Nuxter vs SuperSaas

Stack and hosting

Nuxter is built for Cloudflare Workers on purpose. Queues, file storage, cache, mail, rate limiting, AI and the database connection are bindings, resources the Worker reaches by name with no API key, declared in one wrangler.jsonc. You learn one platform and run one Cloudflare account, and the code for each binding ships with the kit. Your Postgres database sits with a provider you choose and is reached through Hyperdrive, Cloudflare's connection pooler for Postgres. The trade is that the app runs on Workers and nowhere else. The deployment docs list the commands that create each resource.

Both kits are Nuxt 4 apps on Nuxt UI 4, Tailwind 4 and Drizzle. SuperSaas sells its SaaS kit as Essentials, with the Demo App as a second repository. Essentials builds sign-in, organizations, admin and Stripe billing on Better Auth, an auth library with a plugin for each part. Nuxter's sign-in, sessions and organizations are its own code on nuxt-auth-utils, a Nuxt module for encrypted session cookies, password hashing and OAuth.

SuperSaas builds for Workers, Vercel or a Node server by one environment variable, and its deployment docs mark Workers as the tested host for Essentials.

Sign-in and accounts

Nuxter's passkeys and authenticator codes run on Workers from the first deploy, and each new passkey mails its owner a notice. You choose password or magic-link sign-in and add GitHub and Google. SuperSaas turns on email and password, magic links, a six-digit email code and GitHub, Google and Discord together. Nuxter's build mounts routes for the methods you chose and none for the rest, so a method you turned off has no endpoint anyone can call; the SuperSaas docs say its flags hide a method's form while the endpoint still works.

A provider sign-in whose email already has an account is refused until the owner connects that provider from Settings, so a GitHub or Google account with a matching address cannot sign in to someone else's account. Nuxter checks the session row on every request, so signing out a device or changing a role applies on the next one. SuperSaas caches sessions in a cookie for five minutes by default, so a revocation can take that long unless you shorten the cache.

Organizations and permissions

Nuxter declares named permissions in config, and the type check rejects a guard that names one you never declared. A plan can sell a permission, and a route guarded by it answers 402 upgrade-required, so your front end knows to show an upgrade prompt. An organization can have branches, sites or projects under it that share its plan and seats and are run by its owners and admins, so a customer with several locations holds one plan for all of them. The SuperSaas docs describe no level below an organization. Membership, role and invitation changes, and plans that staff grant or revoke, land in an audit trail the organization's managers can read.

In Nuxter, open invitations count toward the member cap, and the seat is checked again at acceptance, so a team cannot invite past its plan. SuperSaas blocks an invitation when no seat is free, and its invitation docs add that pending invitations do not reserve seats, so on a plan with several free seats you can send more invitations than seats, and the last acceptances fail.

Nuxter refuses to delete an account that is the only owner of an organization other people belong to, and by default holds a deleted account for 30 days with a restore link before erasing it. The SuperSaas docs warn that when the only owner deletes their account, nobody is left who can manage billing.

In both kits the organization owns members, invitations, seats and the subscription, with owner, admin and member roles. For anything finer than those three roles, the SuperSaas docs tell you to check the role inside the route.

Payments and billing

You pick providers in one config array. On Stripe, Polar and Creem, the code in a coupon link is checked with the provider before the buyer is sent to pay. A free trial set in config, on Stripe or Polar, goes to each buyer once, so cancelling and resubscribing does not earn a second one.

Failed renewals keep access for pastDueGraceDays (14 by default) behind a payment banner. If the webhook for a paid checkout never arrives, the return page asks Stripe or Polar directly and applies the purchase, so a buyer who paid is not left on the free plan. A payments:refunded event lets your code take back anything else a refunded payment handed out.

SuperSaas runs Stripe through the @better-auth/stripe plugin, which mounts the webhook endpoint for you. You create plans in Stripe, and its Stripe docs say to re-run the sync after each change.

Database, jobs and files

Nuxter runs on Postgres, hosted by a provider you choose and reached through Hyperdrive. Locally it runs PGlite, Postgres compiled to WebAssembly, so pnpm dev needs no database server. Kit tables and yours migrate in separate chains, so a kit update never renumbers a migration you wrote.

Each background job is one file in server/jobs/, and a wrong payload shape fails the type check where you enqueue it.

SuperSaas leads on database choice: Essentials comes as Turso, NuxtHub SQLite or Postgres, one git branch each.

Nuxter stores uploads in R2 with formats, a size cap and access set per upload purpose, and an owner-only purpose serves a file to the signed-in user who owns it and nobody else. SuperSaas stores files in an S3-compatible bucket such as AWS S3, Cloudflare R2 or Backblaze B2, and its Demo App docs say the file manager serves uploads to anyone with the URL unless you add a check.

Email and notifications

Nuxter sends mail through Cloudflare Email Sending or Resend. If one provider fails, the next one sends the mail, and if every provider is down for a moment, a background job retries it later, so a password-reset mail survives a brief provider outage. Mail goes out in the reader's language, and product and marketing mail carries a one-click unsubscribe. An in-app notification bell ships with payment notifications already wired.

SuperSaas supports more email providers: the maker's open-source useEmail library covers six, from Resend to ZeptoMail. Its docs list five templates written as Vue components, with mail rendered and sent in one call, and describe no queue or retry behind it and no in-app notifications.

AI

Nuxter ships the typed server calls a product makes: text, images, speech, transcription, embeddings and video, through the Workers AI binding with no API key. Models are named by role in config, and one environment variable swaps a role's model for a deploy. The AI docs show each call.

SuperSaas's AI docs say Essentials ships no AI code. The Demo App has an organization-scoped chat with streaming replies, generated titles and a model picker, built on the Vercel AI SDK, with Workers AI, OpenAI or Google Gemini picked by environment variable.

Content, languages and marketing pages

Nuxter ships a Markdown blog with tags, RSS and generated Open Graph images, a pricing page built from the plan config, legal page templates and sitemaps. A GitHub Actions workflow drafts a post with an AI model, translates it, makes a cover and opens a pull request for you to review. The languages docs show how Nuxter serves each language and how to add a third.

Nuxter records page views and product events from the server to Cloudflare Analytics Engine, PostHog or Umami with no tracking cookie, has a consent banner that honours Global Privacy Control, and ships typed feature flags with percentage rollouts. The SuperSaas docs describe no analytics provider or cookie consent, and the feature flags they document hide login methods from the UI.

Essentials has no marketing site, and the SuperSaas docs say its root route is the login page. The pricing page lists "Landing, pricing and blog in the Demo App". The docs describe no blog, legal pages or sitemap.

Admin and operations

Your staff get a searchable customers list where they edit and suspend accounts, send reset links, grant a plan and refund a one-time purchase, so support can give a customer a plan or return money without opening the provider's dashboard; the SuperSaas admin docs describe no refunds or plan grants. Impersonation is read-only, ends after 30 minutes and appears in the customer's own activity log with the staff member as actor, so a support session cannot change data and the customer sees it in their log.

SuperSaas's admin area runs on Better Auth's admin plugin, and its user management docs say there is no impersonation audit log out of the box.

Nuxter locks a sign-in route for 15 minutes once its limit is spent, so a script guessing passwords gets ten tries per address and IP before it waits. Every response carries a Content-Security-Policy and other security headers, and with two keys set, Cloudflare Turnstile, Cloudflare's bot check, screens sign-in forms. Turn on monitoring and paste the DSN your tracker gives you, and server errors go to Sentry or Better Stack; GET /api/health lets an uptime monitor tell a dead database from a dead Worker. The SuperSaas docs document Better Auth's rate limit of 100 requests a minute per client and describe no security headers, bot check or error tracking.

Tests

Nuxter's GitHub Actions workflow runs lint, typecheck, both Vitest suites and a build on every pull request, and the Playwright smoke set runs when you add the e2e label to a pull request, or by hand.

A deploy workflow runs database migrations before it uploads the Worker, so a failed migration leaves the old version live. The build refuses a starter.config.ts that cannot work, such as a queue with no consumer, and names the key to fix, so a broken config fails before it reaches production.

The package.json the SuperSaas docs publish for Essentials has lint and typecheck scripts and no test script. Its home page says every feature is exercised against real inputs and edge cases before it ships. The repositories are private, so this describes what the docs show.

Updates

Nuxter's pnpm template:update puts everything the kit changed since your last update into one commit on a branch, which you review as a pull request. The update docs list which paths are the kit's and which are yours, so you know where to put code that no update touches.

SuperSaas's update docs have you add the kit as a git remote, create a temporary branch, run git pull for the branch you cloned and resolve conflicts in your editor's merge tool. They describe no update script, and for schema conflicts they say to keep both sides and regenerate migrations. SuperSaas keeps a changelog on its website with twelve dated entries between 17 April and 18 September 2026.

Docs and AI coding agents

Nuxter's docs are public, 25 pages with search, and nuxter.app serves an llms.txt and an llms-full.txt. In the code, one 330-line AGENTS.md covers setup, checks, code standards and known traps, and pointer files make Claude Code, Cursor and GitHub Copilot read it.

SuperSaas adds an "Ask AI" assistant to its docs, an MCP server for the docs that its pricing page lists, and eight agent skills in Claude Code's format that ship with the Demo App and, its docs say, are not in Essentials yet.

Price and license

When this page was checked, the SuperSaas home page button read "Buy Now for $149 (Save $99)" above a counter reading "90/100 used".

Nuxter's license defines a seat as one person with one GitHub account: everyone who reads or changes code containing the kit needs one, and CI and AI coding tools need none. The SuperSaas pricing page says there is no seat count, and its license forbids sharing it with other people or companies. Both licenses cover any number of your own products and forbid a public repository that contains the kit.

Support and community

Nuxter's support is by email to Devilos LLC, the company that makes it; the public docs and AGENTS.md cover the rest.

SuperSaas gives a support email on its pricing page, links a Discord community in its footer and says you can raise issues and feature requests on GitHub. Its FAQ says support covers setup, configuration and understanding the code, and not your own business logic or custom features. The maker's about page says he reads and answers every message himself.