Features

Everything included in every plan — limits differ, features don't.

🔐 Authentication

Complete user management for your app.

✅ Email + password sign up / sign in with bcrypt hashing

✅ Email verification via 6-digit OTP (optional per project)

✅ Forgot / reset password flow built-in

✅ JWT access tokens (1 h) + rotating refresh tokens (30 d)

✅ Google Sign-In (pass the Google ID token, we verify it)

✅ Custom claims (roles) set from your server

✅ Brute-force lockout, disable users, sessions revoke

✅ onAuthStateChanged() in the SDK — persists across reloads

🗄️ Database

A JSON document store with the ergonomics you know.

✅ Collections → documents, auto IDs or your own IDs

✅ Auto createdAt / updatedAt / owner fields

✅ add / set / update (merge) / delete / increment

✅ Batch writes (up to 100 ops per request)

✅ Query: where (==, !=, >, >=, <, <=, in, contains, like, startsWith)

✅ orderBy, limit (≤500), offset & page pagination, total count

✅ SQLite per project — isolated, fast, backup = one file

✅ Data browser with inline JSON editing in the console

⚡ Realtime

Live UI without websockets infrastructure.

✅ collection().onSnapshot(docs => …) and doc().onSnapshot()

✅ Server-Sent Events with cursor resume, ≤55 s holds (shared-hosting friendly)

✅ Automatic reconnect; JSON polling fallback for old browsers / Node

✅ Change feed retained per project (create / update / delete / drop)

✅ Owner-scoped realtime respects your security rules

🛡️ Security Rules

Simple, readable, powerful enough.

✅ Per collection or wildcard * rules

✅ Levels: public · auth · verified · owner · admin · none

✅ ownerField lets you customise which field owns a doc

✅ Secret key bypasses rules for trusted servers

✅ Editable JSON with validation in the console, applied instantly

📁 File Storage

Simple uploads for avatars, receipts and images.

✅ storage.upload(file) → { id, url, size, mime }

✅ Public or private (auth-only) files

✅ Size limits per plan, MIME allowlist, image types supported

✅ Stored on your ClickBase server disk, served with cache headers

🧑‍💻 Console & API

Ship, watch, manage.

✅ Projects dashboard with usage bars vs plan quotas

✅ API key + Secret key with rotation and CORS allowed-origins

✅ Users tab: search, verify, disable, reset password, set claims, delete

✅ Logs: auth events, errors, API requests with latency

✅ REST for everything: /v1/{project}/auth|db|realtime|files|admin

✅ CORS enabled, rate limiting per IP, clean error codes

Coming next (Phase 2)

Storage UI · Google login button helper · Import/Export (JSON/CSV) · PHP & Flutter SDK · Usage graphs · Webhooks · Scheduled backups

Start building