SaaS Platform Control Plane

Situation

Every SaaS product eventually needs the same foundational infrastructure: tenant isolation, credential lifecycle management, and OAuth 2.0 auth flows. Most teams build it from scratch under time pressure and get it subtly wrong, in ways that only surface under audit or at scale. After three years running Retailloop's platform across 1,500+ merchants, the right patterns became clear enough to extract.

Task

Distil the multi-tenancy and auth patterns from production into a reusable, open-source control plane baseline. The starting point I would reach for at the beginning of any new SaaS project instead of rebuilding the same decisions under time pressure.

Action

• Multi-tenant org and project management with proper isolation boundaries between tenants.
• Scoped API keys with rotation, tracked issuance, and revocation across the full credential lifecycle.
• OAuth 2.0 Authorization Code flow for user-facing access and Client Credentials flow for machine-to-machine, with RS256 JWTs throughout.
• Cursor-based pagination to handle large datasets without offset drift at scale.
• Direct SQL migrations over ORM abstractions so schema changes stay explicit and reviewable.
• NestJS on a Fastify adapter combining NestJS's module structure with Fastify's performance.

Result

• A standalone, open-source control plane encapsulating patterns validated at production scale.
• Available at github.com/Lanrey/saas-platform-control-plane for any team to fork and extend.