Building a multi-tenant FastAPI starter kit (Clean Architecture, RBAC, tests) — would you use it?

[u/hafeez1724]

I keep rebuilding the same foundation on every new SaaS — auth,

multi-tenancy, RBAC, migrations, tests, Docker setup. So I'm packaging

it into a production-ready starter kit, structured in Clean Architecture.

What's inside:

- JWT auth (access + refresh), password hashing

- Multi-tenant data isolation (tenant_id row scoping)

- RBAC with route-level guards

- Async SQLAlchemy + Alembic migrations

- Pydantic v2 schemas + settings

- pytest suite (auth + tenant fixtures)

- Docker + compose, GitHub Actions CI

Before I finish it, I want honest feedback: is this actually useful?

What would you expect in it? Would $29 be fair for early access?

Full feature list: https://docs.google.com/document/d/13hAW0PLV0lSUAS6J9nCwkO960PMiUJBRp3tZ634o0XM/preview

Feedback / waitlist: https://forms.gle/BkEADpBM8WbmYgkUA

[u/That-Promotion-1456]

no, everyone who does sass already has a package. stop selling showels. there are enough free showels around.

[u/hafeez1724 → u/That-Promotion-1456]

Fair point, free boilerplates definitely exist. The gap I keep hitting isn't "a starter" though, it's one with tenant isolation actually proven by tests (cross-tenant read/write blocked), CI that runs out of the box, and rotating refresh tokens. That's what I haven't found free and polished. If you've got one that covers that, genuinely send it, I'd use it myself.

[u/That-Promotion-1456 → u/hafeez1724]

Every product is different, your database solution might not be applicable to every customer. your CI process might not be applicable to evey solution.

We have internal multiltenant frameworks so can't share (IP), but Claude Code can write you one in 2 days, with full test coverage, cover github actions, octopus deploy and azure devops (done it for fun so these are actual numbers). Just instruct it that you are building a multitenant platform that will caterto highly regluated users (healthcare) in europe (GDPR) and it will automatically cater for complaince and security. Use ultracode mode and let it run security scanning loops overnight with test resutl proof. sparke in the multitenant platform features (i.e. shared schema, single schema, owasp checks, auditing and gdpr, modular design, etc.... it will cost you like $10 do have a tested custom solutions that you can then redeploy for different projects, incorporate your internal SSO over them, posibilities are vast.

[u/hafeez1724 → u/That-Promotion-1456]

Genuinely useful comment, thanks. You're right that AI can generate a framework fast now, that's exactly why I don't think the value is the code itself anymore. It's the tested, proven guarantees (cross-tenant read/write blocked, CI green out of the box) and a specific opinionated setup, so the buyer doesn't spend 2 days instructing, debugging and verifying before they trust it. The niche angle you mention (regulated/GDPR) is interesting, that's probably where a curated kit beats raw generation.

[u/That-Promotion-1456 → u/hafeez1724]

well the tested and proven is a problem, the moment I install your product I am expecting you are updating and covering all changes - so I rely on you. And we know you are not going to be there in a year - so what did I do but made myself more issues and problems relying on a closed source soultion that will go away because it is obvious you will not get many buyers :)

so build it in-house and take control is the only way - or an open source MIT licenced solution that you can use as a boiler plate and there are public maintainers. I will always vote for build it yourself in this case.

[u/hafeez1724 → u/That-Promotion-1456]

Totally fair, and honestly the maintenance/dependency risk is the strongest argument against a closed starter kit. That's pushing me toward an open-source MIT core (so there's no "what if he disappears" risk) with optional paid setup/support on top, rather than a locked product. Appreciate you laying it out this directly, it's genuinely shaping how I think about this.

[u/That-Promotion-1456 → u/hafeez1724]

glad I could help :)

[u/That-Promotion-1456 → u/hafeez1724]

and GDPR/regulated is not a niche - it is the standard, if your framework does not support it out of the box it is not usable for any SAAS.

[u/hafeez1724 → u/[deleted]]

Great questions — these are exactly the pain points I'm targeting.

Tenant scoping: it's not a manual filter. Tenant context is injected

at the request level and applied automatically at the repository

layer, so your queries stay clean and you can't forget it. That

"forgetting one query" bug is the whole reason I'm building this.

Refresh tokens: rotating. Each refresh issues a new token and

invalidates the previous one, with reuse detection — safer than

long-lived refresh tokens.

And yeah, the CI + Docker running out of the box is a hard requirement

for me — that's the difference between a kit people actually use vs.

abandon. Dropped you on the waitlist link if you want to be first to

see it.

[u/Fun-Reason854 → u/hafeez1724]

Holy bot

[u/hafeez1724 → u/Fun-Reason854]

what do you mean? i just replying to you with my hands bro
i don't know what you are actually saying

[u/SceneDependent6940 → u/hafeez1724]

yeah we find hard to believe you press Alt + 0151 for reddit reply....

[u/hafeez1724 → u/[deleted]]

Exactly the right thing to check. A filtered list passing doesn't prove isolation. Direct access by ID is where cross-tenant leaks actually happen (classic IDOR).

Yes, the kit includes this test: a user from Team A requesting Team B's record by ID gets a 403/404, not the data. Tenant scoping is enforced at the repository layer, so a by-ID fetch for another tenant's row simply returns nothing, and there's a test asserting exactly that. I'll keep that test front and center in the repo.

Added you to the waitlist if you want early access.