Replit Agent prompt to build a SaaS starter app
Use this when you want the boring parts of a SaaS product built once: auth, workspaces, roles, invites, and a billing stub. Replit Agent produces a deployable starter you can fork for each new idea, with role checks enforced on the server rather than hidden in the UI.
Last updated
Build a SaaS starter app on Replit that I can fork for future products, with {{database}} for storage.
Screens: landing page with a pricing section, signup and login, an app shell with sidebar navigation, a settings area (profile, workspace, billing), and an admin-only members list.
Auth: use Replit Auth rather than hand-rolled sessions. Every role check happens on the server; hiding a button is not enforcement.
Data model: users, workspaces, memberships with a role of owner, admin, or member, invitations with single-use expiring tokens, and a subscriptions table holding plan and status even though payments are stubbed.
Behaviors:
- New signups get a personal workspace automatically.
- Owners invite by email; the invite link opens a join page and the token dies after acceptance or expiry.
- Billing is a stub that flips the plan field, ready for {{addon}} to be wired in later as its own milestone.
Edge cases: the last owner of a workspace cannot be demoted or removed, an accepted invitation cannot be reused, and deleting a workspace requires typing its name to confirm. The members list and the no-workspace state both need designed empty screens.
Verify: app users here are Replit identities, so you cannot create a second account to test with. Prove role enforcement server-side instead: write a dev-only test script that stubs the session with two fake user ids, seeds one as owner and one as member of the same workspace, calls the members-list and workspace-delete endpoints as the member, and asserts both are rejected with 403. Assert too that an invitation token fails on its second use. Paste the script output in chat, then set the app up for deployment; I will run the two-browser invite walkthrough myself once it is live.Customize it
Runs in your browser. Nothing you type here is sent anywhere.
Build a SaaS starter app on Replit that I can fork for future products, with PostgreSQL for storage. Screens: landing page with a pricing section, signup and login, an app shell with sidebar navigation, a settings area (profile, workspace, billing), and an admin-only members list. Auth: use Replit Auth rather than hand-rolled sessions. Every role check happens on the server; hiding a button is not enforcement. Data model: users, workspaces, memberships with a role of owner, admin, or member, invitations with single-use expiring tokens, and a subscriptions table holding plan and status even though payments are stubbed. Behaviors: - New signups get a personal workspace automatically. - Owners invite by email; the invite link opens a join page and the token dies after acceptance or expiry. - Billing is a stub that flips the plan field, ready for input validation to be wired in later as its own milestone. Edge cases: the last owner of a workspace cannot be demoted or removed, an accepted invitation cannot be reused, and deleting a workspace requires typing its name to confirm. The members list and the no-workspace state both need designed empty screens. Verify: app users here are Replit identities, so you cannot create a second account to test with. Prove role enforcement server-side instead: write a dev-only test script that stubs the session with two fake user ids, seeds one as owner and one as member of the same workspace, calls the members-list and workspace-delete endpoints as the member, and asserts both are rejected with 403. Assert too that an invitation token fails on its second use. Paste the script output in chat, then set the app up for deployment; I will run the two-browser invite walkthrough myself once it is live.
Same task in other tools
Questions about this prompt
Why does the prompt insist on Replit Auth instead of email and password?
Session handling and password storage are exactly where generated code grows subtle bugs, and Replit Auth is already integrated with the platform. Hand-rolled auth only makes sense if you plan to move the app off Replit later; say so and the agent will use a maintained library.
The agent keeps trying to wire real payments on the first pass.
Live payments need keys and webhook endpoints, which stall a first build. This spec keeps billing as a stub that flips the plan field; when you are ready, add the payment keys via Secrets and request checkout as a separate milestone.
How do I test the invite flow with only one person?
Use one normal window and one incognito window for two sessions. Sign up in both, send the invite from the owner account, accept it in the other, then confirm the member cannot open the admin members list or remove the workspace.