PocketBase

Overview

PocketBase is an open-source backend packaged as a single binary (or a Go framework), providing an embedded SQLite database, real-time subscriptions over SSE, file storage, built-in authentication, and a dashboard. It auto-generates a REST-ish API for every collection. The project is still pre-1.0 (v0.40.x at the time of writing): backward compatibility is not guaranteed between releases, so read the changelog before upgrading and pin the version you deploy.

Instructions

Run it

• Download the zip for your platform from the GitHub Releases page, check it against checksums.txt from the same release (sha256sum -c --ignore-missing checksums.txt), unzip it, and run ./pocketbase serve. It listens on http://127.0.0.1:8090: the API is under /api/, the dashboard under /_/, and files in pb_public/ are served as static content.
• Create the first superuser from the installer link printed on first start, or with ./pocketbase superuser create admin@shop.dev 'a-long-password'. (Older material says "admin"; since v0.23 the term is superuser.)
• The binary manages pb_data/ (database, uploads, backups; keep it out of git), pb_migrations/ (collection changes as JS files; commit them) and, if you create it, pb_hooks/.

Collections and API rules

• Collection types: base (standard CRUD), auth (users with password, OAuth2, OTP, MFA), view (read-only, backed by a SQL query).
• Every collection has five rules: listRule, viewRule, createRule, updateRule, deleteRule. A rule that is null ("locked") means superusers only; an empty string means anyone, including guests; a non-empty string is a filter expression the request must satisfy, e.g. @request.auth.id != "" && author = @request.auth.id.
• Rules double as filters on list requests, so a list returns only the rows that match, not a 403.