$ npx @xk2800/create-nextjs
Auth and an admin back office, already built.
Google + email sign-in, a full user-management dashboard, audit logging with device and location tracking, and live feature flags — running on Next.js, Drizzle, and Postgres, ready before you write your first page.
registration & login info
- device
- WebKit · Desktop
- location
- United States
- referrer
- direct visit
- ip address
- 172.71.28.153
- captured at
- October 25, 2026 at 12:39 PM
This is what the template records for every real sign-in — captured live from your visit to this page, not a mockup.
next.js 16.3.0react 19.0.0typescript 6.0.3tailwind css 4drizzle orm 0.45.0better-auth 1.7.6
server/drizzle/*.sql, ordered
Everything shipped, in the order it landed.
This template tracks its own growth the same way it expects you to track your schema — numbered, one capability at a time.
0001shipped
Authentication
Sign-in, wired up and hardened before you touch it.
- Google OAuth and email/password, toggled independently per deployment
- Optional Google One Tap prompt
- bcrypt-hashed credentials, DB-backed sessions with a 5-minute cookie cache
- Open-redirect-safe callback URLs on every login and signup route
- Role-based access — user and admin, enforced at the layout level
- Self-serve password reset — emailed link, single-use token, no support ticket
- Self-serve email verification — resend from the dashboard, Better-Auth callback flips the flag
- OAuth callback double-hit recovery — a stale "please restart the process" redirect (browser Back, bfcache replay) silently retries instead of stranding you on an error page
- Cookie-consent banner — "Necessary only" as easy to pick as "Accept all", changeable later from the footer; "Customize" gives a separate, unticked choice for the device fingerprint and for One Tap, each waits for its own consent, withdrawing fingerprint consent erases the stored device record, each signed-in user's choices are kept as proof of consent (Beta), and a useCookieConsent() hook gates your own analytics
0002shipped
Admin dashboard
A real back office, not just a route behind a login check.
- Searchable, paginated user table — ban, promote, delete, one click
- Bulk ban, bulk delete, and CSV export for the whole user list
- Per-user detail page: sessions, activity log, and account status, one screen
- Device signals on the user page (Beta) — every device an account signed in from, with the browser and device traits behind its fingerprint (platform, screen, fonts, languages, CPU, WebGL…) in a collapsible list; accessibility settings are never collected
- Consent history on the user page (Beta) — each user's current cookie choice, allowed or declined per purpose, plus every change with the consent-text version and time, as proof of consent
- Consent-mode switch (Beta) — one System Settings toggle for whether GDPR/ePrivacy consent is required: on shows the cookie banner and waits for consent to each purpose (enforced server-side too), off runs everything for every visitor
- Live online/offline indicator via a lightweight heartbeat endpoint
- Marketing email (Beta) — send updates to a Resend segment as a broadcast, so newsletters use the marketing quota instead of the daily transactional limit; save as a draft or send now, preview past broadcasts and send drafts from the list, see who's subscribed or unsubscribed in each segment, and let users opt in or out themselves from their dashboard, with an unsubscribe link added automatically
0003shipped
Audit & impersonation
Every sign-in and every admin action leaves a record.
- Activity log with search, action, and date-range filters, plus CSV export
- Admin impersonation, logged on start and stop, with an always-visible banner
- Every login captures OS, browser, device type, and city/country — offline, no third-party calls
- Referrer tracking survives the round trip through Google's OAuth redirect
- New-device sign-in alerts — a client-side device fingerprint flags any device an account hasn't used before and emails the user, instead of noisy IP/user-agent matching
- Multi-account / trial-abuse flag — the admin panel surfaces any device fingerprint shared by three or more accounts, each linked for a one-click ban
0004shipped
Live system settings
Flip a switch instead of shipping a deploy.
- Turn Google, email/password, or One Tap sign-in on or off, live
- Maintenance mode with a custom message and your own list of pages that stay open — admins keep access, everyone else doesn't
- Changes take effect within seconds, cached, and fail open if the database hiccups
- Every settings change is itself written to the activity feed
0005shipped
Data layer
Typed schema, real migrations, no ORM guesswork.
- Drizzle ORM over Postgres — self-hosted for dev, Neon serverless in production
- Versioned SQL migrations, generated and reviewable, never run blind
- Zod-validated environment config, kept separate for dev, prod, and test
- Drizzle Studio wired up for local inspection out of the box
- TLS toggle for self-hosted Postgres — one DATABASE_SSL env var, no code changes for managed hosts that require it
0006shipped
Developer experience
The template ships itself, too.
- Published as an installable package — import auth, schema, and admin components directly
- Doppler secrets management, or plain .env files — your choice
- Docker support out of the box
- A versioned changelog and an automated release script
- `bun run doctor` — one command checks runtime version, env validity, DB connectivity, and pending migrations, for a fast "just cloned this" sanity check
- Installable as an app (Beta) — a web manifest named from APP_NAME, so browsers offer "Install app"; its icons are generated from your favicon, visited public pages keep working offline, and anything else shows an offline page instead of the browser error; Settings shows install steps for the visitor's own device and browser, with a one-click Install button where the browser supports it
- In-app feedback (Beta) — a Feedback button in the dashboard sends bug reports and suggestions to a Discord channel webhook, an email inbox, or both, tagged with the sender, page, and browser; @mentions are neutralised and each user is held to one message every 30 seconds
- File upload component (Beta) — take a photo with the camera, pick from the gallery, or drag and drop, each method off by default and switched on with its own prop; image previews, type and size limits, and a max file count
0007shipped
Data display
A table that adapts to its container, not the other way around.
- Responsive DataTable — overflowing columns collapse into an expandable per-row detail panel instead of forcing horizontal scroll
- Per-column sticky and minimum-width control, with a configurable collapse breakpoint
- Fully generic over your own row type — see it live at /dashboard/data-table
0008shipped
Two-factor auth & passkeys
A second factor and passwordless sign-in, both self-serve.
- TOTP two-factor — QR-code setup, 10 single-use backup codes, enable/disable from Settings
- A password sign-in on a 2FA account redirects to a code challenge, with a 30-day "trust this device" option
- Passkeys (WebAuthn) — register Touch ID, Windows Hello, or a hardware key, then sign in with no password
- Manage registered passkeys from Settings; the TOTP QR and secret never leave the browser
- Adding or removing a passkey emails the account owner and lands in the activity log
- Self-serve account deletion from Settings — password-confirmed (or a recent sign-in for Google-only accounts), wipes sessions, passkeys, and history
Clone it, migrate it, ship it.
The scaffolding is done. Bring the product.