Skip to content
B2B SaaS StarterSign in
Knowledge sections

Quickstart

Clone, install, seed, and run the starter locally in under five minutes.

setuplocal-dev
On this page

The starter runs locally against a real Cloudflare-shaped stack: apps/web under the @cloudflare/vite-plugin, apps/api and apps/background under Wrangler, a SQLite-backed local D1 database, MDX-driven public content, and the Seed Workspace populated through scripts/seed.ts.

Prerequisites

  • The Vite+ CLI (vp, >= 0.3.0) — it provides the managed Node runtime (>= 24) and the pinned pnpm
  • A Cloudflare account (only required for deployment, not local development)

Install and run

vp install
pnpm run db:migrate:local
pnpm run db:seed
pnpm run dev

pnpm run dev boots all three apps in parallel through Vite Task (vp run -r --parallel dev):

  • apps/web on port 3071 — TanStack Start, public showcase, reference application
  • apps/api — REST and MCP Capability Interfaces (pnpm -C apps/api dev runs it alone)
  • apps/background — cron and queue handlers (pnpm -C apps/background dev runs it alone)

Sign in with the seed accounts

Seeding creates two credential accounts so the reference workspace is reachable immediately (both use the same password, and /sign-in prints them on the page):

EmailPasswordRoles
demo@starter.localdemo-starter-passwordSystem admin (/admin) + starter-lab owner
engineer@example.comdemo-starter-passwordstarter-lab member

Sign in at http://localhost:3071/sign-in — two Local Auth Paths are wired:

  • Email and password — the seeded credentials above.
  • Magic link — "Email me a sign-in link" switches the form to email-only. The link is single-use and expires after ten minutes; consuming it signs you in (and creates a verified account for a brand-new address). With no email provider configured the dispatched email lands in the dev server's console log under email.dispatched, link included, so local development needs no provider.

Both paths share the sign-in rate limit and record an Audit Event (auth.sign_in, with the method named in its metadata). Restart pnpm run dev after the first migrate + seed so the dev server attaches the persisted local D1 as the DB binding; without it the app runs provider-light on the in-memory seed layer. The setup guide covers the details.

Signing in with an emailed code instead

"Email me a code instead" on /sign-in sends a six-digit one-time code that works once, expires in ten minutes, and locks after three failed attempts. /verify-email (when a link fails) and /forgot-password offer the same code path as an alternative to the emailed link. With no email provider configured the code is not lost: the log dispatcher renders it into the dev console's email.dispatched line, so the whole flow is tryable locally. Sending and verifying codes are rate limited like credential sign-in (5 per minute per IP).

What's wired by default

The Seed Workspace populates one workspace with members in the three Workspace Roles, an audit history, notifications, and seeded API Tokens and Webhook Endpoints so the reference app renders working data, not placeholders.