Build your backend in minutes

Forgeyn Base is an open backend platform. You create a project, and the platform provisions a dedicated, isolated Postgres database (on Neon), a storage layer, and API credentials for it. You talk to it with the JavaScript SDK, plain REST, the CLI — or let AI agents use it through the MCP server.

There are two doors into the platform. The management API is for you, the developer: create projects, run SQL, upload files, wire webhooks. The BaaS gateway is for your software: your website or app gets scoped, parameterized access to its own database — with end-user accounts living inside it.

From zero to a working database-backed website in about five minutes.

1. 1

   Create a free account

   Sign up in the console. No credit card.

2. 2

   Create a project

   Pick a name and a region — a private Postgres database is provisioned for you on Neon.

3. 3

   Create an API key

   Open your project → API keys → Create key. Copy the fbk_live_… value — it authenticates the management API via the X-Api-Key header.

4. 4

   Create a table

   Use the console SQL runner, or run it from anywhere:

   create table todos (
     id uuid primary key default gen_random_uuid(),
     user_id uuid,
     title text not null,
     done boolean not null default false,
     created_at timestamptz not null default now()
   );

5. 5

   Make your first request

   curl -X POST https://forgebase-api-z6xv.onrender.com/api/projects/<project-id>/sql \
     -H "X-Api-Key: fbk_live_…" \
     -H "Content-Type: application/json" \
     -d '{"query": "select count(*) from todos"}'

The management API and the BaaS gateway are deliberately separate. Secrets that can spend or destroy live only on the management side; the gateway hands out scoped, publishable credentials that are safe to embed in browsers.

forgeyn-sdk is the official client. It has zero dependencies and runs in browsers, Node, Bun, Deno and edge runtimes.

npm install forgeyn-sdk

import { createClient } from "forgeyn-sdk";

const fb = createClient({
  url: "https://pupagsqvhhshecxmbgay.supabase.co/functions/v1/gateway",
  appId: "app_xxxx",          // console → project → API keys
  clientKey: "pk_…",          // publishable — safe in the browser
});
// The end-user session token is held in memory by default. To survive page
// reloads, hand the SDK a persistence hook backed by YOUR backend (an
// httpOnly cookie) — never stash raw tokens in localStorage.

// end-user auth — accounts live in YOUR project's own database
const { user, token } = await fb.auth.signUp("[email protected]", "password123");

// parameterized database access — no SQL, no injection
const row = await fb.db.insert("todos", { title: "Ship the docs", done: false });
const { rows } = await fb.db.select("todos", { orderBy: "-created_at", limit: 20 });
await fb.db.update("todos", { where: { id: row.id }, values: { done: true } });
await fb.db.remove("todos", { where: { id: row.id } });
const open = await fb.db.count("todos", { where: { done: false } });

On tables that have a user_id column, every write is stamped with the signed-in user and every read is filtered to them — the SDK cannot opt out of this, even if it tries to send a different user_id.

import { createAdminClient } from "forgeyn-sdk";

// SERVER-SIDE ONLY — bypasses per-user row scoping
const admin = createAdminClient({
  url: "https://pupagsqvhhshecxmbgay.supabase.co/functions/v1/gateway",
  appId: "app_xxxx",
  adminKey: "sk_…",
});

Prefer raw HTTP? The gateway speaks the same JSON the SDK sends. Every request carries your app id and the publishable client key.

curl -X POST "https://pupagsqvhhshecxmbgay.supabase.co/functions/v1/gateway/data" \
  -H "x-app-id: app_xxxx" \
  -H "x-client-key: pk_…" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "select",
    "table": "todos",
    "columns": ["id", "title", "done"],
    "where": { "done": false },
    "orderBy": [{ "column": "created_at", "direction": "desc" }],
    "limit": 20
  }'

Filters accept an equality shorthand or an operator object:

// equality shorthand
{ "where": { "done": false } }

// operator object
{ "where": { "title": { "ilike": "%ship%" } } }
{ "where": { "created_at": { "gte": "2026-01-01" } } }
{ "where": { "status": { "in": ["new", "open"] } } }

Responses return { rows, rowCount } for reads and writes, or { count } for counts. Supported actions: select, insert, update, delete, count.

Your end users are first-class: accounts are created inside your project's own Postgres (baas_users), sessions are tokens, and every scoped query is forced to the token's identity at the execution layer — not in client code.

curl -X POST "https://pupagsqvhhshecxmbgay.supabase.co/functions/v1/gateway/auth/signup" \
  -H "x-app-id: app_xxxx" -H "x-client-key: pk_…" \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]", "password": "password123"}'

# → { "user": { "uid": "<uuid>", "email": "[email protected]" }, "token": "…" }

# subsequent scoped calls:
curl -X POST "https://pupagsqvhhshecxmbgay.supabase.co/functions/v1/gateway/data" \
  -H "x-app-id: app_xxxx" -H "x-client-key: pk_…" \
  -H "Authorization: Bearer <user-token>" \
  -H "Content-Type: application/json" \
  -d '{"action": "select", "table": "todos"}'

Buckets hold files on S3-compatible storage. Uploads stream through antivirus scanning, and any stored image can be resized and re-encoded on the fly — no batch jobs, no CDN plugin.

# 1. create the bucket (once per bucket)
curl -X POST https://forgebase-api-z6xv.onrender.com/api/buckets \
  -H "X-Api-Key: fbk_live_…" \
  -H "Content-Type: application/json" \
  -d '{"name": "media"}'

# 2. upload (multipart, AV-scanned)
curl -X POST https://forgebase-api-z6xv.onrender.com/api/files/upload \
  -H "X-Api-Key: fbk_live_…" \
  -F "bucket=media" -F "[email protected]"

# → { "file": { "id": "<uuid>", "bucket": "media",
#               "scanStatus": "clean", "isImage": true } }

# serve a 400×300 cover-cropped WebP, transformed on the fly
curl "https://forgebase-api-z6xv.onrender.com/api/files/<file-id>/raw?w=400&h=300&fit=cover&fmt=webp" \
  -o hero_400.webp

Also available: GET /api/files/:id/download for Content-Disposition downloads, POST /api/files/zip to stream a ZIP of many files, and POST /api/files/presign for short-lived direct upload URLs.

Subscribe to platform events and receive deliveries signed with an HMAC-SHA256 signature so your server can trust them.

curl -X POST https://forgebase-api-z6xv.onrender.com/api/webhooks \
  -H "X-Api-Key: fbk_live_…" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://yourapp.com/hooks/forgeyn", "events": ["file.uploaded", "file.deleted"]}'

The signing secret is shown exactly once at creation. Verify deliveries by hashing the raw body:

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyForgeynSignature(rawBody: string, header: string, secret: string) {
  const expected = "sha256=" + createHmac("sha256", secret).update(rawBody).digest("hex");
  return (
    header.length === expected.length &&
    timingSafeEqual(Buffer.from(header), Buffer.from(expected))
  );
}

Use POST /api/webhooks/:id/test to fire a signed ping event at your endpoint and inspect the delivery.

Base URL https://forgebase-api-z6xv.onrender.com. Authenticate every call with your key in the X-Api-Key header. Keys are scoped — grant the minimum:

Full endpoint map:

Errors use one envelope everywhere: { error: { code, message, details } }.

The CLI is the fastest way to drive the management API from a terminal or CI.

npm install -g forgeyn-cli

forgeyn login             # email + password, or:
forgeyn login --api-key fbk_live_…

forgeyn projects create my-app --region aws-eu-central-1
forgeyn db sql my-app "create table notes (id serial primary key, body text)"
forgeyn apps create my-app web   # → app_xxxx + pk_… + sk_…

forgeyn-mcp is a Model Context Protocol server that lets AI agents (Claude, Cursor, Zed, …) operate your Forgeyn Base account directly — authenticated with a scoped access token, Supabase-style. Email and password are never exposed to the agent.

1. Create a token: forgeyn keys create agent -s projects:read -s projects:write -s sql:run -s keys:write. 2. Connect — pick whichever fits your agent:

URL:     https://forgebase-api-z6xv.onrender.com/mcp
Header:  Authorization: Bearer fbk_live_…

# It is plain JSON-RPC over HTTP — from any agent:
curl -X POST https://forgebase-api-z6xv.onrender.com/mcp \
  -H "Authorization: Bearer $FORGEYN_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

{
  "mcpServers": {
    "forgeyn": {
      "command": "npx",
      "args": ["-y", "forgeyn-mcp"],
      "env": {
        "FORGEYN_ACCESS_TOKEN": "fbk_live_…",
        "FORGEYN_API_URL": "https://forgebase-api-z6xv.onrender.com"
      }
    }
  }
}

Add --read-only to expose only safe tools, and note the destructive tools (delete_project, revoke_app) should always be user-confirmed.

Every failure — both planes — returns the same envelope with a stable, machine-readable code:

{
  "error": {
    "code": "invalid_client_key",
    "message": "Invalid BaaS Client Credentials: expired token",
    "details": null
  }
}

Current managed defaults — generous for production apps, enforced server-side per account:

Rate limiting is per identity (API key or gateway app), not per IP, and returns 429 with the standard error envelope. Need more? The limits are configuration — talk to us about the Scale plan.

Why the data model fits: payment platforms live on ACID transactions, unique constraints for idempotency keys, double-entry balance tables and append-only ledgers — exactly what Postgres enforces natively. And because every Forgeyn Base project gets a dedicated Postgres (no shared schema, no noisy neighbors), a fast-growing product scales its database without touching anyone else's.

Bottom line: the same Postgres primitives Stripe runs on — full ACID, constraints, JSONB, parameterized access through one hardened API — are what Forgeyn Base hands you on day one. Today's managed quotas are tuned for indie-to-SaaS scale; the architecture (isolated Postgres per project behind a stateless API) is deliberately the pattern you'd keep as you grow.