Cheat Sheet · Day 4 · Auth · DB · Payments

🧱The stack

Auth + DBSupabase · Postgres + magic-link auth + RLS · free to 50k MAU
MoneyStripe Checkout · hosted · cards + Apple/Google Pay + BNPL
Wire itClaude · knows both patterns cold
DeployVercel / Lovable · push = live

The rule: boring + free + integrated beats clever. Don't roll your own auth or billing.

🎯What "done" means

Not "I set up Supabase." Not "I added a button."

Done = a row lands in your subscriptions table after a 4242 test charge.

✅ magic-link login ✅ pay button ✅ row in the table

Post your live URL + a screenshot of that row in #day-8-commits.

💳Test cards

Happy path4242 4242 4242 4242
Declined4000 0000 0000 0002
Exp / CVC / ZIPany future date · any CVC · any ZIP

Always in TEST MODE — orange banner visible. Don't charge yourself a real $19.

Local webhooks: stripe listen --forward-to localhost:3000/api/webhooks/stripe

🔒RLS pattern

The whole rule: auth.uid() = user_id. Enable RLS + 4 owner policies on every table.

-- on every table:
alter table [t] enable row level security;
create policy "owner read" on [t]
  for select using (auth.uid() = user_id);
-- repeat: insert (with check), update, delete

Check: Database → Tables → red padlock = public. Click → enable RLS. Now.

⏱The 90-minute timeline

0:00Open + brief — where you are, the one job: login in, money out
0:05The boring stack — Supabase + Stripe · what to skip
0:12Setup — Supabase in 10 min · magic link · schema · RLS · padlock check
0:33Money — Stripe Checkout (30 lines) · pick your pricing model · write your number
0:42Live demo — login + payment wired in 10 min
0:54Build 1 — wire Supabase auth · log into your own app (20 min)
1:14Show & tell — where's everyone at?
1:17Build 2 + ship — Stripe Checkout · test card · deploy · URL in Discord
1:25Commit — post it · sleep · Deploy Day at 9:00

💰Pick a price shape

Subscription · $X/moDefault for SaaS. Value compounds over time. Notion, Linear, Calendly.
One-time · $X foreverValue is in the artifact (template, course). Easier launch-day sell. Marc Lou's ShipFast.
Usage · $X per 1kCost scales with use. AI tools. Stripe Billing meters it.

Skip freemium today. One paid tier + 7-day trial. Add free later (you won't).

🪤The 6 traps

Wrong magic-link redirect. Set Site URL to localhost:3000, restart.
App returns zero rows. RLS on, no policies. Add the 4 owner policies.
Webhook signature failed. Use req.text(), not req.json().
Success page, no row. Webhook never fired. Run Stripe CLI / check Events.
Used the live Stripe key. Toggle Test Mode, swap to test secret.
Service-role key in client. Server-side only — it skips RLS.

⌨️Key prompts at a glance

1 · Auth"Scaffold Next.js 14 magic-link auth with @supabase/ssr · client + server + login + callback + protected layout."
2 · Schema"Generate Supabase migration SQL for 3 tables, RLS enabled, owner-only policies."
3 · Checkout"Build /api/checkout route · hosted Stripe Checkout · pass customer_email + metadata.user_id."
4 · Webhook"Build /api/webhooks/stripe · verify signature with req.text() · upsert subscriptions on completed."
5 · Pricing"Build a /pricing page · one card · big price · CTA triggers Checkout · mobile-first."
6 · Commit"Draft my Day-8 Discord commit · live URL · login ✅ payment ✅ · what broke · my number."

Full versions with copy buttons → Prompt Pack. Run all six in one Claude chat, top to bottom.

Users, money & logins — one page.