From fork to first paying customer in a weekend
July 14, 2026 · The GoToMarketFit Team · 6 min read
The promise of a boilerplate is speed, but most of them hand you a pile of code and leave you to figure out the order of operations. Here's the path we'd actually take, top to bottom, to go from a fresh fork to a live checkout.
The parts that are already done
You don't build any of this — it ships wired together:
| Concern | What's included |
|---|---|
| Auth & sessions | Supabase auth with cookie-based SSR sessions |
| Multi-tenancy | Row-level security and per-tenant roles |
| Billing | Lemon Squeezy checkout + webhook fulfillment |
| Delivery | GitHub invite, Discord role, and email on payment |
| Transactional mail | Resend, with the sending domain left to you |
Everything below is configuration, not code you have to write.
Saturday morning: make it yours
- Fork the repo and install dependencies.
- Fill in
src/lib/site.ts— your product name, contact address, and legal entity. The landing and legal pages read from it, so one edit updates the whole site. - Point the environment variables at your own Supabase project and Lemon Squeezy
store. Never commit
.env.local; it stays local and is set in your host's dashboard for production.
Saturday afternoon: the money path
The checkout is webhook-driven, which is the part people get wrong. The flow is:
// A payment isn't "done" when the browser redirects back —
// it's done when the webhook says so, verified and idempotent.
export async function fulfillOrder(event: WebhookEvent) {
if (await alreadyFulfilled(event.orderId)) return; // safe to retry
await grantAccess(event.customer);
await markFulfilled(event.orderId);
}
Two rules make this reliable:
- Verify the signature. Treat any unsigned or badly signed webhook as hostile and drop it.
- Make fulfillment idempotent. Payment providers retry. If the same order can be processed twice, you'll eventually double-grant access or double-send an invite.
The redirect back to your
/thank-youpage is a hint that payment succeeded, not proof. The webhook is the source of truth. Design for the webhook arriving late, out of order, or twice.
Sunday: make it real before you share it
- Replace the placeholder legal copy and have it reviewed for your jurisdiction.
- Send yourself a live test purchase and confirm the invite, role, and email all land.
- Check the
backfillpath so a payment that slipped through can be re-fulfilled without manual database surgery.
That's the whole arc: a weekend, mostly spent in config files and a payment dashboard, ending with something a stranger can actually buy.
Want the deep dive on any one step? Tell us which — we'll turn it into its own post.
← Back to all posts