~/simple-stack $ ./launch

Sell your API, metered by credits.

bash — 80×12

# Bearer-token keys, rate limits, and a per-call credit cost, managed from a left-sidebar member app — billing, auth and a dedicated admin app already wired, on plain PHP and SQLite.
$ composer install && php scripts/install.php
✓ database created · migrations applied
$ php -S 127.0.0.1:8000 -t public router.php
✓ live — start charging

[ open the dashboard ] [ view pricing ]

Bearer tokens ss_ + 48-hex keys Peppered hashes Shown once 300 req / 60s 429 + Retry-After Per-call credits Versioned /v1 REST API Self-serve keys in member app Admin-app revoke 401 on bad key Per-key limits Credit ledger Bearer tokens ss_ + 48-hex keys Peppered hashes Shown once 300 req / 60s 429 + Retry-After Per-call credits Versioned /v1 REST API Self-serve keys in member app Admin-app revoke 401 on bad key Per-key limits Credit ledger

Developer API

One bearer token. A clean 200.

Bearer-key auth, per-call credits and rate limits that just work. Watch a request go out and a response come back — no SDK required.

Scoped keys, instant revoke
Per-call credit metering
Rate-limit headers on every response

api.yoursaas.dev — request

$ curl -X POST /v1/notes -H "Authorization: Bearer ss_live_···" -d '{"title":"Ship it"}'

→ resolving host · TLS handshake · sending

HTTP/1.1 201 Created24 ms

x-ratelimit-remaining: 299

content-type: application/json

{ "data": { "id": 42, "title": "Ship it" } }

SHIP THE API, NOT THE PLUMBING

Bearer keys, metered and rate-limited on day one.

Users mint API keys, hit your endpoints with a token, and you meter every call. A working notes JSON API ships as the example you clone into your own routes.

Peppered key hashes, shown once

Keys are ss_ plus 48 hex chars. Only an HMAC-SHA256 hash and a 12-char prefix touch the database; the raw token is shown once at creation and never again. A leaked DB hands an attacker nothing usable.

Bearer auth on every route

Send Authorization: Bearer ss_... or an X-API-Key header. require_api_user() resolves the key to its owner and plan; a bad token gets a clean 401. The same handler serves browser sessions and API keys, so you write each endpoint once.

Per-key rate limits, 429 + Retry-After

A fixed-window limiter in SQLite caps each key at 300 requests per 60s out of the box (one env var to change). Over the line returns 429 with a Retry-After header and a retry_after field in the body.

Credits priced per call

Plans grant credits per billing period (25 free, up to 2,000 on Scale) and each action spends from the same ledger. Set a different cost per endpoint in app/subscriptions.php.

Self-serve key management

Users create, name, list and revoke their own keys from the member sidebar app, up to ten active each. last_used_at is stamped on every call, and a superadmin can revoke any key from the separate admin app at /admin.

A real /v1 REST API to clone

A versioned REST API mounted at /v1: GET /v1/me and GET /v1/usage return the key's account, plan and live credit balance, and GET/POST/PATCH/DELETE /v1/notes is a complete, scoped-per-user CRUD resource. Data comes back as { "data": ... } with real status codes (200/201/204/401/404/422/429) and paginated lists. Delete the notes logic, keep the shape, and drop in your own resource.

One request, fully metered

A real call: authed, throttled, billed, answered.

Send a Bearer key to a notes endpoint and the same short path runs every time — resolve the key, count the window, charge a credit, return your JSON.

api.yoursite.com/api.php

# POST a note as one of your API users.
# The ss_ key is shown once at creation.
curl -X POST https://api.yoursite.com/api.php \
  -H "Authorization: Bearer ss_a1f3...8e2d" \
  -d action=create_note \
  -d title="Shipped v1" -d status=open
# 200 OK  ·  X-RateLimit: 41/300 in this 60s window
{ "ok": true, "cost": 1, "balance_after": 1974,
  "note": { "id": 5012, "status": "open" } }

Auth, throttle, bill

Wired before you write a line — by the numbers

Every figure here is how the metering actually works, not a sales chart.

300 requests per 60s window per key, out of the box — one env var to change

1 credit charged per metered /v1/notes write, with a different cost settable per endpoint

10 active keys a user can mint, name, and revoke themselves from the sidebar member app — and an admin can revoke from the admin app

0 raw keys stored — only an HMAC-SHA256 hash and a 12-char prefix

Try before you buy — no card, nothing saved

Click through all seven live demos — including a whole client site built in the CMS.

You're in one now. Hop straight to any other site type — same tab, still a demo: no card needed, no payment is real, and nothing you do is saved.

Each site-type demo is one of the seven ready-to-run profiles in the download — copy the folder, add your keys, ship.

AI Image Studio Sell credit-metered AI image generation with a gallery and storage you own images.getsimplestack.com No-code CMS Hand clients a site they edit themselves in a visual page builder cms.getsimplestack.com Mobile App Backend Includes native iOS + Android apps, already wired to a backend with verified sign-in and a JSON API — no Firebase bill app.getsimplestack.com

Subscriptions Launch a recurring-revenue SaaS with Stripe tiers and tier-gated access already wired saas.getsimplestack.com Digital Downloads Take one-time payments for files that stay protected and never leak a public URL downloads.getsimplestack.com Credits & Usage Charge per action with a usage ledger that always balances to the row credits.getsimplestack.com API Product you're here Ship a metered, rate-limited /v1 REST API with self-serve bearer keys api.getsimplestack.com

Keep the infrastructure small. Make the product yours.

This store and its demos use the same PHP and SQLite foundation included in your download.

1 SQLite database

web_build_step	none
source_code	included
hosting	your own server
database_mode	SQLite WAL

Superadmin, not a spreadsheet

A real admin console — have a poke around.

Every install ships with this. Search users, replay webhooks, inspect billing and revoke keys — server-rendered, access-gated, no second app.

app.yoursaas.com/admin superadmin

MRR£4,820▲ 12%

Active subs138▲ 6

Credits today29,400spent

Signups · 7d52▲ 18%

User	Plan	Status	Joined
ada@example.com	Pro	active	2d ago
grace@example.com	Scale	active	5d ago
linus@example.com	Starter	past due	3w ago
margaret@example.com	Pro	active	1mo ago
blocked@example.com	Free	blocked	1mo ago

processedinvoice.paidevt_1Q8x…a3just now

processedcustomer.subscription.updatedevt_1Q8w…f19s ago

processedcheckout.session.completedevt_1Q8w…7c41s ago

retryinginvoice.payment_failedevt_1Q8v…022m ago

refundedcharge.refundedevt_1Q8u…9d6m ago

curl -H "Authorization: Bearer ss_live_••••" \
     https://app.yoursaas.com/api.php?resource=notes

{
  "ok": true,
  "data": [ "note_18f2", "note_18f9" ],
  "rate_limit": "58/60",
  "credits_left": 1840
}

From download to charging cards

Preview locally. Connect services. Launch.

Unzip & copy

copy a template folder

Install & connect

composer install · Stripe + SES

Ask your agent

rebrand · plans · run doctor

Deploy & charge

NGINX + PHP-FPM · take cards

Try the local app before configuring billing or email. Provider approval and deployment take additional time.

Pricing you control

Tiers, access levels and credits from one config file.

Define plans in app/subscriptions.php, attach Stripe price IDs, and the checkout flow stays generic across every project.

Included

Free

£0

Default access for new users and trial accounts.

Access 025 starter credits

Start free

Subscription

Starter

$19/mo

For a small paid SaaS tier.

Access 10100 credits/mo

Choose Starter

Subscription

Pro

$49/mo

For heavier usage and premium features.

Access 20500 credits/mo

Choose Pro

Subscription

Scale

$149/mo

For power users and high-credit products.

Access 302,000 credits/mo

Choose Scale

Questions

The honest FAQ.

How do customers authenticate?

How do I meter and rate-limit usage?

Can I tier API access by plan?

What helps me prepare for production?

What does it cost to run?

Get started

You’re already inside.

This is a live, fully interactive demo — explore every screen. Nothing you do is saved and no payments are real.

Open the dashboard → See the admin & page builder

Sell your API, metered by credits.

Sign in with Apple & Google — built in.

One bearer token. A clean 200.

Bearer keys, metered and rate-limited on day one.

Peppered key hashes, shown once

Bearer auth on every route

Per-key rate limits, 429 + Retry-After

Credits priced per call

Self-serve key management

A real /v1 REST API to clone

A real call: authed, throttled, billed, answered.

Wired before you write a line — by the numbers

Click through all seven live demos — including a whole client site built in the CMS.

A real admin console — have a poke around.

Preview locally. Connect services. Launch.

Unzip & copy

Install & connect

Ask your agent

Deploy & charge

Tiers, access levels and credits from one config file.

Free

Starter

Pro

Scale

The honest FAQ.

You’re already inside.