Lovable prompt to build a SaaS starter app
One prompt covers the plumbing every SaaS repeats: auth, workspaces with roles, invitations, and settings pages, with Row Level Security enforcing tenant isolation in Postgres rather than in client code. Lovable builds it as a single project you can open in the preview, sign up two users, and check that data never crosses workspaces.
Last updated
Build a multi-tenant SaaS starter where teams collaborate on {{resource}}.
Auth and accounts:
- Email and password signup and login with Supabase Auth, plus password reset. After first login, an onboarding step creates a workspace and makes that user its owner.
Workspaces:
- Tables: workspaces, workspace_members (role is owner, admin, or member), invitations.
- Owners and admins invite by email; the invite link joins the workspace after signup or login. Inviting an existing member returns a clear message instead of a duplicate row.
- A workspace switcher in the top bar for users who belong to several.
- Row Level Security policies so members only read rows in their own workspaces. Write actual policies; client-side filtering does not count.
App shell:
- Public marketing page with Free and Pro tiers as static content.
- Authenticated area: a dashboard placeholder, workspace settings (rename, member list with role management, remove member, delete workspace behind a type-to-confirm dialog), and account settings for email and password.
- Billing page showing the current plan with a disabled Upgrade button; structure it so a payment provider can slot in later, without adding keys or fake checkout now.
- Leave one clearly marked extension point where {{addon}} can be wired in after launch.
Edge cases: the last owner cannot leave or be demoted, and deleting a workspace cascades its memberships and invitations.
States: loading skeletons in the shell, a friendly empty dashboard for a new workspace, error toasts on failed mutations.
To verify, I will sign up two users, invite one into the other's workspace, confirm a plain member cannot open workspace settings, and confirm nothing from workspace A renders while workspace B is active.Customize it
Runs in your browser. Nothing you type here is sent anywhere.
Build a multi-tenant SaaS starter where teams collaborate on users. Auth and accounts: - Email and password signup and login with Supabase Auth, plus password reset. After first login, an onboarding step creates a workspace and makes that user its owner. Workspaces: - Tables: workspaces, workspace_members (role is owner, admin, or member), invitations. - Owners and admins invite by email; the invite link joins the workspace after signup or login. Inviting an existing member returns a clear message instead of a duplicate row. - A workspace switcher in the top bar for users who belong to several. - Row Level Security policies so members only read rows in their own workspaces. Write actual policies; client-side filtering does not count. App shell: - Public marketing page with Free and Pro tiers as static content. - Authenticated area: a dashboard placeholder, workspace settings (rename, member list with role management, remove member, delete workspace behind a type-to-confirm dialog), and account settings for email and password. - Billing page showing the current plan with a disabled Upgrade button; structure it so a payment provider can slot in later, without adding keys or fake checkout now. - Leave one clearly marked extension point where input validation can be wired in after launch. Edge cases: the last owner cannot leave or be demoted, and deleting a workspace cascades its memberships and invitations. States: loading skeletons in the shell, a friendly empty dashboard for a new workspace, error toasts on failed mutations. To verify, I will sign up two users, invite one into the other's workspace, confirm a plain member cannot open workspace settings, and confirm nothing from workspace A renders while workspace B is active.
Same task in other tools
Questions about this prompt
How do I check the tenant isolation is real?
Ask Lovable to print the Row Level Security policies for each table, then run the two-user test at the end of the prompt. If a policy is missing, any authenticated user can read other workspaces through the API even when the UI looks correctly filtered.
Should Stripe go in this first prompt?
No. Keep billing stubbed until auth and workspaces survive the verification steps, then add payments in a follow-up message. Lovable handles a payment integration better as one focused change than as a clause buried inside a large spec.
Signup works but new users never reach onboarding. Why?
Supabase requires email confirmation by default, so test accounts sit unconfirmed and the session never starts. While developing, disable confirm email in the Supabase auth settings, or sign up with a real inbox you can click through.