The platform
Every project starts production-ready.
None of this is a starter template you inherit and then maintain. These are properties of the platform answering your requests, which is why they stay true after the fifth change as well as the first.
Users and access
Live before you define your first entity. Nothing here is a template you copy into a repo and then own.
Authentication
Accounts, Google sign-in, one-hour access tokens and rotating refresh tokens. Sign-up and sign-in exist in a project the moment it does.
Tenant isolation
Records are scoped to their customer by the platform, on every endpoint, with no opt-in and no policy to author. A cross-tenant read returns 403.
Agent authentication
Agents connect over OAuth 2.1 with PKCE and register themselves. No key to copy, and access is revocable per agent. Tested end to end with Claude and Codex.
API keys
For CI, scripts, and anything that cannot open a browser. Same server, same tools, same tenant scoping.
Your data model
Defined once, by you or by your agent, and enforced everywhere the API touches it.
Validation
Types, required fields, enums, lengths, uniqueness, min and max, regex patterns and decimal precision, all from the same definition.
Relationships
Typed references between entities, single or multiple, with target fields projected inline on read and nested writes up to three levels deep.
Formula fields
Computed values from other fields on the same record, declared as a sandboxed expression. No custom code to write or deploy.
Filtering and facets
Filter, sort, paginate and count by facet straight off the collection endpoint, backed by an index the platform maintains.
Writing and reading at volume
The operations that usually mean a custom endpoint somewhere else.
Bulk writes and reads
Send a JSON array to a collection URL to create, update, delete or upsert up to 100 records in one call, with a per-item result for each. Read many by id in one request.
Atomic counters
Increment a number or append to a list against the stored value in a single write, with min and max enforced there, so stock levels and counters never race or go negative.
File storage
Presigned uploads and short-lived download URLs, with files attachable from your own entities. No bucket to wire up.
Soft delete
A delete flips status and cascades to nested children. Records drop out of reads and are never purged underneath you.
Your own logic, and what you can see
Where the platform stops deciding and you start, plus the means to find out what happened.
Functions
Your own Python on an entity's request lifecycle, on any method including GET, before or after, sync or async. Webhooks and third-party integrations are functions.
Custom endpoints
Non-CRUD routes you shape yourself, backed by functions, with auth and tenant scoping still applied, or deliberately public for a form or webhook target.
Request and function logs
Per-request and per-execution logs sharing one request id, so a failure inside a function traces back to the call that caused it.
Live OpenAPI spec
A current, accurate spec generated from the definition. Your agent reads your API instead of guessing at it.
How your agent operates it
The part that makes the rest of this reachable from a prompt.
MCP server
Create entities, add fields, define functions and inspect a project through typed tools. The agent operates the backend; it never edits backend files, because there are none.
No deploy step
An entity's endpoints are live the moment it exists. There is no build, no migration to run, and nothing to promote.
The API your agent reads
Every entity gets REST endpoints the moment it exists, with no deploy step, and the OpenAPI spec is generated from the same definition. Your agent reads the spec rather than guessing at the shape of your own API, which is the difference between it writing a client that works and one that compiles.
When you do need your own code
Aaly Functions run your own Python on an entity's request lifecycle, on any method including GET, before or after the request, synchronously or not. Webhooks and third-party integrations are functions. Custom endpoints give you non-CRUD routes backed by those functions, with the platform's auth and tenant scoping still applied, or deliberately public when you need a form or webhook target that accepts anonymous calls.
What is not here yet
No realtime or push updates, and that one is not on the roadmap. No scheduled or recurring execution, no roles or field-level permissions inside a tenant, no CSV import or export, no cursor pagination, and search is exact or prefix matching rather than full-text or fuzzy. The full list, with a workaround for each → What shipped recently →
All of it is on every plan, including the free one.
Plans differ on volume: requests, projects, tenants and storage. They do not gate features.
Start building free