BoxyHQ SaaS Starter Kit Review 2026 (vs thefrontkit)
BoxyHQ SaaS Starter Kit Review (2026)
Short answer: the BoxyHQ SaaS Starter Kit is a free, Apache 2.0, full-stack Next.js boilerplate whose real strength is enterprise identity: SAML SSO, SCIM directory sync, audit logs and webhooks. It's still on GitHub with about 4,900 stars, but it hasn't shipped a release since v1.6.0 in December 2024. Since then the main branch has mostly received Dependabot updates. It runs on Next.js 15, React 18 and NextAuth v4, and billing is still listed as "coming soon".
That makes it a good reference for how to wire up SSO, and a riskier foundation for a new product in 2026. Below is what's in the repo today, where it still makes sense, and how it compares with thefrontkit's SaaS Starter Kit. (For the wider field, see Best SaaS Starter Kits 2026.)
BoxyHQ SaaS Starter Kit at a Glance
Checked against the GitHub repo and package.json in September 2026:
| BoxyHQ SaaS Starter Kit | |
|---|---|
| GitHub | boxyhq/saas-starter-kit, about 4,900 stars and 1,200 forks |
| License | Apache 2.0 (free, open source) |
| Latest release | v1.6.0, December 24, 2024 |
| Recent activity | Dependabot dependency bumps (latest on main: May 2026). No feature releases since v1.6.0 |
| Framework | Next.js 15.5, React 18.3 |
| Auth | NextAuth.js v4: email/password, magic links, Google and GitHub sign-in |
| Enterprise identity | SAML SSO and SCIM directory sync via SAML Jackson (@boxyhq/saml-jackson) |
| Database | PostgreSQL via Prisma 6 |
| UI | Tailwind CSS with daisyUI 4 |
| Audit logs | Retraced |
| Webhooks | Svix |
| Payments | Stripe setup documented; "Billing & subscriptions" still listed under Coming Soon |
| Other | Teams and invites, roles and permissions, i18n, dark mode, Playwright tests, Docker |
What happened to BoxyHQ?
Ory acquired BoxyHQ in May 2025. BoxyHQ's SAML Jackson service now lives on as Ory Polis (the old boxyhq/jackson repo redirects to ory/polis, which is actively maintained). The starter kit didn't get the same treatment. Its README still points to SAML Jackson and doesn't mention Ory, and there's no public roadmap for it. If you adopt it, plan to own upgrades (React 19, Auth.js v5, newer Next.js) yourself.
How to try it
Clone the repo, copy .env.example to .env, start PostgreSQL (the repo includes a Docker Compose file), run the Prisma migrations and npm run dev. SAML SSO needs a Jackson or Polis instance. The README walks through each step.
BoxyHQ vs thefrontkit: Feature Comparison
The two kits solve different problems. BoxyHQ is backend identity plumbing with a basic UI. thefrontkit's SaaS Starter Kit is a frontend UI layer (components, auth screens, app shell, settings, AI chat patterns) with no backend at all, so you bring your own auth provider, database and billing.
| Feature | thefrontkit | BoxyHQ |
|---|---|---|
| Stack | Next.js 16, React 19, Tailwind CSS v4, TypeScript | Next.js 15, React 18, Tailwind + daisyUI, Prisma, TypeScript |
| Auth | UI screens for login, signup, forgot/reset password and OTP. Bring your own auth provider | Working auth via NextAuth v4: email/password, magic links, Google and GitHub, SAML SSO |
| SAML SSO / SCIM | Not included (pair with any SSO provider) | Built in. This is BoxyHQ's core strength |
| App shell | Sidebar, topbar, responsive layout, settings navigation, dark mode | Basic layout |
| Settings screens | Account, notifications, AI integrations, team and permissions, billing, privacy and security | Team settings, SSO and directory sync configuration |
| AI patterns | Chat recipes: citations, compare, error handling, prompt submission, refinement, sessions, voice | Not included |
| Design tokens | Tailwind v4 @theme tokens driven by CSS custom properties |
daisyUI themes |
| Accessibility | Built for WCAG AA: semantic HTML, ARIA, keyboard navigation, focus management, contrast | No documented WCAG testing |
| Audit logs / webhooks | Not included | Retraced and Svix |
| Billing | Billing settings UI only (no payment backend) | Stripe setup; subscriptions "coming soon" |
| Database | None (frontend only) | PostgreSQL via Prisma |
| License | Commercial | Apache 2.0 |
| Price | From $79 | Free |
Where BoxyHQ Still Fits
Pick BoxyHQ, or at least read its code, if enterprise identity is your launch blocker:
- SAML SSO. Jackson (now Ory Polis) is a mature SSO service used in production. If your first enterprise customer requires SSO, this repo shows a working integration end to end.
- SCIM directory sync handles user provisioning and deprovisioning from Okta, Entra ID (Azure AD) and similar providers.
- Audit logs via Retraced give you "who did what, when" tracking, which security questionnaires ask about.
- Webhooks via Svix cover team and user lifecycle events.
- Apache 2.0 means no license cost and full control.
The tradeoff is maintenance. You're starting on an older stack (React 18, NextAuth v4) with no active feature development, so budget time for upgrades before you build on top of it.
Where thefrontkit Fits
A complete UI layer
BoxyHQ's daisyUI interface gives you buttons, cards and modals, but not the patterns most SaaS apps need: a responsive app shell, multi-step forms with validation, settings hierarchies, notifications and empty states. thefrontkit ships those as ready components:
import { MainSidebar } from "@/components/ui/composites/main-sidebar"
<MainSidebar
activeMainNav={activeNav}
activeSection={activeSection}
onMainNavChange={setActiveNav}
onSectionChange={setActiveSection}
user={{ name: "Jane Doe", email: "jane@example.com" }}
onUpgrade={() => router.push("/pricing")}
/>
Tokens you can rebrand in one place
The kit uses Tailwind v4's @theme with CSS custom properties, so a rebrand means changing token values, not hunting through components:
/* app/globals.css */
@theme inline {
--color-primary: var(--primary);
--color-primary-50: var(--primary-50);
--color-primary-600: var(--primary-600);
}
Accessibility from the start
If you sell to enterprises, you'll be asked for a VPAT sooner or later, and accessibility is increasingly a procurement requirement. thefrontkit components use semantic HTML, proper ARIA, visible focus, keyboard navigation, AA contrast in light and dark mode, and focus moves to the first error on form submit. BoxyHQ has no accessibility testing set up in the repo.
AI chat patterns included
The kit includes chat recipes for citations, model comparison, error handling, prompt submission, refinement, session history and voice. For a deeper AI interface layer, the AI UX Kit uses the same tokens and components.
Pricing
- BoxyHQ SaaS Starter Kit: free under Apache 2.0. Commercial SSO support is available from Ory for Polis, not for the starter kit itself.
- thefrontkit SaaS Starter Kit: from $79, one-time, commercial license. See pricing.
The bigger cost is engineering time. A free kit that needs weeks of UI work and a stack upgrade can cost more than a paid one. See SaaS starter kit vs building from scratch for the math.
Verdict
- Choose BoxyHQ if SAML SSO, SCIM and audit logs are your launch requirements, you're fine with NextAuth v4 and React 18 for now, and you'll build your own UI.
- Choose thefrontkit if you need an accessible, token-driven frontend for a SaaS product and already have (or will pick) your own auth, database and billing.
- Combine them if you need both: thefrontkit for the frontend, and Ory Polis (or another SSO provider such as WorkOS or Auth0) on the backend when enterprise customers ask for SSO.
Frequently Asked Questions
Is the BoxyHQ SaaS Starter Kit free?
Yes. It's open source under the Apache 2.0 license, so you can use it commercially at no cost. You'll pay for your own hosting, PostgreSQL database and any SSO infrastructure you run.
Is the BoxyHQ SaaS Starter Kit still maintained?
Only lightly. The repo isn't archived and it still gets Dependabot dependency updates, but the last release was v1.6.0 in December 2024. Ory acquired BoxyHQ in May 2025 and now focuses on Ory Polis (formerly SAML Jackson), not the starter kit.
Where is the BoxyHQ SaaS Starter Kit on GitHub?
At github.com/boxyhq/saas-starter-kit. The Prisma schema is in the prisma folder, and the README covers local setup with Docker.
Does the BoxyHQ starter kit include Stripe billing?
Partly. The README documents Stripe environment variables and a Stripe webhook route, but "Billing & subscriptions" is still listed under Coming Soon.
What does BoxyHQ use for SAML SSO?
SAML Jackson, BoxyHQ's open-source SSO service. After Ory's acquisition, Jackson was renamed Ory Polis. The starter kit still installs it under the old @boxyhq/saml-jackson package name.
Which is better, BoxyHQ or thefrontkit?
They cover different layers. BoxyHQ gives you working backend identity features (SSO, SCIM, audit logs). thefrontkit gives you the frontend UI and design system with no backend. If you need enterprise SSO on day one, start from BoxyHQ or an SSO provider. If the UI is your bottleneck, start from thefrontkit.
Ready to skip the frontend boilerplate? Explore the SaaS Starter Kit.
