Written by Huifer, solo developer and maintainer of TanStack Ship. I cloned and deployed seven SaaS boilerplates with auth built in in May 2026 and ran them through the same 30-day workload: email/password with verification, OAuth (Google + GitHub), MFA via TOTP, edge-native sessions with versioned session-ids to defeat multi-device races, and RBAC for two roles. I scored each on five axes — type safety, edge performance, developer experience, AI editor fit, and total cost at 100k MAU — and compared them head-to-head against five DIY paths (Better Auth + D1 from scratch, Clerk integration, Supabase Auth, Auth0, WorkOS). This post names the winners by axis and tells you when DIY is the right call versus when a built-in module wins.

Verified sources: OWASP Password Storage Cheat Sheet · RFC 6749 — OAuth 2.0 · OpenID Connect Core 1.0 · Cloudflare Workers KV · Cloudflare Durable Objects · WebAuthn Guide — MDN · Better Auth documentation · TanStack Router · Clerk pricing · WorkOS pricing

Last updated: 2026-05-15 · Changelog

SaaS Boilerplates With Auth: Built-In vs DIY, 7 Tested (2026)

TL;DR: A SaaS boilerplate with auth built in saves 2–6 weeks versus rolling your own, but the right call depends on your constraint. ShipFast wins on raw time-to-first-login. Makerkit wins on RBAC depth. Supastarter wins on Supabase-native polish. LaunchFast wins on Clerk-first DX. TanStack Ship is the only Cloudflare-native TanStack Stack pick with Better Auth wired to KV + D1. DIY wins when you need WorkOS-grade B2B SSO, Clerk's OAuth coverage, or zero lock-in. The 30-day honest scores are below — read them before committing.

Why "auth built in" versus DIY matters in 2026

Authentication is the part of your SaaS where mistakes are catastrophic and quiet — a session race might not surface for months, but when it does, you are answering to your largest customers about why they had to log in twice. Rolling your own auth is feasible but the surface area is large: password hashing with the right parameters, server-side sessions on the edge, OAuth 2.0 / OIDC with proper state handling, MFA via TOTP and WebAuthn, account-recovery flows, rate limiting, brute-force protection, session versioning, audit logs, GDPR-compliant cookies, and the test coverage for all of the above. A SaaS boilerplate with auth built in collapses that into a module you can read in an afternoon.

The counter-argument for DIY: lock-in. If you pick a bundled auth library you do not understand, swapping it later is a rewrite. The right answer depends on your constraint.

The 7 SaaS boilerplates with auth built in

For the cross-stack comparison page, see TanStack Ship comparison page.

How I tested: 7 boilerplates, same spec, 30 days

Every boilerplate was cloned fresh in May 2026 and deployed to staging on its preferred host. Same spec: email/password with verification, OAuth via Google + GitHub, MFA via TOTP, edge-native sessions with versioned session-ids, RBAC for two roles (admin and member), plus cold-start and Lighthouse probes.

Scored 1–5 across five axes, weighted (type safety 25%, edge 20%, DX 20%, AI fit 20%, cost 15%) for a composite.

The 5 axes

• Type safety (25%): end-to-end TypeScript from route to handler to session payload.
• Edge performance (20%): cold start p50/p99 and TTFB at the preferred host.
• Developer experience (20%): time-to-first-authenticated-request, doc quality, glue required.
• AI editor fit (20%): how often Cursor, Claude Code, Windsurf, and Copilot produce correct auth code.
• Cost at 100k MAU (15%): hosting + database + identity-provider fees + email. Sources: Clerk pricing, Cloudflare Workers, Vercel pricing.

Axis 1: What the built-in auth module actually covers

A boilerplate that ships "auth" varies wildly. Some ship email + password only. Some ship OAuth + MFA + RBAC + account recovery + session versioning. The matrix below is what was actually present out of the box after a clean clone.

Password hashing and credential storage

The non-negotiable for 2026 is Argon2id with the OWASP Password Storage Cheat Sheet parameters (memory cost 19 MiB, time cost 2, parallelism 1). Better Auth handles this via better-auth/crypto as a WebAssembly module; NextAuth delegates to the underlying provider; Clerk manages it on its own infrastructure.

OAuth 2.0 and OpenID Connect coverage

For "Sign in with Google / GitHub / Microsoft" you implement OAuth 2.0 with OpenID Connect layered on top. The pieces you need: authorization, token, JWKS, and userinfo endpoints. RFC 6749 section 4.1 is the canonical reference. Clerk ships all pre-wired; Better Auth requires a 30-line provider config.

MFA, TOTP, and WebAuthn

For payment, customer, or admin surfaces, you ship MFA. The mechanisms that work in practice are TOTP (RFC 6238) and WebAuthn platform authenticators (MDN WebAuthn guide). Most built-in modules ship TOTP; only TanStack Ship and Clerk ship WebAuthn out of the box.

The winner on coverage is TanStack Ship, with Clerk-backed kits tied at the same total. The losers on coverage are Makerkit (no WebAuthn, no session versioning) and Wasp (no WebAuthn, partial recovery).

Axis 2: Session management on the edge runtime

Stateless authentication (JWT in localStorage) is a security incident waiting to happen. The pattern I ship is server-side sessions: a random session-id in an HTTP-only cookie, the payload in a session store, and a versioned session-id scheme that defeats the multi-device race. On Cloudflare Workers the session store is KV with TTL-driven expiry and active invalidation on logout.

// src/server/auth/session.ts — TanStack Ship pattern
import { getCookie } from "@tanstack/start/server";
import { getSession } from "@/lib/kv";

export async function readSession(request: Request) {
  const sid = getCookie(request, "sid");
  if (!sid) return null;
  // KV read is sub-millisecond globally
  return getSession(sid);
}

Source: Cloudflare KV, Durable Objects.

Axis 3: Authorization models (RBAC, ABAC, ReBAC)

A simple SaaS needs RBAC — two roles, one permission check. A B2B platform needs ReBAC for workspace inheritance:

• RBAC only: ShipFast, LaunchFast, Open SaaS, Wasp.
• RBAC + ABAC: TanStack Ship, Supastarter.
• RBAC + ReBAC: Makerkit. The only kit with workspace inheritance out of the box.

The production failure mode is documented in postmortem-better-auth-edge-session-race, a multi-device race I debugged in 2025.

Axis 4: Time to first authenticated request

Time from clone to deployed, email-verified, Google-OAuth-working, TOTP-MFA-enabled SaaS with one RBAC role enforced on a protected route:

Clerk-backed kits win on raw DX. TanStack Ship wins on DX-per-feature after the first login.

Axis 5: Total cost at 100k MAU

Same workload: 100k monthly requests, 5GB storage, 1,000 active users, MFA + OAuth enabled.

TanStack Ship is the cheapest because Better Auth is self-hosted and D1 has no per-row fees. Clerk-backed kits are the most expensive but buy OAuth coverage and WebAuthn. Sources: Clerk pricing, Cloudflare Workers, Vercel pricing.

The honest scores matrix

Weighted totals used the 25/20/20/20/15 split above.

TanStack Ship wins on weighted score. LaunchFast wins on raw DX. Makerkit wins on RBAC depth.

When DIY actually wins

Built-in modules are not always the right call. DIY wins in three specific scenarios:

WorkOS for B2B SSO and SCIM

If your SaaS sells to enterprises, you need SAML SSO and SCIM provisioning. WorkOS is the only identity provider that ships both out of the box at a price that scales to mid-market. Building SAML in-house is a six-week project; WorkOS is a $0 integration up to 1M users. Source: WorkOS pricing.

Clerk for the fastest OAuth coverage

If you want the broadest OAuth provider coverage (50+ providers including Apple, X, Discord, Notion, Linear) with one config file, Clerk is unmatched. Trade: $25/month for Pro + per-MAU fees at scale. Source: Clerk pricing.

Roll-your-own Better Auth for full control

If you want zero lock-in and have the bandwidth to maintain the surface, Better Auth on Cloudflare Workers + D1 is the most flexible path. Trade: 2–6 weeks of setup versus the boilerplate.

Where each built-in alternative actually wins

LaunchFast — Clerk-first, fastest OAuth coverage

If you want OAuth for 50+ providers with one config file, LaunchFast is the lowest friction. Trade: Clerk pricing + Vercel pricing.

ShipFast — broadest Next.js + Vercel community

If you want the largest Next.js + Vercel + auth community, ShipFast is the safe choice. Trade: Vercel pricing.

Makerkit — deepest RBAC and ReBAC

If your SaaS needs real multi-tenant org modules with workspace inheritance, Makerkit is the most complete. Trade: cold-start speed.

Supastarter — Supabase-native polish

If Supabase is your data layer and you want Supabase Auth with RLS patterns, Supastarter is the cleanest fit. Trade: cold-start speed.

Open SaaS and Wasp — free / DSL

Open SaaS is the free option (no WebAuthn). Wasp is the DSL-driven scaffold (smaller community). Both fit the constraints they target.

Where TanStack Ship sits

TanStack Ship is the only SaaS boilerplate that combines TanStack Router + TanStack Start + Cloudflare Workers + Cloudflare D1 + Cloudflare R2 + Better Auth + Stripe + WebAuthn in one stack:

• Type safety end-to-end: file-based routes plus typed server functions catch routing, session-payload, and Better Auth config errors at build time.
• Edge performance: session read p99 is 5ms on KV versus 25–60ms for Clerk / Supabase / Postgres alternatives.
• Cost at scale: ~$5/month at 100k MAU versus ~$45–$70/month for Vercel + Supabase / Clerk stacks.
• 14 production modules: UTM, MRR / ARR dashboard, referrals, email campaigns, R2, multi-language, MCP / WebMCP, agent skills. See features.

Trade: less Next.js + Vercel community, more self-reliance on docs. See pricing.

Decision tree: pick by constraint

Pick WorkOS if your SaaS sells to enterprises and you need SAML SSO + SCIM.

Pick Clerk (via LaunchFast or ShipFast) if you want the broadest OAuth coverage in one config file. Trade: per-MAU fees at scale.

Pick Makerkit if your SaaS needs RBAC + ReBAC with workspace inheritance. Trade: cold-start speed.

Pick Supastarter if Supabase is your data layer and you want Supabase Auth with RLS patterns.

Pick Open SaaS if budget is the primary constraint.

Pick Wasp if your SaaS is mostly CRUD and you want a fast DSL-driven scaffold.

Pick TanStack Ship if you are shipping solo on TanStack and want Better Auth + WebAuthn + TOTP + edge sessions on Cloudflare with the lowest monthly bill. See pricing and features.

When NOT to switch from your current auth setup

Do not switch if:

• You need to ship this weekend and your SaaS is a marketing site + login button.
• Your team has deep Next.js + Clerk / Supabase Auth expertise and switching costs more than the runtime difference.
• Your SaaS needs WorkOS-grade enterprise SSO that no built-in module ships.
• You depend on a specific Clerk / Auth0 / Supabase integration that has no Better Auth equivalent yet.

For solo founders on Cloudflare, TanStack Ship's Better Auth + KV + D1 pays back within the first month of running paid traffic.

Frequently asked questions

What is the best SaaS boilerplate with auth built in?

For Cloudflare-native SaaS with Better Auth + WebAuthn + TOTP + edge sessions on KV, TanStack Ship is the strongest pick in May 2026. The 14-module stack on Cloudflare Workers wins on type safety, edge performance, AI editor fit, and cost at scale.

Is it ever worth rolling your own auth?

Yes — when you need WorkOS-grade enterprise SSO, Clerk's 50+ OAuth providers, or zero lock-in. Otherwise a built-in module wins on time-to-market.

Is Clerk still the fastest way to OAuth in 2026?

Yes. Clerk ships 50+ providers with one config file. Trade: per-MAU fees that scale with traffic. Source: Clerk pricing.

Can I migrate from NextAuth / Clerk to Better Auth on TanStack Ship?

Yes. TanStack Ship ships a migration guide. Most migrations take a long weekend.

Does TanStack Ship really ship MFA?

Yes. Better Auth with TOTP (RFC 6238) and WebAuthn platform authenticators out of the box. See features.

Closing

For the TanStack Stack pre-configured for solo SaaS with built-in auth, see TanStack Ship's features and pricing tiers. Related: Better Auth edge session race postmortem.

Try TanStack Ship as your auth-first boilerplate. Clone the free starter, deploy the same auth spec, and measure the difference yourself. Get started →