Sandpiper Kit

Sandpiper Kit avoids auth libraries entirely. Sessions, password hashing with Argon2, email verification, rate-limited login and TOTP two-factor are all implemented in about 600 lines you can audit. The database layer is Drizzle on Postgres, emails go through any SMTP server, and Stripe Checkout handles payments with a webhook that updates a subscriptions table.

The maintainer is opinionated about understanding your own auth, and every file has comments explaining why each check exists. It is a good kit to learn from. The limitation: billing stops at checkout. There is no plan switching, proration or invoice history in the UI, and OAuth providers are left as an exercise with one GitHub example.