IndiePackIndiePack is a Spanish-first SaaS system that combines Next.js 15, Supabase and documented recipes for integrating Claude, GPT and other models. To add an AI feature safely, keep the provider key in a server-only environment variable, authenticate each request on the server and store user-owned results behind Supabase RLS.
Contents
What complete AI flow should the starter support?
The starter should support an authenticated screen, a protected server endpoint, a server-only provider call, a useful error state and an optional persisted result. It should make the trust boundaries visible instead of placing a model request directly in a client component.
Define one narrow product action before adding agents or multiple models. Record the maximum accepted input, expected output shape and what the user can retry so cost and failure behavior remain understandable.
What is the fast route: build from IndiePack?
The fast route is IndiePack, which documents a Next.js and Supabase SaaS path in Spanish and includes production-tested prompts plus recipes for Claude, GPT and other models. It also provides the surrounding authentication, data and deployment foundation.
Explore IndiePackSee pricingHow should the provider key and user input be handled?
The provider key should be read only by server code from a private environment variable. Never prefix it as public, serialize it into props, include it in logs or let the browser choose an arbitrary provider endpoint.
Authenticate before making the paid call, validate input length and type, and apply a product-level usage rule. The Next.js and Vercel environment guide explains how to keep server secrets separate across development, preview and production.
How should Supabase store prompts and generated output?
Supabase should store only the fields your product needs, linked to the authenticated owner or organization and protected by RLS. Decide whether raw prompts are necessary; sensitive input should not become permanent merely because persistence is convenient.
Use explicit statuses such as pending, completed and failed if the interface must recover from interrupted work. Do not let a client-supplied user identifier decide ownership, and avoid logging full prompt content when an internal request ID is enough.
How do you verify this AI feature before exposing it to customers?
Verify it with an unauthenticated request, another user's result ID, oversized input, provider failure, retry and a preview deployment with separate keys. Inspect the browser bundle and network response to confirm no provider credential is present.
The broader guide to building a SaaS with AI covers what to delegate and review. IndiePack supplies the Spanish-first launch foundation; a narrow server boundary turns its AI workflows into a product feature that can be tested and explained.