What's included
| Module | What it does |
|---|---|
| OAuth 2.1 + PKCE | Full authorization code flow. PKCE enforced. Refresh token rotation. Reuse detection via Redis. |
| API key management | Generate, rotate and revoke from the dashboard. mcpb_ prefix, SHA-256 hash storage, 7-day grace period on rotation. |
| Stripe usage billing | Report usage via POST /api/usage. Retries, partial failures and streaming handled explicitly. |
| Rate limiting | Sliding window via an Upstash Redis Lua script. Per-plan limits. X-RateLimit-* headers on every response. |
| Quota management | Atomic check-and-decrement in Redis. Fail-closed on quota, fail-open on the rate limiter, deliberately different. |
| Multi-tenant | Each user gets their own API keys, OAuth clients, quota and usage history. |
| Dashboard UI | Overview, API keys, usage, billing, settings. Next.js Server Components and Tailwind. |
Test coverage#
29 test files, 309 passing tests, running in about 2.3 seconds. Over 95% coverage in /lib, around 87% in /app/api. The tests cover the OAuth flow, the API key lifecycle, webhook idempotency, quota and rate limiting.
What it deliberately is not#
Billing is kept independent from your MCP server logic. It is infrastructure, not product code, so you can change your server without touching billing. Your server calls the auth and billing endpoints over HTTP, which is why the boilerplate is framework agnostic.
Next: Quickstart or the stack.