Authentication and sessions
Stop re-implementing login on every project. Token rotation, CSRF, and session control ship wired and tested.
Access + refreshHTTP-only cookiesCSRF
Skip the backend boilerplate.
Ship the product.
Starting a NestJS backend from scratch costs weeks of wiring auth, RBAC, database, and ops. This starter hands you the foundation so your first commit is product work, not plumbing.
Open source core · Production-tested · Ready in minutes
Weeks saved
~40h boilerplate eliminated
From clone to running
Under 10 minutes
Auth & RBAC
Ready out of the box
Production patterns
Not just a demo
Open core
MIT-licensed foundation
Upgradable
Pro adds the hard parts
What you stop building yourself
Every card below is hours you won't spend wiring boilerplate — so your sprint zero becomes a sprint one.
Complete user lifecycle
Onboard users on day one, not week three. Registration, email verification, suspension, and restoration are all here.
RegistrationVerificationRestoration
Role-based access control
Skip days of RBAC design. Roles, permissions, per-user overrides, and an audit log come modeled and tested.
RolesPermissionsAudit log
PostgreSQL by default
TypeORM entities, explicit migrations, connection pooling, and verified SSL — so you inherit safe persistence without piecing it together.
TypeORMMigrationsPooling
Discoverable API contracts
OpenAPI docs are generated, not written. Clients get consistent contracts for success, errors, and auth — rendered in Scalar on day zero.
OpenAPIScalarProblem Details
Operational visibility
Correlation IDs, structured Winston logs, daily rotation, and health checks ship ready — so debugging starts on day one, not when something breaks.
Correlation IDsWinstonHealth checks
Skip the architecture debate
Modular-monolith boundaries are already drawn — auth, users, RBAC, and infra live in their own modules. You inherit the decisions, not the meetings.
API Client
NestJS API
AuthenticationJWT, access/refresh tokens, CSRF
UsersRegistration, verification, lifecycle
RBACRoles, permissions, audit log
HealthReadiness probes, monitoring
PostgreSQLSMTPLogs
Clear boundaries now, microservices later — only if you ever need them.
See how it's structuredSet up once, ship every day
Same conventions across security, contracts, infra, and CI — so every new feature is just code.
Email delivery
SMTP, Handlebars templates, and a local Mailpit container mean you verify emails the same way locally and in production.
Consistent request handling
No more dropping CORS or Helmet at the last minute — validation, rate limiting, serialization, and Problem Details are the default, not an afterthought.
Tested from the start
Jest, Supertest, and Testcontainers run against your real database in CI — lint, type-check, and build pass before you merge.
Container-ready
A multi-stage Dockerfile and Compose services give you the same image from local dev to production. There is no "works on my machine."
local setup
bashgit clone <repo-url>
pnpm install
pnpm start:devThree commands from clone to a running API. The full setup guide covers databases, Docker, and environment configuration.
Core technology highlights
- API
- NestJS 11, Express, TypeScript
- Security
- Passport, JWT, Argon2, Helmet, CSRF
- Persistence
- PostgreSQL 17, TypeORM, migrations
- Quality
- Jest, Supertest, CI, Docker
Skip sprint zero. Ship product from commit one.
Five days, zero plumbing. Auth, deployment, migrations, API contracts, and observability — scaffolded, tested, and waiting before your first product commit. The weeks you'd lose to wiring become weeks you spend on the actual product.
terminal
$ curl -X POST /auth/register \
-d '{"email":"dev@..."}'
✓ User registered
$ curl -X POST /auth/login \
-d '{"email":"dev@..."}'
✓ Access + refresh tokens
Day 1: Auth that already works
Skip the two weeks most teams lose to JWT, refresh rotation, email verification, and session revocation. The first request you send registers a real user, verifies an email, and returns tokens — through tested flows, not a blog-post scaffold.
- Register, verify, and log in users from commit one — no auth wiring, no passport tutorials, no refresh-rotation bugs to chase in prod.
- Sessions, profile updates, email changes, and revocation all run through code that already has tests.
terminal
$ pnpm test
✓ 47 tests passed
$ docker compose up -d
✓ PostgreSQL + SMTP running
$ pnpm build && docker push
✓ Ready for deployment
Day 2: Production-shaped from commit one
The path from pnpm test to a pushed image is one command, not a sprint. Roles, permissions, audit logs, health checks, and a multi-stage Dockerfile all ship modeled and tested — local and prod run the same way, with nothing to reconfigure.
- Roles, permissions, and audit logs ship modeled, tested, and wired — not as TODOs for sprint three.
- 47 tests, a multi-stage Docker image, and CI pass identically on your machine and in production.
terminal
$ pnpm migration:show
[X] 0001_enable_pgcrypto · [ ] 0002_add_tz
$ pnpm migration:generate \
add-user-timezone --pretty --dryrun
✓ 1 pending migration previewed
$ pnpm migration:run
✓ Migrations applied in transaction
Day 3: Migrations, not surprises
Stop hand-writing SQL in app code or rescuing a drifted schema in prod. TypeORM migrations with pgcrypto UUID defaults run in a transaction, preview via dry-run, and revert in one command — every change is auditable, reversible, and never a surprise.
- Generate, preview with --dryrun, and revert migrations in one command — no manual SQL, no drift, no 2 a.m. schema fires.
- Every migration runs inside a transaction with pgcrypto UUID defaults on day one.
terminal
$ OPENAPI_ENABLED=true pnpm start:dev
✓ /docs + /openapi.json ready
$ curl :3000/api/v1/auth/register \
-d '{"email":"bad"}'
✓ 422 · invalid_email · pointer /email
Day 4: Contracts, not comments
Stop documenting your API in a wiki nobody reads. Scalar serves /docs straight from your OpenAPI spec, Problem Details (application/problem+json) return stable error codes with JSON Pointer fields, and X-Request-Id correlates every request across logs and audit — contracts your frontend can code against, not comments that drift.
- Ship /docs (Scalar) and /openapi.json with auth, refresh, and CSRF security schemes spec'd — your frontend team codes against the contract, not a Slack thread.
- Return Problem Details with JSON Pointer fields and stable error codes — invalid_email means invalid_email in every client, every time.
terminal
$ curl :3000/health/readiness
✓ {"status":"ok","db":"ok","heap":"ok"}
$ docker compose up -d mailpit
✓ SMTP :1025 · UI :8025
$ rg 'checkout-2026-0001' logs/
✓ correlated request + 2 audit records
Day 5: Operate like it's production
Day-two ops aren't a phase you bolt on later. Winston logs ship as JSON in prod and human-readable in dev, /health/liveness and /health/readiness (Postgres + heap) feed your container's probe every 30s, and X-Request-Id correlates any request across logs and audit — so the 3 a.m. incident takes minutes, not hours.
- Container health checks probe /health/readiness (Postgres + heap) every 30s — orchestrators pull before traffic routes.
- Any request is one X-Request-Id away across logs and audit; Mailpit catches every email in dev so nothing reaches a real customer by accident.
Don't spend sprint zero on plumbing
You get a backend that already passes its own CI, handles auth safely, and reads like code you'd write yourself — so you can spend your time on the product.