Everything behind
your app.
Nothing to deploy.

// Your whole backend starts here.
const app = createClient(PROJECT_URL, PUBLIC_KEY);

// Your data. Your users’ permissions.
const posts = await app.from("posts")
  .select("id, title, published")
  .eq("published", true);

SQL you know. Row permissions applied by the backend.

const app = createClient(PROJECT_URL, PUBLIC_KEY);

// A familiar sign-in flow.
await app.auth.signInWithOAuth({
  provider: "apple"
});

const user = await app.auth.getUser();

Identity travels with every authenticated request.

const app = createClient(PROJECT_URL, PUBLIC_KEY);

// Give your app a place for its files.
await app.storage("photos")
  .upload("hello.jpg", file);

const url = await app.storage("photos")
  .createSignedUrl("hello.jpg");

R2-backed files, with access controlled by your project.

const app = createClient(PROJECT_URL, PUBLIC_KEY);

// Your backend logic. Plain JavaScript.
const post = await app.rpc("publishPost", {
  postId: "post_123"
});

console.log(post.title);

Project-scoped functions for the logic that belongs on the server.