Nuxter vs supastarter

Stack and hosting

Nuxter is built for one platform on purpose. It is one Nuxt 4 app that builds into a single Cloudflare Worker, and the services it runs on, from the queue to the cache, sit on the same Cloudflare account, declared in wrangler.jsonc. Outside Cloudflare you pick a Postgres host, which the Worker reaches through Hyperdrive. The trade is that the app runs on Workers and nowhere else.

A GitHub workflow deploys main when CI passes: it runs the database migrations, then uploads the Worker, and a failed migration leaves the old Worker live. You create the Cloudflare resources once before the first deploy, with the commands in the deployment guide.

Both kits run Nuxt 4 with Nuxt UI 4 and Tailwind CSS 4. supastarter is a Turborepo monorepo of four apps (product, marketing site, docs and mail preview) plus shared packages, with an oRPC API that generates OpenAPI docs at /api/docs. Its docs say it can in general be deployed to any provider that supports Node.js, with guides for Vercel, Render, Fly.io, Netlify, Docker and Coolify, and do not mention Cloudflare Workers.

Sign-in and accounts

Setting up authenticator codes (TOTP) in Nuxter issues ten one-time recovery codes, so a lost phone does not lock anyone out. A deleted account is held for 30 days by default with a mailed restore link, so a user who deletes by mistake restores it themselves, and users can download their data as a JSON file. Each account has a security log of sign-ins, failed sign-ins, credential changes and anything staff did to it.

supastarter's Nuxt docs do not mention recovery codes, a deletion grace period or a data export. It ships an onboarding flow after signup, built from step components with a progress bar.

Both kits ship email and password, magic links, passkeys, TOTP and sign-in with GitHub and Google; supastarter builds them on Better Auth, Nuxter on nuxt-auth-utils.

Organizations and permissions

A Nuxter organization can hold a second level of branches, sites or projects, declared in config. The parent's owners and admins run every child without joining it, and a child uses its parent's plan and seats. If you sell to a restaurant group, a franchise or an agency with client sites, that structure is already in the data model and the permission checks.

Each organization also keeps an audit trail of thirteen event types, from members added and roles changed to plans granted and revoked, which its managers can read. You add organization roles and permissions in config, and a guard that names an undeclared permission fails the type check, so a misspelled permission is caught before the code ships. Each plan sets a member cap that invitations respect.

supastarter's organizations have owner, admin and member roles, invitations and a typed permission matrix with six built-in keys, and it can require an organization after signup. Its docs do not mention levels under an organization or an audit log. In both kits the organization in the URL is the active one.

Payments and billing

Nuxter handles what happens when a payment goes wrong, which supastarter's docs do not describe. Both kits sell subscriptions and one-time plans through Stripe, Polar, Lemon Squeezy and Creem, and supastarter adds Dodo Payments.

The grace period runs from the first failed charge, and everyone who can bill the organization sees the date access ends. Webhooks are signature-checked, a duplicate delivery is skipped, and an older event never overwrites a newer one, so a provider that retries or reorders events cannot grant a plan twice or move a subscription backwards. The payments docs cover each case.

supastarter offers more pricing models: a seatBased price is multiplied by the number of organization members, and its usage-based billing guide gives example functions that report usage from your own server code.

Database, jobs and files

Nuxter uses Postgres with Drizzle. The database is hosted by a provider you choose, such as Neon, Supabase or PlanetScale, and the Worker reaches it through Hyperdrive, Cloudflare's connection pooler. Locally, pnpm dev starts an embedded Postgres (PGlite) with the migrations applied, so a fresh clone runs with no Docker and no database account.

Background jobs run on Cloudflare Queues, each one a typed file. A failed job retries with growing delays, and a job that fails its last retry goes to a dead letter queue, where it is reported. Six cleanup tasks run on a daily cron. supastarter covers jobs with guides for trigger.dev and Upstash QStash, in which you install the SDK and write the task files.

supastarter defaults to Prisma on Postgres, ships Drizzle schemas as an alternative and supports MySQL and SQLite. Locally, Postgres and S3 storage run in Docker Compose. Its files go to any S3-compatible service, uploaded from the browser straight to the bucket through presigned URLs. Nuxter stores files in Cloudflare R2 with type, size and access rules per purpose, and identifies each upload by its first bytes, whatever type the browser claims. Both wire avatar and organization logo uploads.

Email and notifications

Nuxter sends mail through Cloudflare Email Sending or Resend. List both and the sender falls back to the second when the first fails, then queues the mail for retry when every provider is down for a moment, so an outage does not lose a password reset. Product and marketing mail respects each user's opt-out and carries a one-click unsubscribe link. supastarter's docs do not mention retrying outgoing mail or unsubscribe links.

supastarter ships more providers: Resend by default, Postmark, Mailgun, and Nodemailer for any SMTP server, plus a mail preview app. Both write templates as Vue components compiled by Maizzle, with copy per language.

Both have an in-app notification center with preferences. supastarter's notification kinds can also go out by email.

AI

Nuxter ships AI as a server module: the typed calls a product makes for text, images, speech, transcription, embeddings and video. Cloudflare Workers AI is wired through the Worker's binding with no API key, providers are tried in the order you set, and another provider is one file you add.

supastarter ships a working chatbot with chat sessions, history and streaming responses on the Vercel AI SDK, with OpenAI models by default for text, images and audio.

Content, languages and marketing pages

Nuxter's blog is Markdown on Nuxt Content with tag pages, an RSS feed per language, and a GitHub workflow that drafts a post with an AI model, translates it and opens a pull request for you to review. Analytics are recorded on the server, with no vendor script or tracking cookie, and sent to Cloudflare Analytics Engine, PostHog or Umami. A consent banner ships and honors the browser's Global Privacy Control signal. supastarter's Nuxt docs do not mention a consent banner.

supastarter leads on the marketing site: a separate Nuxt app with a landing page (hero, features, FAQ and newsletter sections), pricing and changelog pages and a contact form, with a VitePress docs site beside it. Its interface and emails come in English, German, Spanish and French. Nuxter ships English and Serbian, with localized routes, emails and legal pages, and a test holds every language file to the same keys, so a missing translation fails the unit tests before it ships.

Admin and operations

Nuxter's customers page lets staff edit, suspend and impersonate an account, grant a plan and refund a one-time purchase, and every staff action lands in the affected user's security log. On a fresh deploy the first account to prove its email becomes the administrator, so you do not touch the database to get in; supastarter's admin docs have you set the role field to admin in Prisma Studio. Its admins can search users and organizations, edit and ban users, and impersonate them.

Nuxter rate-limits every credential route (sign-in, registration, password reset, magic link, TOTP and passkeys) with a 15-minute lockout, counted in a Durable Object, a small stateful Cloudflare service. Turnstile, Cloudflare's CAPTCHA, turns on with two keys, and a Content-Security-Policy and hardening headers are on by default. /api/health checks the database, so an uptime monitor can tell a dead Worker from a dead database. Every response carries a request id that the error page also shows, so a user's screenshot leads to the log line, and server errors can go to Sentry or Better Stack without an SDK.

supastarter's changelog records an origin allowlist for auth redirects and CORS, and tracking of failed two-factor attempts. Its Nuxt docs do not mention rate limiting, CAPTCHA, security headers or a health check, and its Sentry guide has you install @sentry/nuxt.

Nuxter also ships typed feature flags evaluated on the server, with targeting by role, user or locale and percentage rollouts, so you can release a feature to part of your users without a flag service. supastarter's Nuxt docs use the term feature flags for the config switches that turn sign-in methods and organizations on and off.

Tests

Nuxter ships 335 test files: 230 unit, 97 component and 8 Playwright. The unit tests run against PGlite, a real Postgres engine, with the migrations applied.

supastarter ships a Playwright setup for the product app and the marketing site, which a GitHub Action runs on every pull request once you add the secrets the app needs. Its CI has separate lint, type-check, unit and e2e jobs, with Vitest tests for API procedures. Its docs do not say how many tests ship.

Updates

Nuxter's pnpm template:update brings everything the kit changed since your last update as one commit on a branch, which you review as a pull request. A table names every path as the kit's, yours or shared, so you know where your code can live without touching kit files. The kit's database migrations run in a chain separate from yours.

supastarter's update docs have you add the kit's repository as a remote and run git pull upstream main --allow-unrelated-histories --rebase. They say each change you make to your app makes updating harder, because the update is a rebase onto the latest kit.

supastarter's Nuxt edition launched in November 2023 and was rewritten in March 2026, and the changelog on its site lists 141 dated entries across its three editions, the latest on 16 September 2026.

Docs and AI coding agents

Nuxter ships an AGENTS.md with pointer files, so Claude Code, Cursor and GitHub Copilot read the same brief before they edit code: setup commands, the checks to run before finishing, the code standards, a list of traps with their causes, and where each kind of code belongs.

Both kits publish their docs before you buy; Nuxter's docs run to 25 pages with search.

supastarter ships AGENTS.md and Agent Skills, instructions for common workflows written to an open specification. Its Nuxt docs listed 22 of them when checked, and its site says Cursor rules ship too.

Price and license

Each kit is a one-time payment. The two Nuxter licenses differ only in seats, and each includes the private GitHub repository, every update and any number of your own products; the license never expires. supastarter's pricing section and FAQ promise lifetime updates, and these are the list prices for its Nuxt edition.

Client work takes one Nuxter license per client, which can be bought in the client's name, so the client holds its own license when you hand the project over. supastarter's license lets you create multiple end products for yourself or for multiple clients, and lets resellers and freelancers buy on a client's behalf.

Support and community

Nuxter's support is by email to Devilos LLC, the company that makes it. The public docs and the AGENTS.md brief your coding agent reads cover the rest.

supastarter's FAQ describes a Discord community, which its site puts at 1200+ members, and a support channel for paying customers. The Agency tier adds a private Discord channel with direct access to the founder.