Auth you can ship as-is
Email + password with mandatory verification, magic-link sign-in, TOTP 2FA with single-use backup codes, password reset, login throttling and 30-day remember-me.
- 2FA + backup codes
- magic links
- throttling
Early bird
First 50 seats at €149 instead of €199, lifetime updates
50 seats at €149 instead of €199
Symfony SaaS starter kit:
Symfony SaaS starter kit:
auth, billing, teams, e-invoicing
ShipAnvil is a Symfony starter kit: auth with 2FA, Stripe and Lemon Squeezy billing, teams, an admin with MRR metrics and a Claude AI module, already wired, tested and documented. You start at the interesting part: your product.
One-time payment · Full source code · Lemon Squeezy handles your VAT
- 481 tests · 2,109 assertions
- PHPStan level max
- Symfony 7.4
- PHP 8.4 / 8.5
- PostgreSQL 16+
- Tailwind v4, no Node
- Factur-X / EN 16931
make init
$ git clone git@github.com:you/your-saas.git
$ make init
→ PHP 8.5, Composer 2, PostgreSQL 18 ok
→ composer install ok
→ database + migrations + fixtures ok
→ tailwind build ok
→ phpunit: 481 tests, 2109 asserts ok
✔ ShipAnvil is ready. Start it with: make serve
$ ▋
src/Billing/Provider/PaymentProviderInterface.php
shipped file
/**
* One payment provider = one implementation.
* Stripe, Lemon Squeezy and an offline sandbox ship
* with the kit; Paddle is just another adapter.
*/
#[AutoconfigureTag('billing.payment_provider')]
interface PaymentProviderInterface
{
public function createCheckoutUrl(
Organization $organization,
Plan $plan,
User $user,
): string;
// Verified, replay-protected, idempotent.
public function parseWebhook(Request $r): WebhookEvent;
}What's inside
Everything between composer install and your first paying customer
Not a demo with happy paths: the parts that are tedious to get right, and the tests that check them.
Billing on two rails
Stripe and Lemon Squeezy behind one PaymentProvider interface: hosted checkout, customer portal, plan upgrades, dunning emails, and an offline sandbox so you build before creating any account.
Webhooks, replayed and deduplicated
Signed, replay-protected, stored in an idempotent inbox and processed async via Messenger with retries. Out-of-order and duplicate deliveries are test cases, not incidents.
Teams & multi-tenancy
Organizations with owner/admin/member roles, email invitations and an organization switcher. A Doctrine filter scopes every query to the current organization automatically, with tests proving tenant isolation.
- Doctrine filter
- isolation tests
Admin with real metrics
A hand-rolled back office on the kit’s own stack (no admin bundle to fight): estimated MRR, churn and signups over 30 days, read-only billing mirrors, and secure user impersonation with an audit log.
Claude AI, wired in
Streaming chat (SSE) and structured extraction via tool use, metered per organization with per-plan token quotas. An offline fake provider keeps dev and CI key-free.
Factur-X ready
A framework-free EN 16931 engine: Factur-X (CII) with PDF/A-3 embedding, PEPPOL BIS (UBL) and business-rule validators, with output checked in CI by the official KoSIT and OpenPEPPOL validators. Numbering, archiving and transmission (Peppol access points, French PDPs) stay yours: the docs draw the line.
- EN 16931
- KoSIT + OpenPEPPOL in CI
Transactional emails
Six branded templates with inlined CSS, a one-file theme, async sending so a slow SMTP never breaks signup, a dev preview catalog, and an SPF/DKIM/DMARC deliverability guide.
Deploy two ways
A multi-stage FrankenPHP Docker image and a step-by-step VPS recipe (PHP-FPM, Apache or nginx, certbot, systemd worker), plus an optional GitHub Actions deploy workflow.
The test suite ships with the kit
481 tests (2,109 assertions) including full billing lifecycles replayed from signed webhook fixtures, PHPStan at level max with zero errors, CS-Fixer and a ready-made CI pipeline.
- 481 tests
- PHPStan level max
- CI pipeline included
Security by default
Nonce-based CSP and security headers on every page, CSRF on every state change, per-IP rate limits on email-sending endpoints, signature-verified webhooks, hardened sessions, threat model documented.
Marketing site included
A sectioned landing page, file-based markdown blog, SEO/OG meta, sitemap and legal page skeletons: the very site you are reading runs on it.
Plus: custom error pages, Sentry pre-wired, fixtures, Makefile, agent-ready docs, and the LAST stack (AssetMapper, Stimulus, Turbo): no Node.js, no build step to babysit.
Quickstart
30 minutes from purchase to running app
The install path is rehearsed from a fresh clone: the test suite even runs as part of it.
-
01 2 min
Buy & claim
Pay with Lemon Squeezy, enter your GitHub username on the claim page, accept the invitation to the private repo.
-
02 10 min
make init
One command checks your PHP, installs dependencies, creates the database, builds the CSS and runs the full test suite.
-
03 15 min
Make it yours
Rename the product, edit the plans in one YAML file, replace the landing copy. The docs walk you through every file that matters.
-
04 same day
Deploy
Follow the VPS recipe or ship the production Docker image. Webhooks, worker, HTTPS and OPcache are all covered, step by step.
No Node.js, no bundler, no lockfile drift
Tailwind runs from a standalone binary · assets served by AssetMapper · Turbo and Stimulus already wired
Live demo
Don't trust screenshots, sign in
This very site runs on ShipAnvil. Poke around the dashboard, the billing flow (offline sandbox), the AI chat and the team pages with the shared demo account.
Open the live demo
shipanvil.com/login
email
demo@shipanvil.com
password
anvil-demo
Shared account: it resets every night. Be nice in the AI chat.
Comparison
How it compares, honestly
Parthenon, the other Symfony SaaS boilerplate, has had no commit since June 2025. Here is what is actually on the market, rechecked on 26 August 2026.
| ShipAnvil €149 early bird | ShipDead $165 | Fastfony free, OSS | |
|---|---|---|---|
| Auth + 2FA (TOTP, backup codes) | auth, no 2FA | auth bundles, no 2FA | |
| Stripe + Lemon Squeezy | both | both | — |
| Teams / multi-tenancy | with isolation tests | — | — |
| Admin + MRR/churn metrics | admin, no metrics | — | |
| AI module (Claude, streaming) | — | Claude Code skill | |
| EU e-invoicing (Factur-X / EN 16931) | engine + CI gates | — | — |
| Test suite shipped | 481 tests | not advertised | tooling only |
| VPS deploy recipe | step by step | not visible | — |
| Live demo | this site | — | — |
| Public docs | 404 at review time | minimal | |
| Written license | one page | not published | MIT |
Compiled 2026-06-10, every row rechecked against each project's public site on 2026-08-26. Fastfony is open-source auth/tooling bundles, not a full SaaS kit: it is great if that is all you need. Spotted an error? Tell us and we will fix it.
Pricing
One-time payment. No subscription.
Pay once, build unlimited products. Lemon Squeezy is the merchant of record: VAT is handled and you get a proper invoice.
49 of 50 seats left
Early bird
For the first 50 builders. Thanks for trusting us early.
€149
€199
one-time · VAT handled at checkout
- Full source code, private GitHub repo
- 1 developer, unlimited projects
- Lifetime updates (early-bird exclusive)
- All docs & guides, email support
Solo
The regular license, once the early-bird seats are gone.
€199
one-time
- Full source code, private GitHub repo
- 1 developer, unlimited projects
- 12 months of updates, the code is yours forever
- All docs & guides, email support
Opens after the early bird
Team
For companies building together.
€349
one-time
- Everything in Solo
- Up to 10 developers of one organization
- 12 months of updates
- Priority email support
FAQ
Frequently asked questions
Something else? Write to support@shipanvil.com. You reach the developer who wrote the code.
What exactly do I get?
An invitation to the private GitHub repository with the full source code, every doc and guide (quickstart, billing setup, deploy, email deliverability), the CI pipeline, and updates per your tier. No obfuscation, no phone-home, no runtime license checks.
What does the license allow?
Build and sell unlimited end products: SaaS, client work, internal tools. The only thing you cannot do is redistribute or resell ShipAnvil itself (or a competing boilerplate derived from it). The license is one readable page in the repo.
How do updates work?
Early-bird buyers get lifetime updates. Solo and Team get 12 months; after that the code keeps working and stays yours forever: you just stop pulling new releases. Updates arrive as commits in the repo: pull or cherry-pick what you want.
What about support?
Email support and GitHub issues on the private repo. It is a small operation: you talk to the developer who wrote the code, usually within one business day.
What is the refund policy?
All sales are final once you claim your repository access. Source code cannot be returned: the moment the invitation is accepted, you have the whole kit, every past release and every future one. That is why everything you need to decide is available before you pay, and none of it is behind the purchase: the full feature list, the license in plain words, the docs, and a live demo you can sign into and use as a real user. Try it first, and email us any question you have before buying. If your payment never resulted in access being granted, write to us and we will make it right.
What are the requirements?
PHP 8.4 or 8.5, PostgreSQL 16+, Composer. No Node.js: the frontend is Symfony's AssetMapper with Tailwind v4 (standalone binary). Docker is optional, never required.
Do I need Stripe AND Lemon Squeezy accounts?
No. Pick either (one env var), or start with the built-in offline sandbox provider and decide later. The webhook pipeline, plans and gating are identical across providers.
Is the AI module mandatory?
No. It is enabled per env var; turned off, the pages and nav links disappear. With it on, you bring your own Anthropic API key. A fake offline provider covers dev and CI.
Does it really handle EU e-invoicing?
The kit ships a framework-free EN 16931 engine producing Factur-X (CII), PDF/A-3 hybrids and PEPPOL BIS (UBL) documents, with business-rule validators, and CI validates its output against the official KoSIT and OpenPEPPOL rule sets. Invoice numbering, archiving and transmission (Peppol access points, French PDPs) remain product decisions; the docs are explicit about that boundary.
I am buying from a company: what about VAT?
Lemon Squeezy is the merchant of record: it collects the right tax for your country, supports VAT IDs for B2B reverse charge, and issues the invoice.
How do I know the code is any good?
Over 481 tests (2,109 assertions) run on every commit, including complete billing lifecycles replayed from signed webhook fixtures. PHPStan at level max with zero errors. And this site (store, checkout, demo) runs on the kit itself.
The whole plumbing, in one repository.
The production plumbing of a SaaS (auth, billing, teams, admin, AI), tested and documented.
Get ShipAnvil · €199 €149
49 early-bird seats left
One-time payment · Delivered as a GitHub invitation · Try the live demo before you buy