Features
What ships in the starter, what each part does for you, and where to read more.
At a glance
Email and Google sign-in, plus TOTP codes you can require for admins or for everyone.
Permissions live in Postgres, so the database refuses what the app shouldn't allow.
Pages and posts in a BlockNote editor with drafts, so clients can update the site without you.
Public post list, post pages, and an RSS feed, all listed in the sitemap.
Upload and reuse images from the admin, with signed upload tickets on the server.
Postgres full-text search for pages and posts, and Ctrl K to jump through the docs.
Messages are stored in an admin inbox, with optional email delivery through Resend.
Site name, accent colour, logo, and navbar and footer width, changed from settings.
Every migration with a plain-English summary and an applied or not-applied badge.
Read and write endpoints under /api/v1, described in an OpenAPI spec you can generate clients from.
Connect an AI client to /api/mcp. Writes need confirm: true and an idempotency key.
Scoped tokens run as their owner under RLS, and every call is written to the audit log.
CSP and CSRF protection are on by default, and session pages are never cached publicly.
Every pull request runs Biome, typecheck, tests, a build, and npm audit.
API and MCP
Call /api/v1 from scripts and generate clients from the OpenAPI spec, or connect an AI client to /api/mcp. Both take the same personal access tokens, check the same scopes, and run each call as the token owner under RLS.
curl -H "Authorization: Bearer $TOKEN" \
https://example.com/api/v1/postsAuth and roles
Sign-in runs on Supabase Auth with cookie sessions checked on the server. New accounts start as members. Admin access comes from a roles table, and row level security checks the same permissions on every query, so a bug in a page can't hand out data the database wouldn't. Turn on TOTP two-step login with one of four policies: off, optional, required for admins, or required for everyone.
How auth and roles workAdmin
Pages and blog posts are written in a BlockNote editor with drafts and previews. Next to them sit the media library, users, redirects, the contact inbox, the audit log, and settings for branding and layout. Each screen checks its own permission, so you can hand out access screen by screen.
Tour the admin panelAPI and MCP
The REST API under /api/v1 and the MCP server at /api/mcp run the same handlers. A personal access token carries the scopes you pick, never more than its owner has, and each call runs as that person under RLS. Every call lands in the audit log. MCP writes need confirm: true and an idempotency key, so a retried call can't apply a change twice.
Read the API docsShipping
CI runs Biome, the TypeScript check, the Vitest suite, a production build, and npm audit on every pull request. CSP headers, CSRF protection on server functions, and private cache headers on session routes are set before you write a line.
Deploying to VercelStack
React 19 and Vite, with file routes, loaders, and server functions
Postgres, Auth, Storage, and row level security
Deploys through the Nitro Vercel preset, with a preview for every pull request
Design tokens and accessible components you can restyle per client
Validation at every server boundary and for the API
Lint, format, and tests, run in CI