Case study: Scaling a Next.js site to 10K+ daily users with minimal ops

When a B2B SaaS launched its marketing and self-serve portal on Next.js, the target was brutal simplicity: handle 10K+ daily users, sub-200ms TTFB, and fewer than two engineers on maintenance. Here is the blueprint we executed, what broke, and what we kept ruthlessly simple.

Architecture choices that compound

We used the App Router, Incremental Static Regeneration for ~85% of routes, and server components for data heavy pages. Static-by-default plus short revalidation windows let the CDN do the lifting while keeping content fresh. Middleware at the edge handled bot mitigation and locale routing; no custom Nginx, no bespoke Kubernetes.

Authentication and authorization implementation

We selected OpenID Connect with a managed IdP (Auth0, but Cognito or WorkOS work too). Auth flows lived in NextAuth with PKCE. Sessions were JWTs signed with JWKs, cached at the edge. Critical: authorization was explicit. We implemented RBAC for app roles and ABAC for resource rules. Policy checks ran in server components and API routes only, never in the client.

• Tenant isolation: orgId embedded in claims; all DB queries asserted orgId to prevent cross-tenant leakage.

Result: 0 auth-related incidents in three months, and requests stayed cacheable where safe because anonymous pages remained static.

Headless CMS integration with Next.js

Marketing needed velocity with guardrails. We integrated a headless CMS (Sanity for structured content; Contentful would have been similar). The pattern:

• Read via server components; write never from the client. Draft preview used Next.js Preview Mode tied to CMS webhooks.
• ISR with tag-based revalidation: publishing a post fired a webhook that invalidated only affected paths.
• Localization lived in the CMS with field-level locales; the site read the correct variant based on locale middleware.
• Images flowed through Next.js Image Optimization with CMS asset URLs, slashing payload by ~42% on mobile.

Editorial impact: from idea to published landing page in 30 minutes, no engineer in the loop. Traffic spikes hit the CDN, not the origin.

Performance and observability

We budgeted 60KB JS for anonymous pages and enforced it with bundle-analyzer in CI. Third-party scripts loaded via Partytown or deferred. RUM used Vercel Web Analytics plus Sentry for traces. We set an SLO: p95 TTFB < 200ms in US/EU, < 350ms APAC. When p95 rose, we traced slow dynamic paths and converted two to static + server actions, dropping TTFB by 40% overnight.

App store deployment and release management

Although web-first, sales wanted app store presence. We wrapped the site using Capacitor for iOS/Android, gated offline views with a PWA cache, and exposed native login via AppAuth. Release management followed strict lanes:

• Versioning automated from Git tags; semantic prereleases hit internal tracks nightly.
• TestFlight and Play internal testing for canaries; 5% phased rollout, then 25%, then 100% after 48 hours clean error budgets.
• Critical copy or pricing tweaks shipped to the web immediately; the shell updated quarterly to limit review churn.
• For React Native surfaces, OTA updates via Expo EAS Update covered non-native changes under Apple’s guidelines.

This hybrid approach satisfied procurement checkboxes without bloating the ops surface area.

Minimal ops, maximum leverage

Hosting ran on Vercel. No servers to patch, no container registry. Environment promotion used separate projects per stage, with protected env variables. Backups for the database were automated with daily snapshots and PITR. A one-page runbook covered cache busting, IdP failover, and incident comms.

• CI/CD: GitHub Actions ran lint, typecheck, tests, and Lighthouse CI on PRs. Fail gates were non-negotiable.
• Infrastructure: only managed services-Vercel, Planetscale, Sanity, Auth0, Sentry. Zero custom Terraform.
• Cost: at 12K daily users, all-in infra was under $1.9K/month; most spend was Sentry and Auth0 MAUs.

What we would do differently at 100K daily users

Add Redis for session introspection and rate limits, precompute search indexes nightly, and introduce a dedicated content edge cache for bursty locales. Everything else scales with the current footprint.

Action checklist you can copy

• Default to static; use ISR with tags and targeted webhooks.
• Keep Authentication and authorization implementation on the server; enforce RBAC + ABAC, log decisions.
• Design Headless CMS integration with Next.js around Preview Mode and localized fields.
• Ship app store shells via Capacitor; use phased rollout and OTA where permitted for release management.
• Set aggressive JS budgets and SLOs; trace dynamic hotspots, promote to static when possible.
• Choose managed services ruthlessly; write a one-page runbook.

If you need senior hands to execute this playbook, slashdev.io can plug in vetted engineers and a software agency backbone to move from plan to production fast, without ballooning your ops.