What is One Shot, and what do you get on day one?

What is One Shot, and what do you get on day one?

One Shot is a complete, working application that you build your product on top of. Accounts and passwordless sign-in, subscriptions and payments, transactional email, background jobs, permissions, security hardening, and iPhone and Android app shells are all built, tested, and documented before you write a line. It runs on a fresh clone with no external accounts and no API keys, and you own the source. A license is $299 per year at the regular price and includes updates while it is active.

Below is the complete list, including the parts that are deliberately not included.

The short answer to "what is it for"

You have an idea. The distance between that idea and something a customer can pay for is mostly work that is identical in every product. One Shot is that work, already done, so you or your coding agent can start at the part that is actually yours.

What is included

Accounts and sign-in

• Passwordless sign-in by email. A six-digit code, expiring, rate limited, stored as a hash.
• Sign in with Google and Sign in with Apple.
• One signup path. Every route in creates or finds an account through a single chokepoint, so signing in with Google using an address that already registered by email finds the existing account rather than silently creating a duplicate. This is a small detail that causes a specific, painful class of bug when it is missing.
• Sessions with secure cookies and server-side invalidation on sign out.

Payments and subscriptions

• Stripe subscriptions, with hosted checkout and the customer billing portal.
• A hardened webhook that verifies signatures and tolerates duplicate delivery, because payment providers retry by design and deliver the same event more than once.
• An entitlement gate. Put one line in a controller and that feature requires a paid subscription.
• A local stand-in. With no Stripe key present, the entire billing flow runs in process, end to end, on your laptop. Same code path, different implementation behind the seam.

Email

• Transactional email through Resend in production and a local preview window in development, so nothing leaves your machine while you build.
• HTML and plain text versions of every message, which matters for deliverability.
• Async delivery, so a slow mail provider cannot slow down a web request.
• The DNS records documented, because deliverability is mostly not code.

Keeping customers separate

• An account is the boundary. Every piece of customer data belongs to one.
• Permissions that deny by default, with a scope that filters to the current account automatically.
• A test for it, shipped with the example feature: a request for another account's record returns a 404. Copy that test with every resource you add. Details in keeping every customer's data separate.

Background jobs

• Solid Queue, which runs on your existing database. No Redis, no extra service to run, pay for, or monitor. The reasoning is in do you need Redis for background jobs?
• Scheduled and recurring jobs included.

Security and compliance

• Rate limiting on the endpoints that get abused.
• An enforced content security policy, not a commented-out one.
• GDPR data export and account deletion.
• A single command, bin/check, that runs the tests, the linter, a static security scanner, a dependency vulnerability audit, and a secret scanner. Measured against the checklist that makes an app safe to launch.

Mobile

• iPhone and Android app shells that wrap the same web screens, so you maintain one codebase.
• In-app purchase wiring, because both stores require it for digital goods.

Deployment

• One command to deploy to a server you control, with TLS.
• Runs on SQLite, which for most products at most stages is a feature and not a compromise. No managed database bill on day one.

For your coding agent

• A guide file (CLAUDE.md and AGENTS.md) that tells an agent the one right way to do each thing in this codebase.
• A worked example feature, complete with model, permissions, screens, and tests, to copy.
• Skills for the common operations: add a resource, add an integration, add an email, add a job, write a post.
• A blog and the whole search and AI discoverability layer, which is what you are reading. How it works is in starting a blog and actually getting found.

What is deliberately not included

This is the part most descriptions leave out, and it is the part you need in order to decide.

• No admin interface. Data operations go through the console. Building a general-purpose admin UI that nobody's product actually wants is a large amount of code that would be in your way.
• No page builder, no theme system, no plugin architecture. You edit the code. That is the point.
• No opinion about your product. There is a worked example feature to copy, and it is meant to be deleted.
• No teams or multi-user workspaces out of the box. The account boundary is built to support them, and the path is documented, but the shipped model is one user per account.
• No AI features. There is a documented pattern for adding an integration, and that is the right place to start.

The thing to check before you buy

Under the hood it is a Ruby on Rails application. That is not a marketing detail, it is the most important compatibility question, and it cuts both ways.

If you or your team can read and maintain that, you are getting a conventional, well-tested codebase that you own completely. If nobody on your team can, then a starter kit will not save you six weeks; it will hand you a permanent dependency on a stack you do not speak. That is worth knowing before you subscribe, not after.

Everything is written to be conventional and readable on purpose. No metaprogramming, no custom domain-specific languages, no clever abstractions. Boring code is easier for a person to change and much easier for a coding agent to extend correctly.

What it costs

The regular price is $299 per year, and the pricing page always shows what is actually being charged today. That includes the full source, delivered privately, and updates for as long as the license is active. If you stop renewing, you keep the code you have.

There is a fuller breakdown of how that compares to the alternatives in what it actually costs to start an app.

How you start

Clone it, run the setup command, and it is already running with a working sign-in and a working purchase flow, using local stand-ins for every external service. Then run the bootstrap step, which renames the application, sets your brand, and removes the example feature. Then build your product.

The first thing most people do is point a coding agent at it. There are walkthroughs for Claude Code, Codex, Cursor, Hermes, and OpenClaw.