for the code exchange, an httpOnly cookie, then teams and billing.
How to add passkeys in Next.js
Every passkey tutorial has you writing four WebAuthn route handlers. This one has you writing none, and making one near-permanent decision instead: which domain runs the ceremony.
Session cookie not shared across subdomains
Signed in on app.example.com, signed out on admin.example.com. An attribute-by-attribute audit of the Set-Cookie header that decides it.
How to add magic-link login in Next.js
Turning magic link on takes one toggle. The decisions that follow - session length, which browser opens the link, and deliverability - take longer.
Connection pool exhausted as org count grows
MongoNotConnectedError under load is usually LRU eviction, not a dead database. The arithmetic behind the 30-connection tenant window and where your own ceiling lands.
An invited member who cannot see the workspace
The invite is parked in one of the states it passes through, and the admin console renders most of them identically. Walk the states, find yours, stop reading.
Middleware redirect loop after login in the App Router
Your middleware sees no cookie and 307s to /login. Your login page sees a session and bounces back. Traced hop by hop, plus the matcher and cookie rules that decide where it turns around.
A permission change that has not taken effect yet
Up to an hour, and that is the designed number, not a cache somebody forgot to bust. Which clock you are waiting on, and which one you can skip.
A 429 when the quota should not be exhausted
A 429 on the usage endpoint is almost never the quota. Quota rejection returns 400. Here is how to reconcile the counter you read with the counter being enforced.
Stripe webhook signature verification failed in Next.js
One error string covers two different bugs. Five causes for a failed Stripe webhook signature in Next.js, ranked by how often each is actually it, each with its one-line test.
Token expired mid-request on a long operation
A 401 halfway through an upload, while the user is still signed in for another 29 days. Two clocks, not one, and the fix is a refresh before the call rather than a retry after it.
Why your webhook is rejected after five minutes
A BuildBase delivery older than five minutes fails verification before the signature is ever compared. Why the max age exists, and the four things that trip it legitimately.