What Slicekit includes

The foundation, already built

Slicekit is not an empty repo with a framework bolted on. It is a working system: the parts every SaaS needs are assembled, wired together and tested, so your first commit is a feature instead of plumbing. This page is the map. Each capability links to the guide that shows you how to use and extend it.

Identity and access

• Cookie sessions with CSRF. Server-side sessions backed by Redis, not bearer tokens in the browser. See authentication.
• Roles and permissions. A typed Allow permission catalogue enforced on endpoints and mirrored to the SPA. See adding a permission and permissions in the UI.
• OAuth providers. Sign in with external providers alongside the cookie session. See adding an OAuth provider.
• Two-factor authentication. TOTP enrollment, verification and recovery codes. See two-factor authentication.
• Admin impersonation. Support staff can act as a user, with the action recorded. See impersonation.

The architecture

• Vertical slices. One feature, one folder; no layered free-for-all. See adding a vertical slice and the architecture overview.
• Domain-driven design. Aggregates own their invariants and raise events. See domain-driven design.
• CQRS over Wolverine. Commands, queries and a message bus, with handlers discovered automatically. See CQRS and domain events.
• Reliable messaging. A transactional outbox makes integration events safe to publish. See domain and integration events.
• A shared error taxonomy. Result<T> and AppError map cleanly onto ProblemDetails responses. See error handling.

Data and operations on data

• PostgreSQL with EF Core. Migrations apply on start in development and as a deploy step in production. See adding a database migration.
• Pagination. Shared primitives for paged, sortable lists end to end. See pagination.
• File storage. An S3-compatible abstraction, MinIO locally and any bucket in production. See file storage.
• Auditing. Emit “who did what” events that flow to Loki and an admin audit log. See auditing.
• GDPR tooling. Per-user data export and erasure built in. See data export and GDPR.

Billing and monetisation

• Stripe subscriptions. Checkout, trials, the Customer Portal, and webhook-synced subscription state, with Stripe as the source of truth. See billing and entitlements.
• Feature-key entitlements. Map Stripe products to your own feature keys to gate endpoints and UI by plan, with flags and numeric limits resolved per user. See billing and entitlements.

The frontend

• A typed React SPA. Vite, TanStack Router and Query, and shadcn/ui. See frontend overview.
• One typed API client. Cookies and CSRF handled for you, wrapped in TanStack Query. See the typed API client.
• Forms. React Hook Form and Zod, wired to the client and its server-side validation errors. See building a form.
• Internationalisation. Namespaced translations and a language switcher. See adding a language.

Production concerns

• Rate limiting. Named policies you apply per endpoint. See rate limiting.
• API versioning. Add a v2 without breaking existing clients. See adding an API version.
• Observability. Traces, metrics and logs over OpenTelemetry into Grafana. See observability.
• Configuration by environment variable. Placeholders in appsettings.json, secrets injected from the environment. See configuration.
• Deployment and reverse proxy. Standard images, OTLP exporters, forwarded-header support. See deployment and reverse proxy.
• CI. GitHub Actions builds, tests and lints both sides on every push.

Working in it

• Testing. A fast unit and architecture suite, plus Testcontainers integration tests. See testing a feature.
• Removing what you do not need. A clean recipe for deleting a slice across both sides. See removing a feature.
• AI-assisted development. AGENTS.md routers and per-side conventions so coding agents have the context they need. See AI-assisted development.

Ready to run it? Start with getting started.