A SaaS starter built on PocketBase
Live demo · Used in production by Kataban
A product application with authentication, system admin, automations, email, billing, and deployment built in. Fork it and focus on what makes your product unique.
ProductBase turns PocketBase into a full product backend: a single Go binary with SQLite, JS hooks, and a React admin. It's aimed at developers and teams building a product on PocketBase, who buy the source and receive versioned upgrades.
This is a showcase repo. ProductBase is a commercial source template and its code is private. This page covers what it includes, how it's built, and my role in building it.
- Auth and signup: open or closed registration, a waitlist with invites, Terms acceptance, password reset, email-change confirmation, failed-login and IP lockouts, and login attempt logging.
- Workspaces: users belong to many workspaces with owner, admin, and member roles. The feature can be renamed across the codebase with a single agent skill.
- System Admin: users, workspaces, settings, and backups, with role-based access for admins, content moderators, and customer support.
- Notifications: an in-app bell and history page, per-category email and in-app preferences, admin broadcasts, and an audit log of every notification sent.
- Email: templates written as React Email
.tsxfiles and compiled to a typed manifest. Operators fill in values through a schema-driven admin form with live preview and test sends. - Stripe billing: one-time and subscription checkout, plan and product management, the customer portal, the full subscription lifecycle, refunds, broad webhook coverage, and a billing error log with a resolution workflow.
- Automations: event, webhook, and timezone-aware cron triggers; nine built-in step types plus admin-authored JS steps; per-step retries with backoff; durable runs that survive restarts; a flow builder and run monitor.
- Platform services: encrypted-at-rest secrets (system, user, or workspace scoped), typed variables, files, feature flags, and single-use tokens.
- For native and desktop apps: ed25519-signed license keys with seats, per-install device sign-in with QR pairing, and offline-first Replica Sync.
- Ops: deploys to Railway with settings as code, bucket backups before every deploy, and versioned upgrades.
 Users: registrations, waitlist, feedback, and lockouts. |
 Automations: event, schedule, and webhook triggered flows. |
 Email templates: code-defined templates with saved variables. |
 Notifications: one template drives in-app and email channels. |
 Billing: Stripe subscriptions and products, as deployed for Kataban. |
 Settings: typed variables, secrets, and backups. |
Creator and sole developer. I designed and built ProductBase from the first commit in February 2026. That covers:
- the framework design: PocketBase used as a Go framework, with business logic in Go services
that JS hooks call as
$pb.<feature>.<method>() - the backend services, including the billing, automation, notification, and email engines
- the React and Mantine admin and app frontend
- the license key format, Replica Sync protocol, and their reference implementations
- the release and upgrade tooling customers use to stay current
I also run it in production: ProductBase is the cloud backend for Kataban, my macOS app for running AI coding agents.
PocketBase as a framework. PocketBase is embedded as a Go library behind a single
productbase.New() entry point. Side effects (email, Stripe, encryption, scheduling) live in Go
services. JS hooks only validate, set defaults, and enforce permissions, and reach those services
through a typed $pb binding. Products built on top keep their own code separate from the core,
which is what makes upgrades possible.
A durable automation engine. A dispatcher, executor, and cron scheduler run flows triggered by typed events, webhooks, or schedules. Steps interpolate earlier outputs, retry with exponential backoff, and resume after a restart. Admins can write custom JS step types, and every run is inspectable step by step in the admin.
Cross-language license keys. One portable key format (an ed25519-signed payload) ships with a written spec, shared test vectors, and reference verifiers in Go, TypeScript, Rust, and Python. Kataban's desktop app verifies its license keys offline with it.
Replica Sync protocol. Native apps keep an offline replica and converge across any number of devices. Every record carries a server-assigned revision and devices pull by an integer cursor per scope, so stale edits are rejected as conflicts instead of overwriting, deletes propagate, and no device clock is ever trusted.
Versioned customer upgrades. A release pipeline builds versioned core bundles. Customers upgrade with a bundled agent skill that labels each changed file and applies the update file by file, leaving their own product code alone.
Built for AI coding agents. The repo ships 12 agent skills (/production-ready,
/rename-feature, /audit-permissions, /create-automation-step, and more) and documented
conventions, so agents extend it the same way a careful developer would. /production-ready runs
the convention, docs, test, and security checks in one pass.
| Layer | Tools |
|---|---|
| Backend | Go 1.25, PocketBase 0.38, stripe-go, goja (JS hooks), robfig/cron |
| Frontend | React 19, TypeScript, Mantine 9, TanStack Query, Zustand, React Router 7, Monaco |
| React Email, compiled to a manifest embedded in the Go binary | |
| Docs | VitePress |
| Testing | Go tests, Vitest, Playwright (one end-to-end spec per feature doc) |
| Infra | Docker, Railway |
- 430+ commits since February 2026
- 40k+ lines of Go, 55k+ lines of TypeScript, 20k+ lines of JS hooks and migrations
- 2,000+ automated tests: about 670 Go tests, 1,000 Vitest cases, and 350 Playwright end-to-end cases
- 50 schema migrations and 3 tagged core releases
Copyright (c) 2026 ched.dev. All rights reserved. · ched.dev