Web App Tech Stack: Choosing Layers You Won't Have to Rip Out
A web app tech stack is not a list of favourite technologies. It is a set of commitments with wildly different exit costs. Swapping a CSS framework takes an afternoon. Swapping a database takes a quarter and a migration nobody wants to own. Choose the layers in order of how expensive they are to reverse, and the rest of the decisions get easier.
Don't pay full price to build this.All 39 Web App tools below come with a discount code, a startup programme or free credits.Claim these perks →
Order your decisions by how hard they are to undo
Every layer in a web app tech stack carries a reversal cost, and those costs differ by orders of magnitude. Your component library, your CSS approach and your deployment pipeline are cheap to change. Your database engine, your authentication provider and your billing system are not, because each one owns data that other systems have already copied and referenced.
So decide in that order. Lock the expensive layers first, deliberately, with a written reason. Then treat everything above them as replaceable and stop arguing about it. Teams that reverse this order spend three weeks choosing a state management library and pick their database in an afternoon, which is exactly backwards.
The practical test for any layer: if this vendor doubled its price tomorrow, how many working days would it take to leave? Under two days, it does not matter much what you pick. Over a month, you need an export path you have actually tested, not one that merely appears in the documentation.
Framework and hosting move together
Your framework choice quietly selects your host. A Next.js or SvelteKit app leaning on server rendering and edge functions is trivially deployable on a platform built for it and awkward everywhere else. A plain single-page bundle runs anywhere, including object storage behind a CDN, which is why it stays the cheapest thing to host.
Platform hosts win on time, not price. You get preview deployments per pull request, one-click rollbacks, automatic TLS and a build pipeline you never configure. The trade is that your compute bill scales with function invocations and bandwidth rather than with a fixed server, and that curve gets steep once traffic is real.
If you are going to be on a platform host, apply to its startup programme before you deploy anything, not after your first surprise invoice. Vercel and Render both run one, and the credits are sized to cover exactly the phase where your usage is unpredictable and your revenue is still zero.
The database is the layer you cannot casually replace
Postgres is the default answer and it is the right one for most web apps. It handles relational workloads, JSON documents, full-text search and geospatial queries competently enough that you can defer specialised stores until you genuinely need them. The interesting choice is not the engine, it is who runs it for you.
Managed Postgres now splits into two shapes. Serverless providers separate storage from compute, scale to zero between requests and offer branching, so every preview deployment gets its own copy of the data. Traditional managed instances stay warm, cost a predictable amount each month and avoid cold starts on the first request after a quiet period.
Document databases are not the wrong answer, but pick one for a reason you can state out loud. If your access patterns are genuinely document-shaped and your team already knows the query model, go. If you are choosing it because schema migrations feel like friction, you are buying that friction back later with interest.
Buy authentication, do not build it
Rolling your own auth is the most reliable way to lose a month and still ship something insecure. Password reset flows, session invalidation, MFA, social providers, rate limiting on login and the audit trail your first enterprise buyer asks for are all more work than they look, and all of it is undifferentiated.
The split worth understanding is consumer auth versus enterprise auth. Consumer providers cover email, social login and MFA with generous free tiers priced per monthly active user. Enterprise auth is a different product entirely: SAML, SCIM directory sync, per-tenant configuration, and the reason a large deal does not close without it.
You do not need both on day one, but check that your consumer provider has a credible path to SAML before you wire it into every route. Retro-fitting enterprise SSO into an app that assumed a single identity model is a rewrite of your session layer, not a feature flag you can turn on.
Payments, tax and the compliance you will underestimate
A payments layer is three separate problems: taking the money, handling recurring billing states, and remitting sales tax in jurisdictions you have never visited. Card processing is solved. Subscription lifecycle, dunning, proration and mid-cycle plan changes are where the engineering time actually goes, and they arrive later than you expect.
The merchant-of-record model exists to remove the third problem. The provider sells to your customer as the legal seller, collects and remits VAT and sales tax, and takes a higher percentage in exchange. Direct processing is cheaper per transaction and hands you the tax obligation, which is fine right up until it is not.
Whichever you choose, model billing state in your own database rather than treating the provider as the source of truth. Webhooks arrive out of order, they arrive twice, and occasionally they do not arrive at all. Your app needs to answer whether a customer is entitled to a feature without making an outbound API call.
Instrument before you need to, not after
Observability answers three questions you will ask under pressure. Is it broken, why is it broken, and is anyone using it. Error tracking and uptime monitoring cover the first two. Product analytics covers the third, and it is the one teams consistently install six months late, after the decisions it should have informed.
Structured logs plus traces beat print statements the first time a request fails only for one customer in one region. Full application performance monitoring gets expensive at volume, so sample aggressively and keep the cardinality of your custom tags under control, because that is what drives the bill nobody forecast.
Transactional email belongs in this section because it fails silently. Password resets and receipts that land in spam look identical to a working system from inside your app. Use a dedicated transactional provider with delivery reporting, keep it separate from marketing sends, and treat the bounce rate as a health metric.
Sequencing, and what the first year should cost
Choose the expensive layers in this order: framework and hosting, database, auth, payments, then observability. Each one constrains the next, and doing them out of order means rework. Nothing here should be picked for a scale you do not have, because premature distribution is how small teams lose entire quarters to plumbing.
The realistic first-year cost of this stack at list price is meaningful but not enormous. The point is that almost none of it needs to be paid at list price. Every major layer named here runs a startup programme of some kind, and several approve self-funded founders with no investor introduction at all.
That is what this directory tracks for the web app category: which hosting, database, auth, payments and monitoring vendors currently have an open programme, what the qualifying criteria actually are, and which ones you can claim today rather than filing under one day. Start with the layers you have already decided on.
The offers mentioned above
Pulled live from the directory, so what you see here is what the listing says.
Vercel
Developer Tools
Share of $8M+ in cohort credits
CreditsLink on plan
Render
Developer Tools
$2,500
CreditsLink on planDatadog
Data & Analytics
$100,000
CreditsLink on plan
Supabase
Developer Tools
$500
CreditsCode on plan
Clerk
Security
$500
CreditsLink on plan
Auth0
Security
$10,000
Free periodLink on plan
WorkOS
Developer Tools
AuthKit free for the first 1 million monthly active users
Free planDirect link
Stripe
Finance & Accounting
$100,000
CreditsLink on plan
Web App codes, all in one place
39 listings in Web App, with the redemption codes and programme links behind one subscription. Browsing is free.
Common questions
What is the simplest web app tech stack that still scales?
A server-rendered framework on a managed platform host, managed Postgres, a hosted auth provider and a payment processor. That combination carries most products well past their first serious traffic without any architectural rewrite.
Serverless database or a traditional managed instance?
Serverless if your traffic is spiky or you want a database branch per preview deployment. A warm managed instance if you have steady load or cannot tolerate a cold start on the first request after quiet periods.
Do I need Kubernetes for a web app?
Almost certainly not. Kubernetes solves multi-service orchestration problems that small teams do not have yet, and it adds an operations burden that a platform host absorbs for you at a fraction of the cost.
Can I get these layers free while I am pre-revenue?
Most of them, yes. Hosting, database, auth and analytics vendors all run startup programmes, and a large share accept self-funded founders on nothing more than a company name and a working URL.