Full boilerplates shine when the repo is empty. Focused modules shine when the app already exists and only one subsystem is the bottleneck. Buying the wrong shape wastes integration time that looks identical to “building it yourself,” just with more merge conflicts.
What a serious auth module must include
- Password hashing with a modern algorithm and per-user salt.
- Session cookies or rotating refresh tokens with revoke-all.
- Email verification and password reset via one-time hashed tokens.
- Guards for pages and APIs that default to deny.
- Optional but valuable: lockouts, login attempt logs, 2FA.
A login form without reset, revoke, or hashing discipline is a UI snippet. Price it like a snippet.
What a serious billing module must include
- Checkout (or subscription) session creation with stable metadata.
- Webhook signature verification using the provider secret.
- Idempotent handling so retries do not double-grant access.
- A purchases or entitlements table your product code can trust.
- A documented local test path (CLI forwarding or equivalent).
Ask one question of any billing kit: “If Stripe retries the same event twice, what happens?” If the answer is vague, keep shopping.
Choose auth first when
- People can already pay somehow (invoice, manual) but accounts are fragile.
- You cannot ship roles or multi-user safely.
- Security review of login is blocking a launch date.
Choose billing first when
- Signup works and you are losing sales at Checkout.
- You need automatic access after payment more than a prettier login.
- Support tickets are “I paid but see nothing.”
Choose a full boilerplate when
- There is no existing app shell worth keeping.
- Auth and billing must land in the same short window.
- You want one coherent stack instead of three partial kits.
Integration cost is the real price
- Map the kit's user id to your users table before merging.
- Keep webhook handlers thin: verify, persist, return success.
- Add one automated or scripted path: pay in test mode → entitlement exists.
- Delete demo routes so they never ship under your domain.
Browse Auth Systems or Billing Systems on Twenty when you need a slice, or full boilerplates when you need the combined path. Pair either choice with the selection checklist.