⬡ Dev Tools/2026-04-01Advanced

Building a B2B SaaS App with Rork: Multi-Tenant Architecture, RBAC, and Stripe Organization Billing

A complete guide to building production-grade B2B SaaS apps with Rork. Learn multi-tenant architecture, role-based access control (RBAC), organization-level Stripe billing, and invitation flows with real code examples.

Rork⁵¹⁵ B2B² SaaS³ Multi-Tenant RBAC Stripe¹⁷ Supabase³³ App Development³³ Advanced⁴

✦ Premium Article

Setup and context — Why B2B SaaS Is the Most Scalable Model for Independent Developers

When you're building and shipping apps as a solo developer or small team, B2B (business-to-business) apps tend to outperform B2C (consumer) apps on revenue sustainability. Organizations contract at the team level, meaning a single contract generates recurring revenue for as long as it remains active. The switching cost of a team tool is high, which translates to lower churn rates and longer customer lifetime values.

But building B2B SaaS introduces design challenges that don't exist in consumer apps:

Multi-tenancy: Safely isolate data across multiple organizations (tenants)
RBAC: Assign roles to team members and restrict access to screens and features
Organization billing: Charge at the organization level via Stripe, with tier-based plans
Invitation flow: Allow existing members to invite new colleagues into the organization

In this guide, you'll learn how to implement all of these with Rork, complete with real Supabase schema design and working code. If you're new to Supabase auth, check out Supabase Auth and Realtime Integration Guide first.

Multi-Tenant Architecture Design

Three Data Isolation Strategies

Multi-tenancy can be implemented in three main ways:

Strategy 1: Database per Tenant Each tenant gets its own database. Maximum security, but high cost and maintenance overhead — typically reserved for enterprise-tier plans.

Strategy 2: Schema per Tenant One database, separate PostgreSQL schemas per tenant. Supports per-tenant Row Level Security policies, but adds complexity to migrations.

Strategy 3: Shared Schema + Row Level Security All tenants share the same tables, separated by an organization_id column. Combined with Supabase's RLS, this is the most cost-effective approach for indie developers and small teams — and the one we'll use here.

Supabase Schema Design

Run the following SQL in your Supabase dashboard's SQL Editor:

-- Organizations table
create table organizations (
  id uuid primary key default gen_random_uuid(),
  name text not null,
  slug text unique not null,
  plan text not null default 'free', -- free / starter / growth / enterprise
  stripe_customer_id text,
  stripe_subscription_id text,
  max_members int not null default 3,
  created_at timestamptz default now()
);
 
-- Organization members (user-to-org mapping + role)
create table organization_members (
  id uuid primary key default gen_random_uuid(),
  organization_id uuid references organizations(id) on delete cascade,
  user_id uuid references auth.users(id) on delete cascade,
  role text not null default 'member', -- owner / admin / member / viewer
  invited_by uuid references auth.users(id),
  accepted_at timestamptz,
  created_at timestamptz default now(),
  unique(organization_id, user_id)
);
 
-- Invitations table
create table invitations (
  id uuid primary key default gen_random_uuid(),
  organization_id uuid references organizations(id) on delete cascade,
  email text not null,
  role text not null default 'member',
  token text unique not null default encode(gen_random_bytes(32), 'hex'),
  invited_by uuid references auth.users(id),
  expires_at timestamptz default now() + interval '7 days',
  accepted_at timestamptz,
  created_at timestamptz default now()
);
 
-- Enable RLS
alter table organizations enable row level security;
alter table organization_members enable row level security;
alter table invitations enable row level security;

Setting Up Row Level Security Policies

-- Users can only view organizations they belong to
create policy "users can view their organizations"
on organizations for select
using (
  id in (
    select organization_id from organization_members
    where user_id = auth.uid()
    and accepted_at is not null
  )
);
 
-- Members can view other members in their org
create policy "members can view own org members"
on organization_members for select
using (
  organization_id in (
    select organization_id from organization_members
    where user_id = auth.uid()
    and accepted_at is not null
  )
);
 
-- Only owner/admin can manage invitations
create policy "admins can manage invitations"
on invitations for all
using (
  organization_id in (
    select organization_id from organization_members
    where user_id = auth.uid()
    and role in ('owner', 'admin')
    and accepted_at is not null
  )
);

✦

Thank you for reading this far.

Continue Reading

What follows includes implementation code, benchmarks, and practical content we hope you'll find useful. This site runs without ads — server and development costs are supported entirely by members like you. If it's been helpful, we'd be truly grateful for your support.

WHAT YOU'LL LEARN

✦Master multi-tenant architecture best practices and implement database-level data isolation using Supabase Row Level Security

✦Build a 4-tier RBAC system (Owner, Admin, Member, Viewer) in Rork and apply permission gates to every screen

✦Implement organization-level Stripe subscriptions, member-count billing tiers, and a customer billing portal from scratch

Secure payment via Stripe · Cancel anytime

✦

Unlock This Article

Get full access to the rest of this article. Buy once, read anytime. This site is ad-free — your support goes directly toward keeping it running.

Unlock all articles with Membership →

RBAC Implementation — A 4-Tier Permission Model

Defining Roles

Here's the 4-tier permission model commonly used in B2B SaaS:

Owner: The organization creator. Full control, including deletion and cancellation
Admin: Can manage billing, invite members, and change settings
Member: Full access to core features; cannot access admin functions
Viewer: Read-only access; cannot create or edit anything

Custom Permission Hook for Rork

Ask Rork to generate the following custom hook:

// hooks/useOrganizationRole.ts
import { useState, useEffect } from 'react';
import { supabase } from '../lib/supabase';
import { useAuth } from './useAuth';
 
type Role = 'owner' | 'admin' | 'member' | 'viewer';
 
interface Permission {
  canManageMembers: boolean;
  canManageBilling: boolean;
  canEditSettings: boolean;
  canCreateContent: boolean;
  canViewContent: boolean;
}
 
const ROLE_PERMISSIONS: Record<Role, Permission> = {
  owner: {
    canManageMembers: true,
    canManageBilling: true,
    canEditSettings: true,
    canCreateContent: true,
    canViewContent: true,
  },
  admin: {
    canManageMembers: true,
    canManageBilling: true,
    canEditSettings: true,
    canCreateContent: true,
    canViewContent: true,
  },
  member: {
    canManageMembers: false,
    canManageBilling: false,
    canEditSettings: false,
    canCreateContent: true,
    canViewContent: true,
  },
  viewer: {
    canManageMembers: false,
    canManageBilling: false,
    canEditSettings: false,
    canCreateContent: false,
    canViewContent: true,
  },
};
 
export function useOrganizationRole(organizationId: string) {
  const { user } = useAuth();
  const [role, setRole] = useState<Role | null>(null);
  const [permissions, setPermissions] = useState<Permission | null>(null);
  const [loading, setLoading] = useState(true);
 
  useEffect(() => {
    if (!user || !organizationId) return;
 
    const fetchRole = async () => {
      const { data, error } = await supabase
        .from('organization_members')
        .select('role')
        .eq('organization_id', organizationId)
        .eq('user_id', user.id)
        .single();
 
      if (data && !error) {
        const userRole = data.role as Role;
        setRole(userRole);
        setPermissions(ROLE_PERMISSIONS[userRole]);
      }
      setLoading(false);
    };
 
    fetchRole();
  }, [user, organizationId]);
 
  return { role, permissions, loading };
}

Applying Permissions to Screen Components

// components/PermissionGuard.tsx
import React from 'react';
import { View, Text, StyleSheet } from 'react-native';
 
interface PermissionGuardProps {
  hasPermission: boolean;
  children: React.ReactNode;
  fallback?: React.ReactNode;
}
 
export function PermissionGuard({ hasPermission, children, fallback }: PermissionGuardProps) {
  if (!hasPermission) {
    return fallback ? (
      <>{fallback}</>
    ) : (
      <View style={styles.container}>
        <Text style={styles.text}>You don't have permission to perform this action.</Text>
      </View>
    );
  }
  return <>{children}</>;
}
 
const styles = StyleSheet.create({
  container: { padding: 16, backgroundColor: '#FFF3CD', borderRadius: 8, margin: 16 },
  text: { color: '#856404', textAlign: 'center' },
});

Usage in a member management screen:

// screens/MembersScreen.tsx
export function MembersScreen({ organizationId }) {
  const { permissions, loading } = useOrganizationRole(organizationId);
 
  if (loading) return <LoadingSpinner />;
 
  return (
    <ScrollView>
      <MemberList organizationId={organizationId} />
 
      {/* Invite button visible to admin+ only */}
      <PermissionGuard hasPermission={permissions?.canManageMembers ?? false}>
        <InviteButton organizationId={organizationId} />
      </PermissionGuard>
 
      {/* Billing visible to admin+ only */}
      <PermissionGuard hasPermission={permissions?.canManageBilling ?? false}>
        <BillingSection organizationId={organizationId} />
      </PermissionGuard>
    </ScrollView>
  );
}

Building the Invitation Flow

Sending Invitation Emails via Supabase Edge Functions

// supabase/functions/send-invitation/index.ts
import { serve } from 'https://deno.land/std@0.168.0/http/server.ts';
import { createClient } from 'https://esm.sh/@supabase/supabase-js@2';
 
serve(async (req) => {
  const { organizationId, email, role } = await req.json();
 
  const supabase = createClient(
    Deno.env.get('SUPABASE_URL')!,
    Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!
  );
 
  // Create invitation record
  const { data: invitation, error } = await supabase
    .from('invitations')
    .insert({ organization_id: organizationId, email, role })
    .select()
    .single();
 
  if (error) return new Response(JSON.stringify({ error: error.message }), { status: 400 });
 
  const { data: org } = await supabase
    .from('organizations')
    .select('name')
    .eq('id', organizationId)
    .single();
 
  // Send via Resend (replace RESEND_API_KEY with your actual key from resend.com)
  await fetch('https://api.resend.com/emails', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${Deno.env.get('RESEND_API_KEY')}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      from: 'noreply@yourapp.com',
      to: email,
      subject: `You've been invited to ${org?.name}`,
      html: `
        <p>You've been invited to join <strong>${org?.name}</strong>.</p>
        <p>Click the link below to accept (valid for 7 days):</p>
        <a href="https://yourapp.com/invite/${invitation.token}">Accept Invitation</a>
      `,
    }),
  });
 
  return new Response(JSON.stringify({ success: true }), { status: 200 });
});

Invitation Acceptance Screen

// screens/AcceptInvitationScreen.tsx
export function AcceptInvitationScreen({ token }) {
  const [status, setStatus] = useState<'loading' | 'success' | 'error' | 'expired'>('loading');
  const { user } = useAuth();
 
  useEffect(() => {
    if (!user) return; // Redirect to login, pass token via deeplink
    acceptInvitation();
  }, [token, user]);
 
  const acceptInvitation = async () => {
    const { data: invitation } = await supabase
      .from('invitations')
      .select('*')
      .eq('token', token)
      .single();
 
    if (!invitation) return setStatus('error');
    if (new Date(invitation.expires_at) < new Date()) return setStatus('expired');
 
    const { error } = await supabase.from('organization_members').insert({
      organization_id: invitation.organization_id,
      user_id: user.id,
      role: invitation.role,
      invited_by: invitation.invited_by,
      accepted_at: new Date().toISOString(),
    });
 
    if (!error) {
      await supabase
        .from('invitations')
        .update({ accepted_at: new Date().toISOString() })
        .eq('id', invitation.id);
      setStatus('success');
    } else {
      setStatus('error');
    }
  };
 
  // ... render based on status
}

Organization-Level Stripe Billing

Tier Design

A clean B2B tier structure to start with:

Free: Up to 3 members, core features only
Starter ($19/month): Up to 10 members, all features
Growth ($65/month): Up to 50 members, priority support
Enterprise (custom): Unlimited members, SLA

Stripe Checkout for Organizations

// api/create-org-checkout/route.ts
import Stripe from 'stripe';
import { NextRequest, NextResponse } from 'next/server';
import { createClient } from '@supabase/supabase-js';
 
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
 
export async function POST(req: NextRequest) {
  const { organizationId, plan, locale } = await req.json();
 
  const supabase = createClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.SUPABASE_SERVICE_ROLE_KEY!
  );
 
  const { data: org } = await supabase
    .from('organizations')
    .select('*')
    .eq('id', organizationId)
    .single();
 
  if (!org) return NextResponse.json({ error: 'Not found' }, { status: 404 });
 
  // Get or create Stripe customer
  let customerId = org.stripe_customer_id;
  if (!customerId) {
    const customer = await stripe.customers.create({
      name: org.name,
      metadata: { organization_id: organizationId },
    });
    customerId = customer.id;
    await supabase.from('organizations').update({ stripe_customer_id: customerId }).eq('id', organizationId);
  }
 
  const isJa = locale === 'ja';
  const planConfig = {
    starter: { amount: isJa ? 2980 : 1900, maxMembers: 10 },
    growth: { amount: isJa ? 9800 : 6500, maxMembers: 50 },
  }[plan] ?? { amount: 1900, maxMembers: 10 };
 
  const session = await stripe.checkout.sessions.create({
    customer: customerId,
    mode: 'subscription',
    line_items: [
      {
        price_data: {
          currency: isJa ? 'jpy' : 'usd',
          product_data: {
            name: `${plan === 'starter' ? 'Starter' : 'Growth'} Plan — ${org.name}`,
            images: ['https://yourapp.com/images/org-plan-product.png'],
          },
          unit_amount: planConfig.amount,
          recurring: { interval: 'month' },
        },
        quantity: 1,
      },
    ],
    success_url: `${process.env.NEXT_PUBLIC_APP_URL}/${locale}/org/${organizationId}/billing?session_id={CHECKOUT_SESSION_ID}`,
    cancel_url: `${process.env.NEXT_PUBLIC_APP_URL}/${locale}/org/${organizationId}/billing`,
    metadata: { organization_id: organizationId, plan },
  });
 
  return NextResponse.json({ url: session.url });
}

Webhook to Sync Subscription State

// api/stripe-webhook/route.ts
export async function POST(req: NextRequest) {
  const body = await req.text();
  const sig = req.headers.get('stripe-signature')!;
 
  let event: Stripe.Event;
  try {
    event = stripe.webhooks.constructEvent(body, sig, process.env.STRIPE_WEBHOOK_SECRET!);
  } catch {
    return NextResponse.json({ error: 'Webhook error' }, { status: 400 });
  }
 
  const supabase = createClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.SUPABASE_SERVICE_ROLE_KEY!
  );
 
  switch (event.type) {
    case 'checkout.session.completed': {
      const session = event.data.object as Stripe.Checkout.Session;
      const { organization_id, plan } = session.metadata ?? {};
      const maxMembers = plan === 'starter' ? 10 : plan === 'growth' ? 50 : 999;
 
      await supabase.from('organizations')
        .update({ plan, stripe_subscription_id: session.subscription as string, max_members: maxMembers })
        .eq('id', organization_id);
      break;
    }
    case 'customer.subscription.deleted': {
      const sub = event.data.object as Stripe.Subscription;
      const { data: org } = await supabase
        .from('organizations').select('id').eq('stripe_subscription_id', sub.id).single();
      if (org) {
        await supabase.from('organizations')
          .update({ plan: 'free', stripe_subscription_id: null, max_members: 3 })
          .eq('id', org.id);
      }
      break;
    }
  }
 
  return NextResponse.json({ received: true });
}

Building the Organization UI in Rork

Member List with Real-Time Updates

// hooks/useOrgMembers.ts
export function useOrgMembers(organizationId: string) {
  const [members, setMembers] = useState<Member[]>([]);
  const [loading, setLoading] = useState(true);
 
  useEffect(() => {
    const fetchMembers = async () => {
      const { data } = await supabase
        .from('organization_members')
        .select(`id, user_id, role, accepted_at, profiles:user_id (email, display_name)`)
        .eq('organization_id', organizationId)
        .order('created_at', { ascending: true });
 
      if (data) {
        setMembers(data.map((m: any) => ({
          id: m.id,
          user_id: m.user_id,
          role: m.role,
          accepted_at: m.accepted_at,
          email: m.profiles?.email ?? '',
          display_name: m.profiles?.display_name ?? '',
        })));
      }
      setLoading(false);
    };
 
    fetchMembers();
 
    const sub = supabase
      .channel(`org-members-${organizationId}`)
      .on('postgres_changes', {
        event: '*', schema: 'public', table: 'organization_members',
        filter: `organization_id=eq.${organizationId}`,
      }, fetchMembers)
      .subscribe();
 
    return () => { supabase.removeChannel(sub); };
  }, [organizationId]);
 
  return { members, loading };
}

Common Errors and How to Fix Them

RLS Not Working — All Data Is Visible

Root cause: Using the service_role key on the client side. Always use the anon key in client-facing code.

// ❌ Wrong: service_role key in client code
const supabase = createClient(url, process.env.SUPABASE_SERVICE_ROLE_KEY);
 
// ✅ Correct: anon key for client, service_role only in server/Edge Functions
const supabase = createClient(url, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY);

Invitation Deeplink Not Opening the App

Set up your app scheme in app.json:

{
  "expo": {
    "scheme": "yourapp",
    "intentFilters": [
      {
        "action": "VIEW",
        "data": [{ "scheme": "https", "host": "yourapp.com", "pathPrefix": "/invite" }],
        "category": ["BROWSABLE", "DEFAULT"]
      }
    ]
  }
}

Members Can Exceed the Plan Limit

Always check before adding a member:

const { count } = await supabase
  .from('organization_members')
  .select('*', { count: 'exact', head: true })
  .eq('organization_id', organizationId)
  .not('accepted_at', 'is', null);
 
if ((count ?? 0) >= org.max_members) {
  throw new Error('Member limit reached. Please upgrade your plan.');
}

Advanced: Implementing Audit Logs

Production B2B SaaS apps need a record of who did what and when. Here's a lightweight audit log implementation using Supabase:

create table audit_logs (
  id uuid primary key default gen_random_uuid(),
  organization_id uuid references organizations(id),
  user_id uuid references auth.users(id),
  action text not null, -- 'member.invited', 'member.removed', 'plan.upgraded'
  target_id uuid,
  metadata jsonb,
  created_at timestamptz default now()
);
 
alter table audit_logs enable row level security;
 
-- Only admin+ can read audit logs
create policy "admins can view audit logs"
on audit_logs for select
using (
  organization_id in (
    select organization_id from organization_members
    where user_id = auth.uid()
    and role in ('owner', 'admin')
    and accepted_at is not null
  )
);

A Note from an Indie Developer

Key Takeaways

In this guide, we walked through every major pillar of building a production-grade B2B SaaS app with Rork: multi-tenant architecture, database-level security with Supabase RLS, a 4-tier RBAC system, member invitation flows, organization-level Stripe billing, and audit logging.

The best path forward is to launch with the Free tier, gather feedback from your first few team customers, then iterate on the paid tiers based on what they're willing to pay for. To dive deeper into Stripe implementation, check out Stripe Subscription Complete Guide.

Thank You for Reading

Rork Lab is ad-free, supported entirely by members like you. We publish practical guides daily with implementation code, benchmarks, and production-ready patterns. If you've found it useful, we'd love to have you on board.