Hosted SaaS / pre-1.0 / paid API access

Make auth and money agree.

SPAPS is one hosted control plane for classic SaaS login, wallet identity, Stripe billing, API keys, and the entitlements every app actually enforces.

Get an API key Read the docs View pricing

$99 per month

05 systems agreeing

03 staging apps / plan

identityuser_42

wallet0x…8f2a

stripeactive

SPAPS agree projected

A1 app / studiotier.grow

A2 app / consoleaccess.ok

A3 app / mobilesession.live

14:03:25identity.resolved200

14:03:25billing.projected200

14:03:26entitlement.granted200

SEED / EXACT HEX #32562B

ONE HOSTED AUTHORITY MANY APPS CLASSIC AUTH + WALLET IDENTITY STRIPE → ENTITLEMENTS PAID API KEYS ONE HOSTED AUTHORITY MANY APPS CLASSIC AUTH + WALLET IDENTITY STRIPE → ENTITLEMENTS PAID API KEYS

01 The seam is the product

Five systems can all be correct.
Your access model can still be wrong.

When identity, wallet verification, checkout, API keys, and entitlements live apart, every app inherits the glue. SPAPS gives that glue one hosted authority.

SaaS identity

Email/password, magic links, passkeys, sessions.

WHO

Wallet identity

Solana, Ethereum, Bitcoin, and Base.

PROOF

Stripe billing

Checkout, subscriptions, webhooks, customer sync.

MONEY

Applications + keys

Provisioned after subscription, scoped per consumer.

WHERE

Entitlements

Revenue state projected into usable access tiers.

WHAT

The SPAPS answer

One hosted service decides: who this is, what they paid for, which app is asking, and what opens next.

02 Product surface

Small enough to understand.
Complete where it counts.

IDENTITY / 01 one user

Identity without picking one religion.

Classic SaaS auth and wallet identity sit beside each other in the same hosted backend—not in separate vendor worlds.

BILLING / 02 synced

Stripe events become access.

Checkout and subscription state project into the tiers your products enforce.

APPLICATIONS / 03 paid access

Subscribe. Create an app. Get the keys.

An active subscription unlocks application provisioning. Raw secret keys are shown once; only their hashes remain on the server.

CONTRACTS / 04 typed

One contract. Several ways in.

OpenAPI, a Python client, and a TypeScript SDK keep consumers on the same nouns.

OPERATIONS / 05 managed

The control plane runs as a service.

SPAPS operates the hosted API at api.sweetpotato.dev. Customers integrate through scoped keys instead of deploying the backend.

STRUCTURE / 06 defense in depth

Security lives in the structure.

Field-level PII encryption, immutable admin audit logs, signed webhooks, and outbound destination guards.

03 One authority, many products

Connect it once.
Let every app ask.

SPAPS gets more useful as your product surface grows. The consumer changes. The hosted authority does not.

01EVENTidentityverified

02EVENTpaymentsettled

03EVENTapplicationscoped

HOSTED AUTHORITY SPAPS identity × revenue × access

WCONSUMERweb appallowed

DCONSUMERdashboardallowed

MCONSUMERmobileallowed

04 From subscription to first request

A real backend.
Without becoming its operator.

The $99/month developer plan includes up to three staging applications. Subscribe, provision an application, save the one-time secret, and point your SDK at the hosted API.

01
Activate access
Start the paid developer subscription. There is no free tier or trial.
02
Create an application
Mint a scoped staging app and save the raw API keys when they are shown.
03
Integrate the client
Use the TypeScript or Python SDK against api.sweetpotato.dev.

~/my-app — zsh

# After your paid subscription provisions an app key.
$ npm install spaps-sdk
$ export SPAPS_API_URL=https://api.sweetpotato.dev
$ export SPAPS_SECRET_KEY=spaps_sec_••••••••

$ npx spaps connect
connected: api.sweetpotato.dev

# One snapshot of identity + access.
$ curl https://api.sweetpotato.dev/api/auth/session-context \
  -H "X-API-Key: $SPAPS_PUBLISHABLE_KEY" \
  -H "Authorization: Bearer $USER_JWT"

{
  "user": "user_42",
  "application": "studio",
  "tier": "grow"
}

# Bind checkout to the same identity.
$ curl -X POST \
  https://api.sweetpotato.dev/api/stripe/checkout-sessions \
  -H "X-API-Key: $SPAPS_PUBLISHABLE_KEY" \
  -H "Authorization: Bearer $USER_JWT" \
  -H "Content-Type: application/json" \
  -d '{"mode":"subscription", ...}'

hosted api ready api.sweetpotato.dev

05 Narrow on purpose

Early by label.
Clear by contract.

SPAPS is pre‑1.0. Contracts can still move. It is a proprietary hosted SaaS: customers pay for access, receive scoped API keys, and integrate the service rather than receiving deployment rights.

NOT 01

Enterprise IAM

No claim to replace SAML, SCIM, workforce identity, or broad federation platforms.

NOT 02

A full BaaS

No storage, functions, hosting, and every-database-feature product sprawl.

NOT 03

Source distribution

The service and code are proprietary. A package or repository checkout is not permission to deploy, modify, or redistribute SPAPS.

THE PLACE WHERE IDENTITY + REVENUE MEET

Give the glue
one address.

Subscribe, provision a scoped application, and make your first request against the hosted control plane.

Get an API key Read the docs