@bootstrapware/onboard

Embeddable first-run setup checklist for small production SaaS: required and optional steps, dependencies, eligibility, facts, dismiss, and snooze.

Local / demo is free. BYO is $9.99 / month (you store progress). Hosted is $19.99 / month (Bootstrapware stores progress). Bootstrapware does not authenticate end users. Your app asserts user.id.

pnpm add @bootstrapware/onboard

Peer dependencies: react and react-dom (>= 18).

Local / demo

import { Onboard, createLocalAdapter } from "@bootstrapware/onboard";
import "@bootstrapware/onboard/styles.css";

<Onboard
  user={{ id: session.user.id, name: session.user.name }}
  workspaceKey={workspace.id}
  adapter={createLocalAdapter({ storageKey: "demo-onboard" })}
  items={[
    { key: "create_workspace", title: "Create your workspace", progressScope: "workspace" },
    { key: "invite_teammate", title: "Invite a teammate", dependsOn: ["create_workspace"], progressScope: "workspace" },
  ]}
/>

Hosted

Publishable keys may appear in the browser. Secret keys must stay server-side. Never mint keys via MCP.

<Onboard
  flowId="flw_..."
  publishableKey="bsw_live_pub_..."
  user={currentUser}
  workspaceKey={workspace.id}
  authorToken={authorTokenFromBff}
/>

Optional apiBaseUrl defaults to https://onboard.bootstrapware.co.

BYO ($9.99): pass an OnboardAdapter. Progress stays on your backend. See the packaged AGENTS.md.

Security

• Do not put bsw_live_sec_ or bsw_test_sec_ in client code.
• Host-asserted user.id can be forged if a publishable key leaks. Mitigate with origins and requireAuthorToken plus a secret-minted authorToken.
• Never send host context or flags through MCP. MCP configures flows only.

Docs

• Product: https://bootstrapware.co/onboard
• Agent rules (AGENTS.md): https://bootstrapware.co/onboard/docs/agents

For coding agents, copy the packaged AGENTS.md into your repo rules, or point the agent at the docs URL above.

License

MIT