Product services

Recommended

• Use Stripe for payments

  Recommended Paid

  Take card payments and subscriptions through Stripe's hosted checkout and official SDK, and pin the SDK's major version.

• Use Amazon SES to send transactional email

  Recommended Paid

  Send transactional email through Amazon SES with DKIM on your own domain, and route every bounce and complaint back to your app.

• Use SimpleWebAuthn or py_webauthn for passkeys

  Recommended Open source

  Build passkey sign-in on SimpleWebAuthn in JavaScript or py_webauthn in Python, and never parse WebAuthn responses yourself.

• Use Keycloak when you need a sign-in server

  Recommended Open source

  When two or more apps share sign-in, or you need single sign-on or SAML, run Keycloak and connect apps through standard OpenID Connect.

• Use the Web Push standard for browser push

  Recommended Open source

  Send push messages to browsers through the Web Push standard with VAPID keys, using an open source library on the server.

• Use Firebase Cloud Messaging for Android and Apple app push

  Recommended Free service

  Send push messages to installed Android and Apple apps through Firebase Cloud Messaging with the Firebase Admin SDK.

• Use Twilio to send text messages

  Recommended Paid

  Send text messages through a Twilio Messaging Service with the official SDK, and keep phone numbers in E.164 form.

• Use Better Auth or django-allauth for sign-in inside the app

  Recommended Open source

  When one app runs its own sign-in, use Better Auth in TypeScript or django-allauth in Django, with users in your own database.

• Use MJML to build email layouts

  Recommended Open source

  Write each email layout in MJML, compile it to HTML in the build with strict validation, and fill in the values with your template engine.

• Use Playwright or WeasyPrint to turn HTML into PDF

  Recommended Open source

  Build invoices, receipts and reports as HTML and print them to tagged PDF with Playwright in Node.js or WeasyPrint in Python.

Optional

• Use Plausible for analytics without cookies

  Optional Open source

  Count visits and events with a self-hosted Plausible Community Edition, which sets no cookies and stores no raw IP addresses.

Avoid

• Avoid handling card numbers yourself

  Avoid

  Never let a card number, expiry date or security code reach your own servers, logs or database.

• Avoid writing your own password and token code

  Avoid

  Never write your own password hashing, session tokens, WebAuthn parsing or OpenID Connect handling.