Bootship is the Spring Boot starter with everything you rebuild for every SaaS — auth, organizations, Stripe billing, API keys, feature flags, audit log — already wired together and tested. You start at the business logic.
# clone, run, done — H2 in dev, zero setup $ mvn spring-boot:run # register a user: tokens + personal workspace, out of the box $ curl -X POST localhost:8080/api/auth/register \ -d '{"email":"[email protected]","password":"..."}' { "accessToken": "eyJ...", "refreshToken": "Kx2..." }
Not a demo. Production patterns, hashed secrets, tested flows.
JWT access tokens + opaque rotating refresh tokens stored hashed. Email verification, password reset that revokes all sessions, login audit with IP.
OWNER / ADMIN / MEMBER roles, personal workspace at signup, role-checked member management. Invite people by email — they auto-join when they register.
Per-org subscriptions, Checkout for upgrades, customer portal, signature-verified webhooks that survive Stripe API version bumps. Off by default, runs without a Stripe account.
Declare features and minimum plans in YAML, enforce with requireFeature(orgId, "x") — 402 when the plan is too low. Frontend reads the resolved map from one endpoint.
Org-scoped sk_... keys, hashed at rest, shown once, revocable, last-used tracking. One header authenticates machines as the organization.
17 sensitive event types recorded in a separate transaction — even failed logins that roll back. Org-scoped view for admins, global view for the platform owner.
Per-IP Bucket4j limits on the auth endpoints — the ones exposed to credential stuffing. One property to tune, ready to move to Redis when you scale.
Provider-agnostic mailer: log mode in dev, SMTP in prod. Works with Resend, Postmark, SES, Mailgun — switch with one property.
Flyway migrations, Swagger UI, Postman collection with auto-saved tokens, integration tests on every core flow, Docker + compose, seeded admin.
The boring 20% that takes 80% of the time is done. Add your product on top.
// gate any feature by plan — one line planService.requireFeature(orgId, "advanced-reports"); # application.yml app: features: advanced-reports: pro audit-log: business
Bootship Lite is the open-source (MIT) auth module of Bootship: JWT + rotating refresh tokens, email verification, password reset — free forever, commercial use included. Kick the tires, read the code, then come back for the full SaaS starter.
⭐ Get Bootship Lite on GitHub →Pay once, build unlimited products with it.
A private repository with the full Bootship source: Spring Boot 3.4 / Java 21, auth, multi-tenant organizations, Stripe billing, API keys, feature flags, rate limiting, audit log, email, admin endpoints, Flyway migrations, integration tests, Docker setup and a Postman collection.
Yes — Bootship Lite is the auth core of Bootship, open source under MIT: JWT with rotating refresh tokens, email verification, password reset. Use it freely, even commercially. The full Bootship adds organizations, billing, feature flags, API keys, audit log and more.
Bootship is API-first: it powers any frontend (React, Vue, Angular, mobile) through a clean REST API with OpenAPI docs. A reference frontend is on the roadmap.
Yes — unlimited end products, owned by you or your clients. The only thing you can't do is resell or republish the starter itself.
Because that's your stack. The JS world has a hundred starters; Java teams building SaaS have almost none — Bootship exists so you don't have to switch ecosystems to ship fast.
14 days, no questions asked. If Bootship doesn't save you weeks, you shouldn't pay for it.