# Baselyra > A self-hosted backend-as-a-service: Postgres with row level security, an auto-generated REST API over any table, authentication, file storage, realtime over WebSockets and an admin Studio, running as two containers — one Node process and one Postgres — in a few hundred megabytes of RAM. Apache-2.0, no telemetry, no vendor account. Authorisation is Postgres row level security, not application code: every request runs as `anon`, `authenticated` or `service_role` with the verified JWT claims published to the session, and the policies decide the rest. Sign-in is email and password, magic links, one-time codes, phone OTP over SMS (Twilio, Vonage, MessageBird, Amazon SNS, Plivo or a generic webhook sender) and OAuth with Google, GitHub, LinkedIn, Facebook, Instagram, TikTok and Envato. Database webhooks and cron-scheduled jobs run inside the same process, queued in the project database. Baselyra does NOT have edge functions, database replication, an S3 storage backend or image transformation. `control.projects` holds a single row that every project lookup resolves through, but nothing creates a second project and the Studio has no project switcher. - [Full documentation as plain text](https://baselyra.sarimtools.com/docs/llms-full.txt): every page below, concatenated. ## Start here - [Baselyra documentation](https://baselyra.sarimtools.com/docs/): Documentation for Baselyra, a self-hosted backend-as-a-service: Postgres with row level security, an auto-generated REST API, auth, storage, realtime and an admin Studio in two containers. - [Getting started](https://baselyra.sarimtools.com/docs/getting-started.html): What Baselyra is, how a request becomes a Postgres query under row level security, and the order to read these pages in. - [Quickstart](https://baselyra.sarimtools.com/docs/quickstart.html): From an empty machine to an authenticated API with row level security in about ten minutes, with every request and response shown. - [Installation](https://baselyra.sarimtools.com/docs/installation.html): Install Baselyra with Docker Compose or straight on a host with Node 22 and Postgres 17, and understand what the boot sequence does. - [Configuration](https://baselyra.sarimtools.com/docs/configuration.html): Every environment variable Baselyra reads, its default, what it changes, and what happens when it is left unset. ## Core - [The database](https://baselyra.sarimtools.com/docs/database.html): What lives in each schema, how a table becomes an API endpoint, which types cross the wire as strings, and how to evolve the schema safely. - [REST API](https://baselyra.sarimtools.com/docs/rest-api.html): The auto-generated PostgREST-compatible API over every table, view and function in public: reading, writing, upserts, RPC, headers and errors. - [Filtering and paging](https://baselyra.sarimtools.com/docs/filtering.html): Every filter operator the REST API accepts, the value grammar, nested logic trees, ordering, paging and the exact errors a malformed filter produces. - [Row level security](https://baselyra.sarimtools.com/docs/rls.html): The authorisation model: how a request becomes a Postgres role, the helper functions that exist today, five complete policy sets, and what happens when RLS is left off. ## Auth - [Auth](https://baselyra.sarimtools.com/docs/auth.html): Sessions, refresh-token rotation and theft detection, email flows, metadata, admin user management, and the line between Studio accounts and application users. - [Third-party sign-in](https://baselyra.sarimtools.com/docs/oauth.html): OAuth sign-in with Google, GitHub, LinkedIn, Facebook, Instagram, TikTok and Envato: configuring a provider, the round trip, identity linking and the redirect rules. - [Phone one-time codes](https://baselyra.sarimtools.com/docs/phone-otp.html): Sign in with a six-digit SMS code: choosing a sender among Twilio, Vonage, MessageBird, Amazon SNS, Plivo or your own webhook, and the limits that protect your balance. ## Services - [Storage](https://baselyra.sarimtools.com/docs/storage.html): Buckets on local disk with MIME allowlists and size limits, uploads and downloads with Range and ETag support, signed URLs, and RLS on storage.objects. - [Realtime](https://baselyra.sarimtools.com/docs/realtime.html): One WebSocket carrying database change feeds, broadcast and presence, with every changed row re-read as each subscriber before it is delivered. - [AI assistant](https://baselyra.sarimtools.com/docs/ai.html): The optional DeepSeek routes: natural language to SQL, query explanation, ask-your-database, and a chat relay your app's users can call without the key reaching a browser. - [Importing](https://baselyra.sarimtools.com/docs/importing.html): One-click import from Supabase, Postgres, Appwrite, Firebase or a pg_dump file — what each source carries, which passwords survive, and how a run behaves. ## Clients - [Client libraries](https://baselyra.sarimtools.com/docs/sdk.html): Which client is official, what the plain-HTTP contract is for every other language, the shared error envelope, and which key belongs where. - [JavaScript client](https://baselyra.sarimtools.com/docs/javascript.html): The complete reference for @baselyra/client: createClient, the query builder, auth, storage, realtime and AI, with no dependencies. - [Next.js](https://baselyra.sarimtools.com/docs/nextjs.html): Working App Router setup: the browser client, three server clients, sessions in server components, sign-in, and a route handler using the service key. - [React](https://baselyra.sarimtools.com/docs/react.html): A Vite setup, an auth hook, a protected route, a live list, and the remount trap that makes every realtime message arrive twice. - [Flutter and Dart](https://baselyra.sarimtools.com/docs/flutter.html): A complete Dart client for Baselyra over package:http and web_socket_channel — auth with refresh, queries, storage and realtime. - [PHP](https://baselyra.sarimtools.com/docs/php.html): A complete PHP client for Baselyra over ext-curl with no dependencies: sign-in, queries with counts, writes and RPC. - [Python](https://baselyra.sarimtools.com/docs/python.html): A complete Python client for Baselyra over requests: auth, queries, upserts, a paginating generator, uploads and signed URLs. ## Tools - [The Studio](https://baselyra.sarimtools.com/docs/studio.html): The admin console shipped at /: data grid, SQL editor, users, files, realtime inspector, API reference, email templates, AI panels and the audit log. - [VS Code extension](https://baselyra.sarimtools.com/docs/vscode.html): Browse the schema, run SQL with diagnostics on the offending token, generate TypeScript types, manage files and watch realtime events without leaving the editor. ## Operate - [Self-hosting](https://baselyra.sarimtools.com/docs/self-hosting.html): Running Baselyra in production: reverse proxies, TLS, email, backups and restores, upgrades, sizing and day-to-day operations. - [Security](https://baselyra.sarimtools.com/docs/security.html): What Baselyra defends and how, what the SQL editor can reach, where each credential lives — and, stated plainly, what is not protected. - [Troubleshooting](https://baselyra.sarimtools.com/docs/troubleshooting.html): The failures people actually hit — an empty result, a silent realtime feed, a missing email, a Studio that will not open — with the cause and the fix for each. - [FAQ](https://baselyra.sarimtools.com/docs/faq.html): Straight answers to the questions people ask first about Baselyra: how it compares, what it does not do, and the decisions that surprise people.