Everything in the binary
This is the exhaustive list. For the shape of the product, see the homepage. This page exists for the "does it do X" question, grouped so you can scan it in one pass.
Collections & data
A collection is a real SQL table, and the query surface over it is a filter language compiled straight into the query plan — not an ORM layer in front of one.
Dynamic collections
Define fields through the API/dashboard; Cratebase creates and migrates the real SQL table for you.
POST /api/collectionsField types
Text, number, bool, email, url, date, select, JSON, relation, file, password, geoPoint, and more.
API rules
A small filter-expression language (owner = @request.auth.id) for list/view/create/update/delete access, enforced in SQL.
listRule, viewRule, ...Filter syntax
The same expression language powers rules, ?filter=, and RPC WHERE clauses — learn it once.
Full-text search
?search= on any collection — SQLite FTS5 or Postgres tsvector + GIN, kept in sync automatically as fields change.
?search=espressoCustom SQL RPC
A named, parameterized, rule-gated SQL endpoint for the GROUP BY, window function, or PostGIS query a filter can't express.
cb.rpc(name, params)Geo & nearest queries
geoDistance(...) radius filters and nearest-first sorts, GiST-indexed automatically once PostGIS is installed.
sort=geoDistance(...)Database extensions
Enable Postgres extensions — PostGIS, pgvector, pg_trgm — from the dashboard, one API call away.
GET/POST/DELETE /api/db/extensionsBatch API
Several record create/update/upsert/delete calls in one HTTP round trip and one SQL transaction — all commit or none do.
POST /api/batchRecords API
List, filter, sort, expand relations, and paginate any collection over a consistent REST shape.
Schema as code
Pull the live schema to a checked-in JSON file, push it back with a dry-run plan that flags destructive changes.
cratebase schema pull / pushTypegen, built in
One TypeScript type per collection, generated by the binary itself — CLI, REST endpoint, or a --dev watch.
cratebase typegenAuth & security
Any collection can be type: "auth" and gets a full session model for free — registration is just creating a record.
Password auth
auth-with-password and auth-refresh, with email verification and password reset built in.
Email OTP
Passwordless sign-in with a one-time code — always answers 200, even for an unknown address, so it can't enumerate accounts.
Magic link
A single-use sign-in link instead of a password or a typed-back code.
TOTP 2FA
RFC 6238 authenticator-app 2FA with backup codes, layered onto any first factor.
OAuth2 presets
Google, Apple, GitHub, Microsoft, Discord, GitLab, Facebook, X, LinkedIn, Slack, Twitch, Spotify — built in.
Generic OIDC
Point Cratebase at any OpenID Connect issuer that isn't one of the built-in presets.
MFA
A challenge-based second-factor gate shared by TOTP and any other MFA method a collection enables.
Sessions
JWT-based sessions with refresh, independent of which first factor was used to sign in.
Cookie sessions (SSR)
The official SDK's standard SSR pattern — a fresh client per request, auth hydrated from a cookie — works unmodified.
Linked accounts
Manage multiple OAuth providers linked to the same record.
Superuser impersonation
A superuser can mint a session as another user for support/debugging, audited.
New-location login alerts
_authOrigins tracks known sign-in origins and emails on a new one.
Bans
Suspend an auth record without deleting it.
API keys
Dashboard-minted keys as ordinary identities — for agents, CI, and services.
Settings → API keysTeams
_teams / _team_members for scoping an app collection to a workspace via rules.
_team_membersSuperusers & roles
The _superusers collection and how superuser-only endpoints are gated.
Email platform
An editable _emailTemplates collection with a real visual editor — not an HTML textarea — and a send API a frontend can call directly.
Visual template editor
Headings, buttons, columns, images, a theme tab, and live preview, built on React Email Editor.
Send API + sendRule
cb.mails.send(...) is callable from a signed-in or anonymous app user when a template's sendRule allows it.
cb.mails.send(...)No-code triggers
Fire a template automatically on a record create/update/delete, no hook file required.
Mail log
Every send — API, trigger, or hook-originated — is logged to _mailLog.
SMTP & Resend
Pluggable delivery backend: Resend's API, plain SMTP, or log-only for local dev.
Files & storage
Local disk by default; switch to any S3-compatible bucket with three environment variables.
Local or S3 storage
AWS S3, Cloudflare R2, Backblaze B2, or self-hosted RustFS/MinIO — one driver swap.
Presigned direct uploads
Upload straight to storage and claim it with a single-use token — no multipart round trip through your server.
cb.files.upload(file, { collection, field })Image transforms
?w=&h=&fit=&format=&q= on the files route, independent of the existing thumbnail sizes.
Per-user storage quota
Cap the bytes an auth record may store via the direct-upload flow, scoped by an ownerField.
Realtime
Subscribe to a collection or a single record over SSE; get events as they happen, filtered server-side by the same rules as everything else.
Live subscriptions
create/update/delete events over a streamed fetch response — no EventSource polyfill, works server-side too.
GET /api/realtimeCross-node on Postgres
LISTEN/NOTIFY fans events out across app instances — a write on one reaches a subscriber on another.
Presence & notifications
Presence tracking and in-app notification channels on the same realtime connection you already have.
Automation & extending
Drop a *.pb.js file next to your data directory and get PocketBase's own hook API, plus cron, queue, and webhooks.
JS hooks
onRecordCreate/onRecordUpdate-style lifecycle hooks and routerAdd for custom endpoints, on an embedded QuickJS runtime.
onRecordCreate, routerAddJS migrations
pb_migrations/*.js with PocketBase's migrate(up, down) API — apply, revert, or scaffold from the CLI.
cratebase migrate up/down/createCron jobs
A _cron_jobs record is a schedule plus raw SQL, reactive with no redeploy.
_cron_jobsQueue
An opt-in durable job queue with retry-with-backoff and stale-job reclaim.
_queue_jobsOutgoing webhooks
Signed HTTP callbacks on record events, verifiable on the receiving end.
X-Cratebase-SignatureIncoming webhooks
A worked pattern for verifying an inbound HMAC-signed webhook (Stripe and friends) from a JS hook.
Push notifications
Web Push, FCM, and APNs, via _push_subscriptions.
_push_subscriptionsRust plugins
Extend the server itself without forking it, for the cases a JS hook genuinely can't reach.
ZIP export
Export a collection's records and files as a ZIP archive.
AI
Vector search, an LLM chat gateway, and auto-embedding, backed by the same collections and API rules as everything else — not a bolt-on.
Vector search
A vector field and nearestTo(...) similarity search over your own collections.
nearestTo(pb, collection, field, vec, opts)Auto-embedding
Write text, get an embedding computed automatically on create/update.
LLM chat gateway
Stream a chat completion over the realtime connection you already have.
chat(pb, messages, { onDelta })MCP server
Runtime tools (call_rpc, send_email, search_nearby) and superuser dev tools (schema, rules, logs, SQL) over MCP.
POST /api/mcpDashboard & operations
Embedded at compile time — cratebase serve is the whole deployment, and every setting is configurable from it.
7 tabbed setting groups
Application, Email, Auth & security, Database, Automation, Integrations, and Logs — one page per group.
Onboarding checklist
A dismissible walkthrough on the dashboard home: app identity, mail delivery, auth, backups, rate limiting.
API docs tab
Every collection's own endpoint reference, generated from its live schema and rules.
SQL console
A superuser-only console for the query a filter or RPC can't express, right in the dashboard.
Backups
Streaming backups to local disk or S3, with a documented restore path.
Metrics
Prometheus exposition, unauthenticated and outside /api by design.
GET /metricsRequest logs
Structured request logging to a separate SQLite file, with configurable retention.
Deploy & portability
SQLite by default; Postgres when you need it. Same API, same filter syntax, same rules, either way.
SQLite or Postgres
One environment variable switches backends — no code change, no migration to rewrite.
DATABASE_URL=postgres://...One binary or Docker
The admin dashboard is embedded at compile time; ghcr.io/cratebasehq/cratebase ships multi-arch on every release.
Horizontal scaling
What's safe to run behind a load balancer, and what LISTEN/NOTIFY buys you on Postgres.
Security hardening
Rate limiting, the one-time setup token, sandboxed file serving, and security headers — all on by default.
S3-compatible storage
AWS S3, R2, B2, or self-hosted MinIO/RustFS, configured with three environment variables.
Reverse proxy & TLS
A documented nginx/Caddy config for terminating TLS in front of cratebase serve.
Configuration reference
Every environment variable, including Postgres/S3/rate-limiting setup.
Didn't find it?
The docs cover more than fits a feature grid — or ask in an issue on GitHub.