Ship a SaaS in a weekend with Cursor + Supabase: the stack, the code, and the 'don't skip this' checklist

npx create-next-app@15 my-saas --ts --app --tailwind --eslint --no-src-dir --import-alias "@/*" --use-npm --no-turbopack --yes
cd my-saas
npm i @supabase/supabase-js @supabase/ssr stripe posthog-js server-only

NEXT_PUBLIC_SUPABASE_URL=
NEXT_PUBLIC_SUPABASE_ANON_KEY=
SUPABASE_SERVICE_ROLE_KEY=
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=
STRIPE_PRICE_ID=
APP_URL=http://localhost:3000
MAILVALID_API_KEY=
NEXT_PUBLIC_POSTHOG_KEY=
NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com

create table public.profiles (
  id uuid primary key references auth.users on delete cascade,
  email text not null,
  plan text not null default 'free',
  stripe_customer_id text,
  created_at timestamptz default now()
);

alter table public.profiles enable row level security;

create policy "users read own profile"
  on public.profiles for select
  using (auth.uid() = id);

-- Create a profile row for every new auth user
create function public.handle_new_user()
returns trigger
language plpgsql
security definer set search_path = ''
as $$
begin
  insert into public.profiles (id, email) values (new.id, new.email);
  return new;
end;
$$;

create trigger on_auth_user_created
  after insert on auth.users
  for each row execute procedure public.handle_new_user();

// lib/supabase/server.ts
import { createServerClient } from "@supabase/ssr";
import { cookies } from "next/headers";

export async function createClient() {
  const cookieStore = await cookies();
  return createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
    {
      cookies: {
        getAll: () => cookieStore.getAll(),
        setAll: (toSet) => {
          try {
            toSet.forEach(({ name, value, options }) => cookieStore.set(name, value, options));
          } catch {
            // called from a Server Component; safe to ignore if middleware refreshes sessions
          }
        },
      },
    }
  );
}

// lib/supabase/admin.ts
import "server-only";
import { createClient } from "@supabase/supabase-js";

// Service role key bypasses RLS. Server only.
export function createAdminClient() {
  return createClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.SUPABASE_SERVICE_ROLE_KEY!,
    { auth: { persistSession: false } }
  );
}

// app/signup/actions.ts
"use server";
import { createClient } from "@/lib/supabase/server";
import { verifyEmail } from "@/lib/verify-email";

export type SignUpState = { error?: string; ok?: boolean };

export async function signUp(_prev: SignUpState, formData: FormData): Promise<SignUpState> {
  const email = String(formData.get("email")).trim().toLowerCase();
  const password = String(formData.get("password"));

  const check = await verifyEmail(email);
  if (!check.allow) return { error: check.reason };

  const supabase = await createClient();
  const { error } = await supabase.auth.signUp({ email, password });
  if (error) return { error: error.message };
  return { ok: true };
}

// app/signup/page.tsx
"use client";
import { useActionState } from "react";
import { signUp, type SignUpState } from "./actions";

export default function SignUpPage() {
  const [state, action, pending] = useActionState<SignUpState, FormData>(signUp, {});
  if (state.ok) return <p className="p-8">Check your inbox to confirm your email.</p>;
  return (
    <form action={action} className="mx-auto mt-16 flex max-w-sm flex-col gap-3 p-4">
      <input name="email" type="email" required placeholder="[email protected]" className="border p-2" />
      <input name="password" type="password" required minLength={8} placeholder="Password" className="border p-2" />
      <button disabled={pending} className="bg-black p-2 text-white">
        {pending ? "Creating account..." : "Sign up"}
      </button>
      {state.error && <p className="text-red-600">{state.error}</p>}
    </form>
  );
}

// app/api/checkout/route.ts
import Stripe from "stripe";
import { createClient } from "@/lib/supabase/server";

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);

export async function POST() {
  // Take the user from the session, never from the request body.
  const supabase = await createClient();
  const { data: { user } } = await supabase.auth.getUser();
  if (!user) return new Response("Unauthorized", { status: 401 });

  const session = await stripe.checkout.sessions.create({
    mode: "subscription",
    line_items: [{ price: process.env.STRIPE_PRICE_ID!, quantity: 1 }],
    customer_email: user.email,
    client_reference_id: user.id,
    success_url: `${process.env.APP_URL}/dashboard?paid=1`,
    cancel_url: `${process.env.APP_URL}/pricing`,
  });
  return Response.json({ url: session.url });
}

// app/api/stripe/webhook/route.ts
import Stripe from "stripe";
import { createAdminClient } from "@/lib/supabase/admin";

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);

export async function POST(req: Request) {
  const body = await req.text(); // raw body, not req.json()
  const sig = req.headers.get("stripe-signature");
  if (!sig) return new Response("Missing signature", { status: 400 });

  let event: Stripe.Event;
  try {
    event = stripe.webhooks.constructEvent(body, sig, process.env.STRIPE_WEBHOOK_SECRET!);
  } catch {
    return new Response("Bad signature", { status: 400 });
  }

  if (event.type === "checkout.session.completed") {
    const s = event.data.object;
    // Setting a value (not incrementing) makes this safe if Stripe redelivers the event.
    await createAdminClient()
      .from("profiles")
      .update({ plan: "pro", stripe_customer_id: s.customer as string })
      .eq("id", s.client_reference_id!);
  }
  return new Response("ok");
}

stripe listen --forward-to localhost:3000/api/stripe/webhook

// app/providers.tsx
"use client";
import posthog from "posthog-js";
import { PostHogProvider } from "posthog-js/react";
import { useEffect } from "react";

export function Providers({ children }: { children: React.ReactNode }) {
  useEffect(() => {
    posthog.init(process.env.NEXT_PUBLIC_POSTHOG_KEY!, {
      api_host: process.env.NEXT_PUBLIC_POSTHOG_HOST,
    });
  }, []);
  return <PostHogProvider client={posthog}>{children}</PostHogProvider>;
}

// lib/verify-email.ts
type Check = { allow: boolean; flag?: boolean; reason?: string };

export async function verifyEmail(email: string): Promise<Check> {
  try {
    const res = await fetch("https://mailvalid.io/api/v1/verify/single", {
      method: "POST",
      headers: {
        "X-API-Key": process.env.MAILVALID_API_KEY!,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ email }),
      signal: AbortSignal.timeout(3000),
    });
    if (!res.ok) return { allow: true, flag: true }; // fail open
    const { result } = await res.json();

    if (result.status === "invalid" || result.is_disposable) {
      return { allow: false, reason: "We can't send email to that address. Check for typos, or use a different one." };
    }
    return { allow: true, flag: result.status !== "valid" }; // catch_all, unknown: allow, but watch
  } catch {
    return { allow: true, flag: true }; // timeout or network error: never block signup on a dependency
  }
}