DEV3 Technologies home

DEV3 Gantrel – Next.js SaaS Boilerplate with Auth, 2FA, Teams, Billing, Admin, API & Gemini AI Admin Tools

Next.js 16 and MongoDB SaaS boilerplate: 2FA sign-in, organisations, plans with proration, usage metering, admin console with Gemini AI admin tools, Google Translate switcher, API keys, webhooks, docs and a module generator. Setup wizard and demo data included. No mobile apps.
by DEV3 TechnologiesVerified Author(0) 0 sales 0 viewsUpdated 14 Nov 2026

Video tour. Pick a section below to browse 40 screenshots in 5 sections.

App & phone tours

Tap play to watch each app. Nothing downloads until you do.

  • Mobile web0:06

Gantrel is a Next.js SaaS boilerplate built by DEV3 Technologies on Next.js 16, React 19, TypeScript, Tailwind 4 and MongoDB. You download the source, rename it, delete the example app with one command and build your own product on top of working sign-in, teams, billing, an admin console and a public API. Out of the box it runs as a demo SaaS called Brightpad, a small notes-and-checklists app, so you can see every feature working before you change anything. The demo data is fictional.

No live demo: 40 grouped screenshots and two video tours show the marketing site, the workspace app, the admin console, the developer pages and the installer. Install it with the demo data to try every role on your own server. This product is a web application: there are no mobile apps.

Accounts and teams

  • Sign-in: email and password, magic link and authenticator-app two-factor with recovery codes. OAuth buttons for GitHub, Google and Microsoft are included.
  • Organisations: every user belongs to one or more workspaces with owner, admin and member roles, teams, invitations bound to the invited email, and a seat cap. The last owner cannot be removed.
  • Admin console: an operator panel with organisations, plans, feature flags, an email outbox, platform settings and impersonation that is view-only by default and fully audited.

Billing

  • Plans with features, limits, trials and a hidden-plan option, edited in the admin console. Three demo plans: Solo, Team and Business.
  • Subscriptions with a proration preview before any change, coupons, and credit for what was actually paid when a customer upgrades. A trial that ends without a payment method falls back to the default plan and is never invoiced.
  • Invoices you can print, a Billing page, and usage metering against per-plan allowances with quota errors in the API.

For developers

  • REST API with scoped Bearer keys, an OpenAPI 3.1 document and an API reference page.
  • Signed webhooks with a delivery log, retries at 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours, and automatic disabling of a failing endpoint. Outbound requests are DNS-pinned and refuse private addresses.
  • Module generator: npm run make:module -- Projects scaffolds a tenant-scoped model, routes, page and tests, and refuses names that collide with existing code.
  • Docs site: 30 guides in the app, plus an offline copy in the download.
  • Private files on local disk or S3, an audit log, notifications, feature flags, English, Spanish and Arabic with right-to-left layout, dark mode, and an installer wizard.

Gemini AI admin tools and Translate

  • AI panels on most pages: summaries, rewrites, tags, risk flags, plain-English filters, reply drafts and next-best-action hints for notes, billing, team, files, webhooks, the audit log and the admin pages for workspaces, plans, invoices, subscriptions, users and feature flags. Suggestions are previews: nothing saves until you accept.
  • Bring your own key: the product ships with GEMINI_API_KEY blank. You add your own key after purchase and Google bills it. Pick the model, daily cap and de-identification in Admin > Platform settings. Without a key the buttons say "Add your Gemini key in Settings".
  • Google Translate switcher in the public and app headers, with your own language list and an admin off-switch.

Safe by design

  • Every query is scoped to the workspace by a plugin that fails closed, with 21 enumerated test cases. Subscriptions, checkouts, renewals and invitations use conditional updates guarded by unique indexes, and race tests run against a real MongoDB.
  • 291 app tests and 49 core tests pass. The first-load JavaScript on the login page is about 188 KB gzipped.

Good to know

  • The OAuth providers and the payment gateway are simulated and demo-only. They are switched off in production: nothing leaves your server until you add real keys and explicitly allow live calls. Without a Gemini key the AI buttons use a deterministic simulated driver in demo mode, labelled "Demo AI (simulated)"; the demo makes no real AI calls.
  • It is a boilerplate, not a finished business: it has no niche logic beyond the removable Brightpad example, no multi-database tenancy (one database, workspace-scoped) and no Stripe Connect marketplace.
  • You need Node.js 20.9+, MongoDB 6+ (a single-node replica set works) and a cron or systemd timers for scheduled jobs. Runs on any Node host; a Vercel guide is included.

What you get

The application source with the core in your repository under packages/gantrel-core, a setup wizard, demo data, .env.example, the module generator, scheduled-job scripts, tests, the buyer documentation, START-HERE.txt and the licence. Setup wizard and demo data included. No mobile apps.

#nextjs-boilerplate#saas-boilerplate#saas-starter#multi-tenant#authentication#two-factor#subscriptions#usage-metering#admin-dashboard#webhooks#mongodb#self-hosted

How it's built

Architecture, stack, key decisions and the quality gates DEV3 Gantrel passed before release.

The engineering behind Gantrel: a tenant plugin that fails closed, subscription and proration rules that credit only what was paid, view-only impersonation, DNS-pinned outbound requests and a generator with rollback, with the known limits written down.

The problem it solves

A SaaS boilerplate looks finished after sign-in and a pricing page. The problems come later. A query forgets its workspace filter and one customer sees another's data. Two checkouts finish at once and a customer ends up with two subscriptions. An upgrade mid-period credits a discount the customer never paid. Support impersonates a user and changes something by accident. A webhook URL points at an internal address. Each of these has to end in one safe state, and a buyer who extends the code must not be able to reintroduce them by accident.

Architecture and approach

Gantrel is a Next.js 16 application on MongoDB with its core in your repository under packages/gantrel-core. Every model that belongs to a workspace goes through a tenant plugin that scopes each query by an immutable workspace id and throws when a filter has none; 21 enumerated cases test it, and cross-tenant code lives only in the admin area and scripts.

One live subscription per workspace

A unique row per workspace, checkout references applied once and a stale second paid checkout that replaces the first (the old gateway subscription is cancelled and an overpayment becomes account credit) keep concurrent checkouts from producing two subscriptions. Upgrade credit is the amount actually paid, discount included, computed by a pure prorate() function with 19 money vectors.

Impersonation that cannot write by accident

Support sessions are view-only by default. Full access needs a super-admin switch, every start, end and mode change is audited, and nesting or impersonating a super-admin is refused.

Outbound requests

Webhooks, payment gateways, OAuth, S3 and the optional AI calls all go through one fetch wrapper that pins the resolved address, validates every redirect hop and refuses private ranges. A test fails the build if any plain fetch( appears outside it.

A generator that refuses collisions

npm run make:module -- Projects scans models, collections, routes, files and registries for singular and plural collisions before writing, writes with exclusive flags, rolls back on failure and passes its own type check, lint and tests.

AI admin tools

Pages carry an AI panel configured from one map file. Suggestions are previews, passwords, keys and card numbers are stripped before any request, and the product ships with the Gemini key blank: the buyer adds their own.

Quality gates and results

The app has 295 tests plus 59 for the core, including race groups run against a real MongoDB for subscriptions, invitations and renewals. The first-load JavaScript on the login page is about 188 KB gzipped. Known limits are written down: one database with workspace scoping rather than a database per tenant, simulated OAuth and payment gateway in the demo and off in production, no Stripe Connect marketplace, and no niche business logic beyond the removable example.

Tech stack

Area Technologies
Application Next.js 16 App Router, React 19, Tailwind CSS 4, MDX docs site
Platform Organisations, roles and invitations, Plans, proration and metering, Admin console with impersonation, API keys, OpenAPI and webhooks
Data and security MongoDB 6+, Fail-closed tenant plugin, DNS-pinned outbound requests, Zod validation, TOTP two-factor
Quality Vitest unit and race tests, Headless smoke tests, Secret scan of the zip

Inside the build

Landing: A launch-gantry photo under a steel duotone, the headline and a live generator terminal and proration preview. Landing — A launch-gantry photo under a steel duotone, the headline and a live generator terminal and proration preview.

What is included: Eight platform areas, each linking to its guide, then billing, the Gantry Board and the generator. What is included — Eight platform areas, each linking to its guide, then billing, the Gantry Board and the generator.

Guides & articles

Practical guides and engineering write-ups for DEV3 Gantrel.

Next.js SaaS boilerplate: 7 things to check before you build on one

Last updated
Next.js SaaS boilerplate: 7 things to check before you build on one: DEV3 Gantrel

A boilerplate saves weeks, but only if the parts you cannot see are right. Here are seven things to check before you build on one, with DEV3 Gantrel as the worked example.

The workspace dashboard with usage, plan limits and the Gantry Board

1. Does sign-in go beyond a password?

Look for magic links, authenticator-app two-factor with recovery codes, sessions you can list and revoke, and OAuth buttons you can switch on with your own keys. Gantrel ships all of these; the OAuth providers are simulated in the demo and off in production.

Settings with the two-factor setup

2. Is tenancy enforced or only intended?

Every query that belongs to a workspace needs its workspace id, and forgetting it should fail loudly. Gantrel scopes models through a plugin that fails closed and tests 21 cases.

Team members, roles and pending invitations

3. Does billing credit only what was paid?

Mid-period upgrades are where disputes start. Check for a preview of every line, credit for the amount actually paid, coupons, trials and one live subscription per workspace.

A plan change with a proration preview

Video: a tour of the Gantrel site, workspace and admin console

4. Can support help without breaking things?

Impersonation should be view-only by default, audited and impossible against a super-admin. An admin console with plans, feature flags, an email outbox and platform settings saves you building it later.

The admin console organisations list

5. Are the API and webhooks safe to extend?

You want scoped keys, an OpenAPI document, signed webhooks with retries, and outbound requests that cannot reach private addresses.

Webhook endpoints and a delivery log

6. Is there a way to add modules without copying code?

Gantrel's generator scaffolds a tenant-scoped module and refuses names that collide with existing code.

The module generator guide

7. What about AI and translation?

Gantrel adds Gemini AI admin tools to most pages and a Google Translate switcher. The product ships with the Gemini key blank: you add your own, and Google bills it. Suggestions are previews, and sensitive values are stripped before a request.

AI admin tools settings

One last check: read the limits. Gantrel uses one database with workspace scoping, simulates the payment gateway until you add keys, and has no Stripe Connect marketplace.

Frequently asked questions

The complete source code (version 1.0.0) as a download from your account, with the setup and usage guides shown on this page. You can modify the code to suit your product.

Questions about this product (0)

Answers from the DEV3 team and the community.

Ask a question

No questions yet.

Wondering about setup, licensing or customisation? Ask, and the DEV3 team will help.

Open the product board

More from this author

View all

Related in Enterprise SaaS Starters

View all