I built AI SaaS products with Nuxt for 6 months and extracted my setup into a boilerplate
I've been building AI SaaS products with Nuxt for about 6 months now. Started with Docuyond (an AI agent for customer support), and I kept needing the same things: auth, UI components, Stripe, database, rate limiting. When I started my second project I was literally copy-pasting files between repos. That's when I figured I should just extract it properly.
I looked at what Nuxt boilerplates existed and most of them were a login page, a Stripe checkout, maybe a dashboard layout, and that's it. You pay $200+ and still build 80% of the product yourself. I wanted something with actual AI infrastructure built in, not a TODO comment where the AI should go.
So here's what's in it:
RAG-powered chat with Cloudflare AutoRAG and Vercel AI SDK v6 (streaming, tool calling, whole setup)
Embeddable chat widget you can drop into any site
Image and video generation with DALL-E 3 and Sora
nuxt-auth-utils for auth (Google OAuth + email/password but can be easily expanded)
Multi-tenant projects with team members and resource scoping
Stripe subscriptions with webhooks and customer portal
Full Cloudflare edge stack: D1, R2, KV, Workers via NuxtHub (but can be used with Vercel or other cloud providers as well)
Nuxt UI v4, Drizzle ORM, Tailwind v4
Blog with Nuxt Content, emails with Resend
The RAG setup and embeddable widget are what I spent the most time on. Getting AutoRAG to work with streaming responses and making the widget secure with CORS and domain whitelisting was painful but it works well now. I use it in my own product.
One honest pain point: the NuxtHub setup. Since Nuxt got acquired by Vercel, it kept getting updates and breaking. I had to chase changes constantly. But it's stable now and deploying is simple once you configure everything in Cloudflare (or other cloud providers)
I also added a CLAUDE.md file so Claude Code, Codex etc actually understand the project when you use them. If you're building with AI coding tools this saves a lot of back and forth. (let's be honest, we all do now)
Currently $59 one-time, lifetime updates. Price increases each 5 sales. I got my first sale from a Reddit post on r/Nuxt this week. I use this for my own products so it won't go stale.
nuxtbeyond.com if you want to check it out.
If you're building with Nuxt + Cloudflare, happy to share what I learned about the edge stack. What's your current setup?
Congrats on the launch, looks solid. How are you currently thinking about acquiring early users and gathering feedback?
Currently posting on X and Reddit and see how it goes. Will probably expand in the future
Great job! This is a solid stack. Building real AI infra instead of a fake boilerplate is the right move. The RAG + embeddable widget combo is especially interesting.
Quick security question. With multi-tenant projects, team members, and resource scoping on top of D1, R2, and KV at the edge, how are you enforcing tenant isolation at the data layer? Edge KV and object storage can get tricky if keys or object paths are predictable.
Also, for the embeddable chat widget, beyond CORS and domain whitelisting, are you validating server-side project ownership on every request? Client-side origin checks alone are often bypassed.
The embeddable chat widget validates project ownership and origin/referer server side on each request.
And multi-tenant projects don't yet use any isolation using Cloudflare services, I didn't have a need for that yet.
Good move validating project ownership server-side on every widget request. That matters more than CORS.
On the Cloudflare side, it’s good you called out the gap. KV and object storage isolation gets risky fast once you have teams, invites, and shared resources. Predictable keys and object paths turn into cross-tenant reads.
If you want a low-friction next step before you “need it”:
Use tenant scoped prefixes everywhere, enforced in one server-side gate.
Add server-side auth checks per read and write, not only at the widget layer.
Make object keys non-guessable. Use random IDs, not human slugs.
Treat KV as cache, not source of truth, unless you can enforce access rules at fetch time.
Add audit logs for cross-tenant access attempts.
We’re a security team building Nautillo Pro for founders and small teams who want to protect users before scale adds complexity. You’re welcome to try our web attack simulator. There’s a free version for solo founders, so you can run a monthly check or test each release and see if any boundary issues slip through.