Espobase docs

Getting started

1. Create an account and an organization.
2. Create a project. It gets its own dedicated database.
3. Create tables in the Table Editor or describe your app to the AI builder.
4. Call your REST API with the project's publishable key.

curl "<project URL>/rest/v1/todos?select=*" \
  -H "apikey: <publishable key>"

Projects

A project is one app backend: its own PostgreSQL database, REST API, API keys and app users (App Authentication). Projects belong to an organization.

Database

Every project gets a dedicated PostgreSQL 18 database. Tables in the public schema are exposed through the REST API; row-level security policies decide who can read or change each row.

REST API

Each table gets endpoints under your project's REST URL (…/project/<project-ref>/rest/v1, shown on the project's API page). Send a publishable key (eb_pk_…) from browsers and apps; its requests are anonymous and row level security decides what they can see. Add a signed-in user's access token as Authorization: Bearer to run requests as that user. Secret keys (eb_sk_…) bypass user-level access controls and must only be used on trusted servers.

Authentication

Espobase App Authentication gives your app's own users email and password sign-up and sign-in, separate from your Espobase account. Users live in your project's database. Signing in returns a short-lived access token (signed with your project's own key) and a rotating refresh token; the @espobase/client SDK keeps them fresh and sends the token with every request, so row level security sees the user as authenticated. Without a user token, publishable-key requests are anonymous. Secret keys act as a server-side service role and must only be used on trusted servers.

Row level security

Row level security is on for every new table, whether you create it in the Table Editor, the SQL editor, a migration or the AI builder. Until you add policies under Database → Policies, publishable keys see no rows; secret keys (server-side only) see everything. You always review the generated SQL before it runs. Public read works for everyone. Authenticated only, User owns row, Organization membership and Admin only apply to users signed in with App Authentication: espobase.user_id() is the signed-in user's id and espobase.app_role() their app role, both taken from the verified token. Organization membership also needs your own membership table (with a policy that lets users read their own memberships), and Admin only needs app roles that you assign on the server.

Storage

Buckets hold files. Access follows the same row-level security model as your tables.

Realtime

Live updates for your app with espobase.realtime: broadcast messages to everyone on a channel, see who's online with presence, and receive row changes of the tables you turn on under Realtime in the dashboard. Each subscriber gets only the rows its user may read under the table's security rules; deletes send only the row's primary key. See the full guide at espobase.com/docs/realtime.

Edge Functions

Your own server code with espobase.functions: TypeScript functions you deploy from the dashboard or the CLI, for webhooks, payments, emails and other server work. Each project's functions run in their own sandbox; secrets are stored encrypted, signed-in users are verified for you, and every call's output appears under Logs. See the full guide at espobase.com/docs/functions.

Hosting

Publish your app's front end next to its backend: build your site, publish the folder from the dashboard or with `espobase deploy`, and it's live at `https://<name>.espohost.com` with HTTPS. Every deployment is kept, so you can roll back in one click. Available on Pro and Group. See the full guide at espobase.com/docs/hosting.

AI backend builder

Describe your app and Espobase proposes tables, relations and policies. You review every statement; nothing runs without your approval.

Vector search

Every project includes pgvector: store embeddings in vector columns, index them with HNSW and search by similarity with a database function called through the REST API or espobase.rpc(). Row level security applies. See the full guide at espobase.com/docs/vector.

CLI

npx espobase login, then npx espobase init: link a folder to a project, generate TypeScript types, run read-only queries and check logs and usage from your terminal. See the full guide at espobase.com/docs/cli.

Connect AI tools (MCP)

Use Espobase from Claude, ChatGPT, Cursor or VS Code: they read your schema, API reference, logs and usage, run read-only queries and propose changes you approve. See the full guide at espobase.com/docs/ai-tools.