The whole backend, and a way out of it
Scribase runs Postgres, Auth, Storage, Realtime, and Functions, then adds the operations layer that makes it trustworthy: preview branches, import, export, verified restore, and one control surface for humans and agents.
The data plane
The APIs your app already speaks. Your client SDK, CLI scripts, and generated types point at Scribase by swapping the URL and keys.
PostgreSQL database
Real Postgres — SQL, joins, extensions, and row-level security.
A full PostgreSQL instance per project with the relational model you already know: SQL, foreign keys, views, and extensions. Row-level security is first-class, and policies are linted for cost so a slow policy never surprises you in production.
- Standard Postgres connection string plus the /rest data API
- Row-level security with policy-cost linting
- Extensions, views, functions, and full referential integrity
Authentication
Email, OAuth, and JWT auth on a wire-compatible /auth API.
A drop-in auth service on the /auth paths: email/password, magic links, and OAuth providers issuing standard JWTs. User IDs are preserved on import, so existing sessions and password logins keep working after a move.
- Wire-compatible /auth endpoints and JWT claims
- User IDs preserved on import — no forced password resets
- Works unchanged with the standard client auth helpers
Object storage
S3-style buckets with RLS-aware access on the Storage API.
Store and serve files through a wire-compatible Storage API. Buckets honor row-level access rules, and object bytes and metadata travel with every export and import so storage is never left behind.
- Wire-compatible bucket and object API
- Policy-aware public and private buckets
- Bytes and metadata included in export/import bundles
Realtime
Postgres change streams and channels over the Realtime protocol.
Subscribe to database changes and broadcast on channels using the standard realtime protocol. Clients built on existing realtime subscriptions connect without code changes.
- Postgres change data capture on the /realtime path
- Broadcast and presence channels
- Compatible with existing realtime clients
Edge Functions
Deploy server-side functions on the /functions/v1 path.
Run server-side logic close to your data on the open-source Deno edge-runtime, served on the compatible /functions/v1 path. Deploy, list, and invoke functions through the /v1 API and the TypeScript SDK.
- Compatible /functions/v1 routing
- Deploy, list, and invoke over the /v1 API
- Same database and JWT secret as the rest of the stack
Platform and workflow
The operations layer that makes the data plane trustworthy: branching, migration, portability, and verified recovery.
Preview branches
PR-linked preview environments — database, auth, and storage together.
Every pull request can get an isolated preview environment, not just a database branch. Branches are secret-scrubbed and swept on a TTL when the pull request closes, so stale environments never pile up or leak credentials.
- Full preview environments: DB + auth + storage
- Secret-scrubbed and TTL-swept automatically
- Copy-on-write branches with scale-to-zero compute
Import an existing project
Move an existing project in — resumably, with a dry run first.
scribase import connects to a live hosted Postgres project with its ref and service key and moves schema, data, auth.users, storage objects, and RLS policies. Edge functions move from your local functions checkout with --functions-dir. Run it with --dry-run to see exactly what will and will not move before committing.
- Schema, data, auth users, storage objects, and policies
- User IDs preserved so JWTs and foreign keys stay valid
- --dry-run preview and resumable transfers
- Edge Functions deployed from your local checkout with --functions-dir
Full-stack export
Leave with a bundle that actually boots elsewhere.
scribase export produces a runnable bundle — schema, table data, auth identities, storage bytes, RLS policies, grants, and roles — with a checksummed manifest so you can verify the bundle before you trust it. Portability is a product feature, not a support ticket.
- Whole stack, not a database-only dump
- SHA-256 manifest for verification
- Boots on managed Scribase, BYOC, or self-hosted
Verified restore
PITR-class recovery that ships evidence, not just a green checkmark.
Every verified restore comes with proof: row-count parity, SHA-256 checksums, policy parity, and a real login. The same discipline powers export, so "it restored" and "it works" are the same claim.
- Included, not a per-month add-on
- Row-count, checksum, and policy parity evidence
- Login proof after restore
Portable backups
Logical backups with checksums you can carry anywhere.
Backups are portable logical bundles with SHA-256 evidence, aligned with the export format. A backup you can move is a backup you can trust.
- Portable logical format with checksums
- Shares the export/restore verification pipeline
- No proprietary snapshot lock-in
Agents and operations
One control surface for humans and agents, and an operator model built for least privilege and bring-your-own-cloud.
Agent-native control surface
Every mutation has a CLI flag, an OpenAPI operation, and an approval model.
Scribase is designed so an agent can operate it as safely as a person. Every mutation is expressible on the CLI, mapped to an OpenAPI operation, carries an idempotency key, and returns an operation ID — with an approval model for sensitive actions and support for MCP-driven workflows.
- CLI + OpenAPI parity for every mutation
- Idempotency keys and operation IDs on every change
- Approval model and MCP-friendly workflows
Control API and CLI
One authenticated /v1 API and one binary for humans and agents.
The scribase CLI and the authenticated /v1 control API sit over a durable Postgres executor, so operations survive restarts and can be audited by their operation IDs. The same surface manages organizations, projects, environments, previews, branches, migrations, backups, imports, and exports.
- Durable executor — operations survive restarts
- Auditable by operation ID
- Single surface for projects, environments, branches, and migrations
Bring-your-own-cloud
Run the full stack in your own Kubernetes cluster with a Helm chart.
The Helm chart (deploy/helm/scribase) runs the control and data planes in your own cluster with the same verified restore and preview features as the managed cloud. The control plane never requires cluster-admin inside your workloads.
- Helm chart for the full control + data plane
- Least-privilege operator role model
- Same restore and preview features as managed
Point your existing app at Scribase
Change the URL and keys — your existing client SDK, CLI scripts, and generated types keep working. Your data is always yours to export.
Included Verified restore, previews, custom domains, and export — no add-ons.