Hybrid Tenancy & Identity Federation
One codebase. Multi-tenant B2B or single-tenant B2C, with OAuth2/OIDC social login and tenant-scoped enterprise SSO built in.
Five production-ready services: IAM, Gateway, Billing, CMS and Audit. Two React SPAs: Tenant App and Platform Admin. Kubernetes-native with Helm charts and selectable Stripe or Lemon Squeezy billing.
Five Production-Ready Services
100+ REST APIs, each with its own Helm chart, CI/CD pipeline, and dedicated PostgreSQL database
IAM Service
60+ identity endpoints — signup, JWT RS256, magic-link passwordless auth, OAuth2/OIDC social login, tenant-scoped enterprise SSO, token exchange, avatar uploads, announcements, and in-app notifications.
Gateway Service
Reactive Spring Cloud Gateway — JWT validation via JWKS, header sanitization, audit context propagation, per-tenant metrics, Swagger aggregation, and plan feature enforcement.
Billing Service
40+ payment endpoints — Stripe + Lemon Squeezy, per-tenant customers, FLAT and PER_SEAT pricing, subscription lifecycle, free trials, refunds, and Customer Portal sessions.
Audit Service
Centralized event-driven audit trail — passive RabbitMQ consumption, SPI-based extensibility, JSONB metadata, and PLATFORM_ADMIN search API with filters.
CMS Service
Static page management — draft/publish workflow, multi-language with en-US fallback, hierarchical slugs, SEO metadata, and schema-per-tenant isolation.
Hybrid Tenancy & Identity Federation
Deploy as multi-tenant B2B SaaS (schema-per-tenant PostgreSQL isolation) or single-tenant B2C (all users in one default workspace) from the same codebase. Every user gets a personal platform workspace(auto-joined as MEMBER to platform tenant), plus OAuth2/OIDC social login, tenant-scoped enterprise SSO, and passwordless magic links. Switch deployment mode via one config flag.
One flag, two models
platform.rolloutMode: MULTI_TENANT or SINGLE_TENANT
Authentication, Admin & Self-Service
Complete identity management, platform operations, tenant self-service, and global observability
Passwordless Magic Link
Secure email-based sign-in with configurable TTL, rate limiting, and automatic personal workspace membership on first use.
Multi-Language i18n
Lingui 6 catalogs with en-US, bg-BG, de-DE, fr-FR out of the box — user locale stored on profile, i18n notifications and pages.
Plan Feature Enforcement
Plan-code stamped into JWTs, feature-gate annotations, maxUsers + per-seat quotas, and advanced analytics gating on plans.
Centralized Audit Trail
Passive RabbitMQ event consumption, SPI-based extensibility, PLATFORM_ADMIN search API with full JSONB metadata records.
Global Announcements
Multi-lingual editor with en-US mandatory + optional translations, async 1K batch fan-out, WebSocket broadcast, delivery tracking.
In-App Notifications
Persistent table + real-time WebSocket push, per-user STOMP queues, unread count, mark-as-read, i18n-aware types.
Token Exchange & Workspace Pick
Seamless tenant switch via POST /auth/exchange — new RS256 pair per tenant; tenant picker UI with /users/me/memberships listing.
Avatar & User Self-Service
Two-phase presigned S3/MinIO upload, old avatar auto-delete, profile edits, password change, connected accounts and sign-out.
Refunds & Trials
Full refund management for TENANT_OWNER and PLATFORM_ADMIN; trial-ending and payment-overdue notifications via daily jobs.
Three Production Frontend Apps
Tenant workspace, platform operator console, and this Astro landing kit — all production-ready
Tenant App
The workspace interface for your customers. Tenant-scoped JWT sessions, 60+ UI routes, Feature-Sliced Design.
- Password + passwordless magic link + OAuth2/Google/GitHub/Microsoft + tenant SSO sign-in
- Self-service signup, create-org, invite accept, email verify, forgot/reset password
- Team list, invites, ban/unban, role edit, ownership transfer, memberships picker
- Billing self-service — checkout, plan catalog, Stripe/Lemon Squeezy portal, refunds
- Connected accounts, SSO OIDC config, notifications/announcements, i18n (EN/BG/DE/FR) + themes
Platform Admin
Internal operator console for platform-wide administration. PLATFORM_ADMIN authority-gated.
- Dashboard with parallel count cards (users, orgs, active subscriptions)
- User detail 4-tab view: Overview, Organizations, Identities, ban/unlock/force-unlink
- Organization 5-tab view: Overview, Members, Billing, Subscriptions, Refunds
- Announcements multi-lingual editor & publish, audit log search with filters, invites
- Subscription lifecycle (cancel/pause/reactivate), refunds detail, read-only plan catalog, i18n
Built for Business Growth
Accelerate your journey from startup to scale-up
Launch in Days
Skip months of infrastructure work. IAM, Gateway, and Billing are production-ready — deploy with Helm and start building your vertical.
Security by Default
RS256 JWT, JTI denylist, brute-force lockout, header sanitization, BCrypt strength 12, and two-layer token revocation out of the box.
True Data Isolation
Schema-per-tenant PostgreSQL with Liquibase per-tenant migrations. Tenant context flows automatically from JWT claims through the gateway.
Zero Licensing Cost
Apache 2.0 — use it for personal projects, commercial products, or anything in between. No usage limits, no vendor lock-in.