BackendStudio 1.0 · read-only by defaultNEW

Connect a database.
Get a backend.

Point BackendStudio at your PostgreSQL, MySQL, or SQLite database. It reads the schema and serves a REST API with OpenAPI docs from your Mac — no code to write, nothing to deploy. Read-only until you grant write access, one table at a time.

$ curl localhost:8080/api/users
7-day free trial Runs entirely on your Mac No account required
BackendStudio
Databases
Local Encryption
AES-256 Enabled
Tables (5)
users
orders
teams
api_keys
sessions
URI:postgresql://admin:••••••••@db.internal:5432/app_production
Read-only
1SELECT
2 users.id,
3 users.email,
4 count(orders.id) as total_orders,
5 SUM(orders.amount_usd) as life_value
6FROM users
7JOIN orders ON users.id = orders.user_id
8WHERE orders.status = 'completed'
9GROUP BY users.id
10ORDER BY life_value DESC
11LIMIT 3;
Results Grid Success in 1.42ms
idemailtotal_orderslife_value
usr_8fa2sarah.k@stripe.com14$2,480.00
usr_9b1calex@indiehackers.net8$1,120.00
usr_2d7ed.heinemeier@37signals.com6$890.00
Bring your own database

Three engines,
one API shape.

PostgreSQL, MySQL, and SQLite each get the same generated REST API, so the endpoint you call does not change when the database does. Redis and MongoDB are browsable in the app, but deliberately not served over HTTP — see below for why.

Full backend
Latency:REST + OpenAPI

PostgreSQL

Tables and views become REST endpoints, with types preserved: numerics stay numbers, NULL stays null, and NUMERIC never degrades into a float.

Workspace Highlights
Schema read in one query
Filter, sort, paginate
Fetch by primary key
Full backend
Latency:REST + OpenAPI

MySQL

Same API surface as Postgres. Connect over TCP or a socket, and the schema BackendStudio reads is the schema it will validate every request against.

Workspace Highlights
Tables and views exposed
Per-table write grants
Bound parameters only
Full backend
Latency:REST + OpenAPI

SQLite

Open a file, get an API. The file is opened read-only and is only reopened for writing once you grant a table — so a browse session cannot alter it.

Workspace Highlights
No server to run
Read-only unless granted
Good for demos and tests
Browse only
Latency:No REST API

Redis

Browse keys, hashes, and sorted sets from the app. There is no REST API for Redis: without tables and columns there is nothing to validate a request against.

Workspace Highlights
Key and type browser
TTL inspection
Not served over HTTP
Browse only
Latency:No REST API

MongoDB

Browse collections and nested documents from the app. Like Redis, it stays out of the API: a document store has no fixed schema to check a request against.

Workspace Highlights
Collection browser
Nested field expansion
Not served over HTTP
Core capabilities

The backend you would
have written anyway.

Listing rows, filtering, paginating, fetching by id, writing the OpenAPI spec, remembering to parameterize — the same code every project starts with. BackendStudio derives it from your schema instead.

An endpoint for every table

Filter on any column, sort, paginate, or fetch a single row by primary key. Types survive the trip: an integer arrives as a number, a NUMERIC keeps its decimal places, and SQL NULL comes back as null instead of an empty string.

Tables and viewsStable paginationNo SQL in the request
REQUESTGET localhost:8080
RESPONSE200 OK
{
  "rows": [
    {
      "id": 1,
      "email": "alice@example.com",
      "plan": "pro",
      "mrr_usd": 49.00,
      "canceled_at": null
    },
    {
      "id": 2,
      "email": "bob@example.com",
      "plan": "free",
      "mrr_usd": 0.00,
      "canceled_at": null
    }
  ],
  "count": 2
}

Docs you did not write

An OpenAPI 3 document is generated from the same schema that serves the data, so it cannot drift from reality. Open the Swagger page and try a call, or hand the spec to a client generator.

/openapi.json● LIVE
"/api/users/{id}": {
  "get": {
    "parameters": [
      { "name": "id",
        "in": "path",
        "required": true,
        "schema": {
          "type": "integer" } }
    ],
    "responses": { "200": … }
Paths appear only for tables you have chosen to expose.

Writes are opt-in, per table

Granting one table says nothing about the rest. Until you flip a switch, POST, PATCH, and DELETE do not exist — and a PATCH or DELETE with no filter is refused rather than applied to every row.

WRITE ACCESS
submissionsREAD + WRITE
usersREAD ONLY
invoicesREAD ONLY
Switching databases clears every grant.

Locks, and a log to check them

Require an API key, list the origins allowed to call from a browser, and reach a database behind a bastion over SSH with the host key pinned. Then watch what actually arrives — method, path, status, and duration, with a p95 that only appears once there is data behind it.

Constant-time key compareCORS allow-listPinned host keys
REQUEST LOGp95 4.1 ms
GET/api/users?limit=502002.4ms
GET/api/invoices/88212001.9ms
POST/api/submissions2015.2ms
DELETE/api/users4000.3ms
GET/api/secrets4040.2ms
$ curl -H 'x-api-key: $KEY' …/api/users
The 400 is an unfiltered DELETE being refused.
Intuitive Developer Flow

Unified workflow
from schema to deployment.

Streamline your architectural operations with a workspace built specifically to integrate with your local CLI and Git repositories.

01. Connect

About a minute

Point it at a database

Enter your connection details, or open a SQLite file. BackendStudio reads the schema — tables, views, columns, types, primary keys — and that introspected schema becomes the contract every later request is checked against.

Under the hood
TCP, socket, or SSH tunnel
Credentials go to the Keychain
Host keys are pinned

02. Choose what is exposed

Read-only by default

Hide tables, grant writes

Everything starts read-only. Hide the tables that are none of the caller's business, then grant write access to the few that need it. The API only ever advertises what you actually turned on.

Under the hood
Per-table write grants
Unfiltered DELETE refused
Grants cleared on DB switch

03. Start serving

No deploy step

Hand someone a URL

Press Start and the API is live on your local network, with a Swagger page and an OpenAPI spec beside it. Watch requests land in the log with status codes and p95 latency while a frontend is built against it.

Under the hood
Swagger UI included
Optional API key and CORS list
Live request log
Safe by default

Your database, your machine.
nothing leaves it.

BackendStudio is not a proxy and has no cloud component. It connects straight from your Mac to your database and serves requests from that same machine. There is no account to create, and no analytics SDK in the app — the privacy manifest declares zero data collection and zero tracking.

Read-only until you say otherwise

A fresh connection serves GET and nothing else. Write access is granted one table at a time, and the API never advertises a write method you have not enabled. With SQLite, the file itself is opened read-only until a table is granted.

No SQL over HTTP. Ever.

There is no endpoint that accepts a query. Every table and column name in a request is checked against the schema BackendStudio read from your database, and every value travels as a bound parameter — never as text pasted into a statement.

Credentials in the Keychain

Passwords, SSH keys, and connection details live in the macOS Keychain, not in a config file. They are never included in an API response, an error message, or a log line — not even when a connection fails.

Locked doors fail shut

Turn on auth without setting a key and requests are refused rather than waved through. API keys are compared in constant time, CORS answers only origins you listed, and an SSH host key that does not match the one you pinned aborts the connection.

No account. No telemetry. No cloud.Your data never reaches a server we operate, because there is not one.
NO ANALYTICS SDKKEYCHAIN-BACKED CREDENTIALSAPP SANDBOX
Predictable Pricing

One app.
three ways to pay.

Every option is the same app — the only difference is how you pay. The trial is 7 days with nothing held back; after it ends the app still opens and your connections are still there, but serving requires a subscription.

Monthly

Try it on a real project. Cancel whenever.

$5.99/ month

7-day free trial

  • PostgreSQL, MySQL, and SQLite
  • A REST endpoint for every table and view
  • OpenAPI 3 spec and Swagger UI, generated live
  • Per-table write access, off by default
  • API key auth and a CORS origin allow-list
  • SSH tunnels with host key pinning
  • Request log with status codes and p95 latency
RECOMMENDED

Yearly

$4.00 a month, paid once a year.

$47.99/ year

Save 33% — about four months free

  • PostgreSQL, MySQL, and SQLite
  • A REST endpoint for every table and view
  • OpenAPI 3 spec and Swagger UI, generated live
  • Per-table write access, off by default
  • API key auth and a CORS origin allow-list
  • SSH tunnels with host key pinning
  • Request log with status codes and p95 latency

Lifetime

One payment. Every future version included.

$119.99once

Nothing renews

  • PostgreSQL, MySQL, and SQLite
  • A REST endpoint for every table and view
  • OpenAPI 3 spec and Swagger UI, generated live
  • Per-table write access, off by default
  • API key auth and a CORS origin allow-list
  • SSH tunnels with host key pinning
  • Request log with status codes and p95 latency
Common Inquiries

Frequently asked questions

Everything you need to know about security, schemas, offline workflows, and licensing.

BackendStudio reads your schema and immediately serves a REST endpoint for every table and view — list, filter, paginate, and fetch by primary key. Alongside it you get an OpenAPI 3 spec and a Swagger UI page, so you can hand a frontend developer a URL instead of writing a backend. Nothing is generated on disk and there is no build step.