Next.jsOpen Source

@payez/next-mvp

Full-stack auth, RBAC, billing, and admin — in one npm install.

Under 10 minutes to your first login screen. 0 lines of auth code to write.

npm install @payez/next-mvp

Start Free GitHub

Code features, not infrastructure

The MVP handles auth, sessions, roles, audit, themes, and billing. You write the code that makes your app different.

lines of
Auth code

lines of
Session management

lines of
Role/permission checks

lines of
Audit logging setup

lines of
Theme system

lines of
Billing integration

You write: components, pages, business logic, custom API routes. Everything else is inherited from the MVP framework.

From zero to running in 6 steps

Under 10 minutes if you have the env vars. Under 30 if you're setting up a new IDP tenant.

npm install @payez/next-mvp

One package. Everything you need.

Set 4 env vars

VIBE_API_URL, VIBE_CLIENT_ID, VIBE_CLIENT_SECRET, NEXTAUTH_SECRET

Add middleware.ts

One import: createSlimMiddleware from @payez/next-mvp

Add providers.tsx

SessionProvider + LoginRecorderProvider + ThemeProvider

Add auth route

app/api/auth/[...nextauth]/route.ts — one import, auto-discovers OAuth providers

npm run dev

After step 6 — you have a login screen, session management, theme switcher, and a full admin dashboard with Users, Sessions, Audit, Logs, and Roles tabs. First protected route? Add one line to the middleware publicRoutes array. The admin panel is already at /admin.

The `vibe_app` schema — your foundation

Every app gets these 9 tables in the vibe_app schema. PostgreSQL with JSONB columns where flexibility matters. All tables have created_at/updated_at. All foreign keys cascade properly.

users

Core user record — id, email, display_name, created_at. The single source of truth for identity across all schemas.

user_roles

Role assignments — user_id FK to users, role_name, assigned_by, assigned_at. Powers the RBAC middleware.

roles

Role definitions — name, description, is_system. System roles are immutable; custom roles are yours.

sessions

Active session tracking — user_id, token, IP, user_agent, expires_at. Redis-backed distributed sessions.

audit_log

Every admin action logged — who, what, when, target_user, details (JSONB). Compliance-ready from day one.

organizations

Multi-tenant org support — name, slug, settings (JSONB). Built-in multi-tenancy without any wiring.

org_memberships

User-to-org mapping — user_id, org_id, role. Users can belong to multiple orgs with different roles.

page_permissions

Route-level RBAC — route_pattern, required_roles, requires_2fa. Per-route access control and 2FA enforcement.

app_settings

Key-value config store — key, value (JSONB), updated_by. Runtime configuration without redeployment.

Built on VibeSQL — full PostgreSQL 16 over HTTP. Read the VibeSQL docs →

Configurable per-route rate limits. Protects your API from abuse without any configuration.

Learn more →

Custom schemas — your data, real identity

Create your own PostgreSQL schema namespace. Every table that references a user uses REFERENCES vibe_app.users(id). One source of truth. No sync jobs.

How it works

When you create app-specific tables (e.g. ideal_resume), they live in their own PostgreSQL schema namespace. Your tables reference vibe_app.users(id) — the developer never manages user identity. It's inherited.

Custom tables are accessed via the Vibe API: GET /v1/data/{schema}/{table}. On the frontend: fetch('/api/vibe/data/ideal_resume/resumes'). The API handles auth, pagination, and filtering — you just query.

VibeSQL docs →

-- Your app's schema namespace
CREATE TABLE ideal_resume.resumes (
  id        SERIAL PRIMARY KEY,
  user_id   INTEGER REFERENCES vibe_app.users(id),
  name      TEXT,
  file_data JSONB,
  score     INTEGER,
  created_at TIMESTAMPTZ DEFAULT NOW()
);

-- Frontend access (auth handled automatically)
-- fetch('/api/vibe/data/ideal_resume/resumes')

-- Or direct Vibe API
-- GET /v1/data/ideal_resume/resumes?user_id=eq.42

-- The FK means: no separate user table,
-- no mapping, no sync. One source of truth.

Agent-ready by design

AI agents can scaffold, customize, and deploy apps on this framework. The MVP is structured so an agent never has to implement auth, sessions, roles, or audit — it just builds features.

What an agent can do

✓Scaffold a new Next.js app with @payez/next-mvp in one session

✓Create custom schema tables via VibeSQL (POST /v1/query with CREATE TABLE)

✓Build CRUD pages that fetch from the Vibe API — auth is already handled

✓Add new admin tabs without touching auth or session logic

✓Create API routes wrapped in withApiLogging() for automatic structured logging

The MVP turns “build a SaaS app” into “build the features that make your app unique.” Whether the builder is a human developer or an AI agent, the contract is the same.

What's under the hood

Next.js

App Router, React Server Components

NextAuth.js

Federated OAuth/OIDC, auto-discovery

Zustand

Lightweight client state, session sync

Redis

Distributed sessions, cross-device themes

VibeSQL

PostgreSQL 16 over HTTP

Stripe

Checkout, webhooks, credit management

Tailwind CSS

Utility-first, dark mode built in

TypeScript

End-to-end type safety

npm install and start building

10K MAU free. Auth, RBAC, audit, billing, admin dashboard — all included. Custom schemas from day one. No credit card required.

Get Started Free View on GitHub

@payez/next-mvp

Code features, not infrastructure

From zero to running in 6 steps

The vibe_app schema — your foundation

Infrastructure that's already done

Authentication

Session Management

Role-Based Access Control

Admin Dashboard

Theme System

Audit Logging

API Route Protection

Stripe Integration

Tier System

2FA Enforcement

Structured Logging