Code your backend with AI. Deploy it globally.

Describe it in plain language and let AI build it — or write it yourself. Either way you ship a production-grade backend, deployed to the edge worldwide. Built for professional developers and vibe coders alike.

Start free on Cloud → Try the live playground →
Runs on
Bun Node.js Deno
Deploy to
Docker Cloudflare Vercel Netlify Deno Deploy AWS Lambda Google Cloud Azure
ai-native

Ask your data anything, in plain language.

Type a question and a model turns it into a reviewable query — then runs it. Pick the model (Claude, Grok, DeepSeek, Qwen) or bring your own key. Every plan passes through your permissions DSL, so each caller sees only the rows and fields their role allows.

Try Ask AI on Cloud MCP spec
Ask in natural language claude-haiku-4-5
Who were our 10 most valuable customers last month?
synthesizing
plan → collections.list read permissions DSL filters rows
tokens 380latency 28msrows 10
namelifetime_valuelast_order_at
Lena Voss$28,1422026-05-22
Theo Ranganathan$22,0052026-05-19
Yuki Okafor$18,8302026-05-23
Permissions DSL applied · 0 fields redacted+7 more rows
mcp · agents

Build it with an agent. Ship it like a pro.

A streamable MCP server ships in the box — point Claude, Codex, Cursor, or any agent at it and build by talking. Every tool call runs through your permissions DSL, with a per-key tool allowlist and read-only guards.

149 tools
MCP tool catalog
Every admin capability is an MCP tool — grouped, type-validated, and DSL-filtered before it runs. Cloud adds 44 more for the control plane.
pak_8f2a…
Per-key guards
Bind a tool allowlist and a read-only flag to any access key — agents inherit the guards of the key they used.
oauth 2.1 · no key
Connect a client
Hosted clients sign in with OAuth — no key to paste. Headless agents keep the Bearer path: stateless POST /mcp, or /api/admin/mcp for ops bots.
1 · connect — point your agent at the MCP server, once
# Claude Code
claude mcp add --transport http backlex \
  https://acme.backlex.com/mcp \
  --header "Authorization: Bearer pak_8f2a…"
2 · ask — then just say what you want
you ▸Add a campaigns collection with name, budget, start_date and status — then seed 3 sample rows.
mcp ▸
→ schema.create_collection campaigns
→ collections.create campaigns ×3
ran through your permissions DSL · per-key allowlist + read-only guards apply

same wiring for Cursor, Codex, Claude Desktop, or any MCP client — one URL, then OAuth or a pak_… key · protocol 2025-11-25

capabilities

Everything a backend ships with, none of the lock-in.

No black box. The collection editor in the admin runs the same DDL your migrations would have. The permission DSL the admin writes is the same string your client sends as ?filter.

Dynamic schema
Define collections in the admin, each becomes a physical c_<slug> table. CREATE TABLE runs against your live DB, no redeploy.
drizzle · pg + sqlite/d1
Adopt or import a database
Wrap tables you already have with a metadata row — no DDL, no data migration. Or import from Postgres, MySQL, SQLite, MongoDB, Firestore and DynamoDB: plan it, run it, resume it, re-sync deltas.
adopt · 6 sources · --since
Schema versions & branching
Snapshot the schema, diff two points in time, branch a change and apply it when it's ready. Auto-snapshots run on a schedule, so there is always a point to roll back to.
snapshot · diff · branch
Permissions DSL
JSON predicates that compile to Drizzle SQL fragments and match in-process for realtime. Same syntax in roles, REST ?filter, and GraphQL.
$user.id · _eq · _in · $or
REST + GraphQL
Every collection auto-exposes /api/items/:slug with filter/sort/expand/projection. GraphQL synthesised from the same metadata. Bulk + atomic writes on both.
openapi 3.1 · graphql-yoga
Realtime
SSE in Bun, Durable Object + WebSocket on Workers. Per-event permission filter means subscribers see only what their role can read, and live queries push membership changes — not just raw row events.
sse · live queries · durable objects
Edge functions
JavaScript sandbox with a host bridge for ctx.db / fetch / email. Bun worker thread, QuickJS-WASM, or remote HTTP — auto-selected per runtime.
quickjs · bun worker · http
Storage + image transforms
Local FS in dev, R2 / S3 on edge. Image resize via Bun.Image, CF Image Resizing, or passthrough — same URL shape.
r2 · s3 · fs
Webhooks & Flows
HMAC-signed outbound webhooks per event, plus a visual flow builder for branching multi-step automations. Fire-and-forget — never blocks API responses.
items.* · auth.* · cron
Form builder
Drag blocks into a multi-step public form, then share the link or embed the script. Anonymous uploads get signed tickets, conditions and translations are built in, and submissions land in a collection.
blocks · steps · embed · /f/:token
Extensions
Install admin panels, field editors, and hooks from npm or an upload. Hooks run sandboxed — on events or on the cron tick — so you extend the admin instead of forking it.
npm · upload · sandboxed hooks
AI Agents
Agents that reason over your data and call your tools in a persisted reason→act loop. Every tool call runs through your permissions DSL; optional per-thread vector memory.
threads · tools · memory
Auth, not yours to maintain
better-auth wrapper: email, OAuth, magic link, OTP, passkey, 2FA, SAML 2.0 SSO, LDAP / AD. Per-IP rate-limiting + account lockout built in.
better-auth · 2fa
Activity + revisions
One activity table, dot-namespaced actions (item.update, auth.login). Every CRUD writes a row to revisions — point-in-time restore included.
audit log · point-in-time
Traces, usage & advisor
W3C traceparent spans you can open in the admin or ship over OTLP, a per-key usage ledger with limits, and a linter that scores your schema, permissions, and config with a deep link to each fix.
otlp · usage ledger · lint score
Insights & embedded BI
Build dashboards over your collections — six chart types, grouping, drill-through — and embed any of them in your own product behind a public iframe token.
panels · charts · /embed/d/:token
Unified messaging
Push (FCM, APNs, Web Push) and SMS (Twilio, Amazon SNS) from one API. Per-tenant credentials, device + phone registries, and templates — all built in.
fcm · apns · web-push · sms
Durable job queue
Background work that retries with exponential backoff, dead-letters after N tries, and runs on a schedule. Rides the cron tick — no Redis, no extra binding.
retry · dead-letter · runAt
Resumable uploads
TUS 1.0.0 chunked uploads survive dropped connections and resume from the committed offset. Native R2 / S3 multipart under the hood.
tus 1.0.0 · multipart
Draft & publish
First-class draft / published status: drafts hidden from readers without a publish permission, and scheduled publishing the cron tick applies when due.
_status · publishAt
Feature flags
Toggle features and ship remote config without a deploy. Per-workspace or global, with rollout-percentage and permission-DSL targeting, evaluated per caller.
rollout % · targeting
Offline-first sync
Keep a local copy that works offline: an incremental changefeed with delete tombstones, SSE live updates, and an offline write queue that flushes on reconnect.
changefeed · indexeddb · lww
Edit like a spreadsheet
Grid mode with cell selection, keyboard nav, copy/paste, fill-down and undo — or a Kanban board grouped by status. Same permissions and validation as the item form.
grid · kanban · inline edit
Two editors, no lost writes
Presence and field-level awareness on the item form and the rows table show who is editing what, and every PATCH carries an optimistic-concurrency guard that refuses a stale overwrite.
presence · awareness · conflict guard
Content i18n
Localize any field — text, files, even relations — through a translations sidecar. Edit locales side by side, compare them, and let AI fill in the keys you haven't written yet.
locale bar · compare · auto-translate
integrations

Fan record events out to the tools you already run.

Connect a workspace from the admin and every data event flows to chat, alerting, analytics, search, and issue trackers. Scope by collection, secrets encrypted at rest — no glue code. On Cloud the same connectors carry ops events too: deploys, quota alarms, provisioning failures.

Slack Discord Microsoft Teams Telegram Datadog Sentry PagerDuty Opsgenie PostHog Segment GitHub Linear Jira Algolia Meilisearch
chat · alerting · analytics · search · issue tracking · plus HMAC-signed webhooks & visual flows
global edge

Your backend, where your users are.

Deploy to Cloudflare Workers and your API runs in 330+ cities on six continents. The request never crosses an ocean to find its origin — database reads, live subscriptions, and file fetches all happen at the city closest to the user.

live anycast routing · 330+ cities
San Jose SJC
12 ms
Ashburn IAD
9 ms
London LHR
8 ms
Frankfurt FRA
7 ms
Istanbul IST
11 ms
Singapore SIN
14 ms
Tokyo NRT
10 ms
Sydney SYD
16 ms
São Paulo GRU
15 ms
Johannesburg JNB
19 ms
01
Reads stay local
Database reads are served from the city closest to your users. Writes sync to the primary in the background, so a read never waits on another region.
02
Realtime, region-free
Each collection has its own live channel that pins to the nearest edge node. Clients stream updates over WebSocket or SSE — no round-trip to a central server.
03
Files at the edge
Uploads and downloads are served from edge storage with zero egress fees. Image resizing runs at the same location, so the payload never travels twice.
cloud · managed

Don't want to run it yourself? Backlex Cloud hosts it for you.

Same Apache-2.0 codebase, same admin, same API — provisioned as your own Worker, D1 database, R2 bucket and Vectorize index on Cloudflare. 30 seconds from signup to first deploy, or start from one of 28 ready schema templates. One-click export if you ever want to bring it back home.

Start free — no card → See pricing no card on free · 100K requests / mo
EU or Global residency
Pick where the data lives when you create the org. EU pins the database and bucket to the EU jurisdiction — read replicas included. Global lets Cloudflare place the primary for the lowest latency.
eu jurisdiction · 8 regions
Backups with real PITR
Daily automatic snapshots plus on-demand ones, and point-in-time restore through D1 Time Travel — 7 days on Pro, 30 on Scale and Max.
daily · on-demand · time travel
Custom domain + edge SSL
Point a subdomain or a root domain at your project. Certificates are issued and rotated for you through Cloudflare for SaaS. Pro and up.
api.acme.app · automatic ssl
Preview branches
A branch or PR gets a full isolated instance — its own database, bucket, and URL — with data cloned from the parent and torn down for real when it closes.
isolated instance · auto teardown
Keys you don't have to own
AI embeddings and generation, transactional email, push, and SMS run through managed gateways. Metered against your plan and hard-capped, so nothing runs away.
ai · email · push · sms
Meters, alarms, audit
Requests, database and object storage against your plan caps, a 30-day chart, and CSV export. Set an alarm at any percentage and it fires to email, Slack, or a webhook.
alarms · csv export · audit log
Upgrades roll forward
Your instance is upgraded in place as new versions ship — or take it yourself from Settings with one click. No redeploy, no downtime window to book.
in-place · one click
Your exit is preserved
Export the whole project as a portable SQL dump — schema and data, one click. It's the same Apache-2.0 Backlex, so your own server runs it in minutes.
sql dump · apache-2.0
quickstart

Five minutes from clone to your first item.

Sign up the first user. They get admin. From there, define a collection in the admin and the API endpoint exists immediately — no redeploy, no codegen step, no schema versioning gymnastics.

Drop a column, the column is gone. Rename a collection, the API path moves with it.

Full getting-started → Permissions DSL
terminal 

        

      

    

    
    

      

        
client sdks

        
Ship in any language. One API, eleven SDKs.

        
TypeScript is the reference client; native clients ship for ten more languages. Every one wraps the same REST + SSE surface — CRUD, a fluent query builder, auth, realtime, and storage.

        

          

              

                
                TypeScript
              

              
fetch · browser + node

            

              

                
                Python
              

              
httpx

            

              

                
                Go
              

              
net/http · stdlib

            

              

                
                Rust
              

              
serde_json · wasm-ready

            

              

                
                Swift
              

              
URLSession · iOS

            

              

                
                Dart
              

              
flutter · ios+android+web

            

              

                
                Kotlin
              

              
jvm · android

            

              

                
                Java
              

              
java.net.http

            

              

                
                .NET
              

              
httpclient · zero deps

            

              

                
                Ruby
              

              
net/http · stdlib

            

              

                
                PHP
              

              
curl

            

          Browse all SDKs →
        

        

          Client SDKs docs
          Browse the source ↗
          one canonical query grammar · idiomatic in each language · Rust core compiles to WebAssembly
        

      

    


    
    

      

        
why Backlex

        
The trade-offs, in one table.

        
Other tools do parts of this. Backlex's design choice is to keep every part under one source tree, behind one API, deployable to five targets — without forking.

        

          

            
              

                Capability
                Backlex
                Supabase
                Firebase
                Directus
                Roll-your-own
              

            
            
              

                  Self-host, Apache-2.0 licensed
                  ✓
                  partial
                  no
                  ✓
                  ✓
                

                  Runs on Cloudflare Workers
                  ✓
                  no
                  no
                  no
                  if you build it
                

                  Change schema at runtime
                  ✓
                  migrations only
                  schemaless
                  ✓
                  depends
                

                  Adopt an existing database as-is
                  ✓
                  no
                  no
                  limited
                  depends
                

                  Declarative row & field permissions
                  ✓
                  RLS
                  Security Rules
                  ✓
                  build it
                

                  Per-event realtime permission filter
                  ✓
                  RLS-based
                  rules-based
                  no
                  build it
                

                  Edge functions sandbox + host bridge
                  ✓
                  ✓
                  Cloud Functions
                  no
                  build it
                

                  Visual flow builder
                  ✓
                  no
                  no
                  ✓
                  build it
                

                  Runtime MCP server over your data
                  149 tools
                  project admin
                  no
                  content tools
                  build it
                

                  Public form builder + embed
                  ✓
                  no
                  no
                  no
                  build it
                

                  Embedded BI dashboards
                  ✓
                  SQL editor
                  Looker Studio
                  ✓
                  build it
                

                  Import MySQL / Mongo / Firestore / DynamoDB
                  ✓
                  CSV / pg_dump
                  no
                  limited
                  build it
                

                  Schema snapshots + branching
                  ✓
                  migrations
                  no
                  schema snapshot
                  build it
                

                  Live presence + conflict guard
                  ✓
                  no
                  no
                  no
                  build it
                

                  Client SDKs (official)
                  11 langs
                  4
                  5
                  JS / TS
                  build it
                

                  Unified messaging (push + SMS)
                  ✓
                  OTP only
                  push only
                  no
                  build it
                

                  Durable job queue (retry + DLQ)
                  ✓
                  pgmq
                  Cloud Tasks
                  no
                  build it
                

                  Feature flags + remote config
                  ✓
                  no
                  Remote Config
                  no
                  build it
                

                  Offline-first sync
                  ✓
                  PowerSync
                  built-in
                  no
                  build it
                

                  SAML 2.0 + LDAP / AD
                  ✓
                  enterprise
                  enterprise
                  enterprise
                  build it
                

            
          

        

        

          Full head-to-head:
          vs Supabasevs Firebasevs Directusvs Strapivs Appwritevs AWS Amplify
        

        
Self-host stays the default — most teams want to own their own DB credentials. Backlex Cloud (managed) runs the same Apache-2.0 codebase on Cloudflare for teams who'd rather not, with one-click export so you can leave any time.

      

    


    
    

      

        
philosophy

        

          “Everything an operator needs lives behind one URL. The schema editor writes the same DDL your migrations would have. The permission DSL the admin writes is the same string your client sends as a query parameter. There is no second layer to learn.”
        

        
— from docs/DESIGN.md

      

    


    
    

      

        
The backend ships with the docs. Start there.

        
Five-minute getting-started, the permission DSL spec, five deploy walkthroughs, and a sandbox guide. All in one place.

        

          Open the docs →
          Start free on Cloud