Open-source · Self-hosted · Postgres-nativePoint it at the database you already run. Nothing to provision, nothing copied, nothing migrated — your schema is the only input.
No signup for the demo. Yours is one command away:
Teams shipping products on our tools — Rebase and FireCMS
01·The first five minutes
02·Code as Truth
One TypeScript file per collection is the entire input. The database schema, the REST API, the typed SDK, the forms and every admin view come out of it — and change with it.
import type { PostgresCollectionConfig } from "@rebasepro/types"; export const products: PostgresCollectionConfig = { name: "Products", slug: "products", table: "products", properties: { name: { name: "Name", type: "string", validation: { required: true }, }, category: { name: "Category", type: "string", enum: { electronics: "Electronics", fashion: "Fashion", home: "Home & Garden", }, }, price: { name: "Price", type: "number" }, in_stock: { name: "In Stock", type: "boolean" }, image_url: { name: "Image", type: "string", url: true }, }, };
→ generates Admin views · forms · DB schema · REST API · Typed SDK
03·What your app talks to
A typed SDK for your collections, REST over every table, and realtime on a WebSocket — plus auth, storage and backups, running against your database from minute one.
Fully type-safe SDK with IDE auto-complete. Schema changes update your types automatically.
Filtering, sorting, pagination and relation expansion on every collection, over plain REST.
Live data subscriptions, broadcast channels, and presence tracking — all over WebSocket. Build chat, dashboards, and collaborative UIs without any extra infrastructure.
04·Two products, one definition
The backend and the panel are separate products that share a schema. Ship headless today and add the panel the day a human needs to touch the data — or never. Whichever half you leave out, the API answers exactly the same.
REST, auth, storage, realtime and backups over your database. No UI, no React anywhere in the dependency tree.
What your app talks to
Click a layer to see what it adds.
Your dependencies
What you get
Identical in every configuration above. The layers change what a human can see — never what your app can call.
05·The back office
Tables, forms, relations, media, roles and workflows — every screen already laid out, and usable by the people on your team who will never open your repo.
A tour of the panel: filtering, inline editing, relations and uploads — running against the same API your app calls.
Track who changed what. Compare versions side by side. Revert with one click.
CSV, JSON, or Excel — automatic field mapping in, one-click export out.
Bring your own React components to completely transform how fields look and behave in the admin.
06·Security-first
Row-level security written in the same TypeScript file as the collection, compiled into real Postgres policies. Granular per collection, per field, per role — and enforced by the database itself, not by middleware someone has to remember to call.
MIT-licensed, end to end — the schema editor, the generated APIs, the typed SDK, all of it. Your data stays in your Postgres: no vendor dependency, no per-seat pricing, no surprises.
rls-check runs against any Postgres — Supabase, Neon, RDS or your own server — and reports what is actually exposed: tables served with row-level security switched off, policies that are true for everyone, views that read straight past the RLS on their base tables.
Read-only by construction: it opens a read-only transaction and runs catalog queries. It writes nothing, and no data ever leaves your machine.
$ npx @rebasepro/rls-check $DATABASE_URL rls-check 0.1.2 · read-only Row-Level Security audit ──────────────────────────────────────────────────────────────── Database db.acme.internal:5432/production Server PostgreSQL 16.4 Platform Supabase Scanned 3 schemas · 41 tables · 26 policies · 14 checks CRITICAL ──────────────────────────────────────────────────────────────── [critical] rls-disabled public.invoices public.invoices has row-level security disabled and is granted to anon and authenticated Impact Any client holding the anon key can read — and write — every row in this table. Fix ALTER TABLE public.invoices ENABLE ROW LEVEL SECURITY; [critical] policy-always-true public.documents, policy "documents_read" USING (true) grants every row to every role the policy applies to. HIGH ──────────────────────────────────────────────────────────────── [high] view-bypasses-rls public.billing_overview The view runs as its owner, so it reads past the RLS on public.invoices. ──────────────────────────────────────────────────────────────── Summary 2 critical · 1 high · 3 medium · 0 low
07·Built for the agent era
An AI agent can scaffold a backend in an hour. It can't tell you whether that backend is safe. Agents are extremely good at producing plausible backends — and famously bad at producing secure ones. Rebase makes the safe outcome the only outcome, by construction.
And the surface it has to get right is small: one TypeScript file per collection, no React in it, no endpoints to hand-write, no ORM layer to keep in sync. The schema is the API, and the permissions live in Postgres — where an agent's mistake gets rejected by the database instead of shipped.
Implement intelligent features seamlessly without cluttering your core codebase.
Inject custom collections and backend listeners directly into your codebase. The AI callbacks execute on database events within your local project files.
Configure database webhooks in the Rebase Studio UI. Route write triggers directly to decoupled Hono custom functions to invoke LLM logic asynchronously.
Native pgvector with cosine, L2 and inner-product distance. Query embeddings straight over REST — no separate vector database to run.
Agents made day-one code cheap. What stayed expensive are the day-30 problems: RLS correctness, backups, migrations, realtime consistency. Rebase isn't the boilerplate your agent would have written anyway — it's the operational guarantees it can't.
08·Built for real products
From marketplaces to SaaS platforms and internal tools — three very different products, the same definition underneath.
Vector Design Tool · Built by the Rebase team
Our own product: a fast, in-browser vector editor with cloud sync. Dadaki runs on a completely standard Rebase backend — the same auth, storage, and generated APIs every project gets.
dadaki.comDigital Pain Therapy
A certified digital medical device delivering AI-personalized pain therapy. Rebase runs the entire backend — patient records, therapy plans, the exercise content library, and the clinical dashboards on top of them.
medicalmotion.comMarketplace & Job Portal
A two-sided marketplace connecting sustainability professionals with green companies. Rebase powers both sides of the market: role-based auth, typed matching APIs, and the moderation back office.
sustentalent.com01/03
Every answer links to the page that proves it.
PostgreSQL is the primary focus — Rebase goes deep on Postgres so every feature (RLS, enums, constraints, relations) works natively. That said, the architecture is database-agnostic and can be adapted to other databases. You bring your own database instance; self-hosted Rebase never sees or copies your data.
Property types and Postgres mappingAbsolutely. Point Rebase at any Postgres connection string and it will read your tables, columns, foreign keys, enums, and constraints to generate a complete admin panel. Existing data appears instantly — no migration, no duplication, no schema re-definition needed.
How the schema pipeline worksThe admin panel is a React 19 SPA built with TypeScript and Tailwind CSS. The backend is a lightweight Node.js service that connects directly to your PostgreSQL database. No SSR, no monolithic framework.
Architecture overviewYes. Rebase is distributed as npm packages. You can mount the entire admin panel inside your existing React application, or deploy it as a standalone SPA. It's designed to be embeddable.
Extension mechanismsUnlike Retool, Rebase is open-source with no per-seat pricing lock-in, and it's a real React framework you can extend with your own code. Unlike Supabase, Rebase connects directly to your existing Postgres database — no new infrastructure to manage, no vendor-managed instance. You keep the database; Rebase is what runs in front of it.
Side-by-side comparisonsYes. The entire framework is free and MIT-licensed — the schema editor, data import/export, user management, generated APIs, typed SDK, and every feature ships at no cost, fully self-hosted. Optional paid plans add enterprise support, SSO/SAML, and SLAs; see pricing.
Read the MIT licence on GitHubYes. SSO, SAML, and advanced enterprise authentication are supported. Enterprise plans with dedicated support and SLAs are available — reach out to talk through your requirements.
Authentication docsWe ship fast. Here is where we are going in the coming months.
Three ways to run it.
Pick the one that matches how you already deploy.
One command against the Postgres you already have. No account, no container to pull, nothing to sign up for.
Docker, Fly, Railway, Hetzner or bare metal. Your data stays in your infrastructure and never reaches us.
Managed hosting. We run our own products on it first — early access goes out from the waitlist, oldest first.
