Volca Review 2026: Multi-Tenant SaaS Starter with TypeScript Focus

TL;DR

Volca is a solid multi-tenant TypeScript boilerplate with a focus on production infrastructure. AWS Cognito for auth (unusual choice), Stripe billing, and a clean separation between frontend and backend. At ~$99-$149, it's cheaper than Supastarter for multi-tenancy. Trade-off: AWS lock-in and less polish than Supastarter.

What You Get

Price: ~$99-$149 (check volca.dev for current pricing)

Core features:

• React (Vite) + TypeScript (SPA, not SSR)
• Node.js/Express backend
• Multi-tenancy: Teams + roles
• Auth: AWS Cognito
• Payments: Stripe
• Database: PostgreSQL via Knex
• UI: Tailwind + custom components
• Infrastructure: Terraform for AWS

---

The Architecture Decision: SPA + API

Volca makes an unusual choice: React SPA (Vite) + Express API, rather than Next.js:

apps/
├── client/   ← React SPA (Vite)
├── api/      ← Express + TypeScript
└── infra/    ← Terraform (AWS)

This decoupled approach is appropriate for products that will have multiple clients (web + mobile + third-party) or teams that want strict separation between frontend and backend.

// apps/api/src/modules/projects/project.router.ts
import { Router } from 'express';
import { requireAuth } from '../auth/auth.middleware';
import { requireTeamAccess } from '../teams/team.middleware';

const router = Router();

router.get('/teams/:teamId/projects',
  requireAuth,
  requireTeamAccess('member'),
  async (req, res) => {
    const projects = await projectService.findByTeam(req.params.teamId);
    return res.json(projects);
  }
);

router.post('/teams/:teamId/projects',
  requireAuth,
  requireTeamAccess('admin'),
  async (req, res) => {
    const project = await projectService.create({
      ...req.body,
      teamId: req.params.teamId,
    });
    return res.json(project);
  }
);

export default router;

This is more REST-like than tRPC — useful for teams building public APIs or needing OpenAPI documentation.

---

AWS Cognito Auth

Volca uses AWS Cognito for authentication — unusual in the boilerplate space:

// AWS Cognito user pool setup
import { CognitoIdentityProviderClient, SignUpCommand } from '@aws-sdk/client-cognito-identity-provider';

const cognitoClient = new CognitoIdentityProviderClient({ region: 'us-east-1' });

export async function signUp(email: string, password: string) {
  const command = new SignUpCommand({
    ClientId: process.env.COGNITO_CLIENT_ID!,
    Username: email,
    Password: password,
    UserAttributes: [{ Name: 'email', Value: email }],
  });

  return cognitoClient.send(command);
}

Why Cognito? It scales infinitely, handles MFA natively, and integrates with AWS IAM. The downside: AWS vendor lock-in and more complexity than Clerk or Supabase Auth.

---

Multi-Tenancy with Team Roles

// Team role enforcement
const requireTeamAccess = (minimumRole: 'member' | 'admin' | 'owner') =>
  async (req: Request, res: Response, next: NextFunction) => {
    const { teamId } = req.params;
    const { userId } = req.auth!;

    const membership = await db('team_memberships')
      .where({ team_id: teamId, user_id: userId })
      .first();

    if (!membership) return res.status(403).json({ error: 'Not a team member' });

    const roleHierarchy = { member: 0, admin: 1, owner: 2 };
    if (roleHierarchy[membership.role] < roleHierarchy[minimumRole]) {
      return res.status(403).json({ error: 'Insufficient permissions' });
    }

    req.teamMembership = membership;
    next();
  };

---

Terraform Infrastructure

Volca includes Terraform for AWS infrastructure:

# infrastructure/main.tf — AWS setup
module "api" {
  source = "./modules/api"

  environment = var.environment
  api_version = var.api_version
  database_url = module.database.connection_string
  cognito_user_pool_id = module.auth.user_pool_id
}

module "database" {
  source = "./modules/rds"

  environment = var.environment
  instance_class = "db.t3.micro"  # Dev
  # instance_class = "db.t3.medium"  # Production
}

This is valuable for teams deploying to AWS who want infrastructure-as-code from day one.

---

Volca vs Supastarter

Feature	Volca	Supastarter
Price	~$99-149	$299
Multi-tenancy	✅	✅
Auth	AWS Cognito	Supabase Auth
Stack	SPA + API	Next.js
Infrastructure	Terraform/AWS	Vercel
i18n	❌	✅
Admin panel	❌	✅ Basic
Lock-in	AWS	Supabase

Volca is cheaper; Supastarter has more features and better documentation.

---

Who Should Buy Volca

Good fit:

• Teams deploying to AWS (uses Cognito, can use RDS)
• Products needing a REST API (not tRPC or server components)
• Teams who want Terraform infrastructure from the start
• Budget-conscious teams needing multi-tenancy

Bad fit:

• Vercel/Next.js teams (architecture mismatch)
• Teams wanting simpler auth than Cognito
• Founders needing the fastest time-to-market
• Teams who want Supabase ecosystem

---

Final Verdict

Rating: 3/5

Volca fills a niche: multi-tenant SaaS for AWS-native teams at a lower price than Supastarter. The architecture decisions (Cognito, SPA+API, Terraform) are defensible but create lock-in and complexity. For the right team (AWS shop, REST API preference, IaC requirement), it's a good fit.

---

Compare Volca with other multi-tenant boilerplates on StarterPick.