Ulabase
Features

Your backend is already written

Sign-up and login, permissions, payments, real-time data — called from React, Angular or Vue, or straight from your iOS and Android app. There is no server of yours to write, deploy or pay for.

$ npm install @ulabase/kit-react
Start free React Starter App

Included In Your Plan

Everything here comes with your service, on the Free tier too.

Switch On Yourself

Enable a feature from your service and it is running. No sales call, no waiting.

Fully Managed

We handle updates, scaling, and maintenance. You focus on building your application.

Secure & Reliable

Enterprise-grade security with the same reliability guarantees as your Ulabase API.

What you get

9 of these are simply there, 7 you switch on when you need them. All of it is included in the price of your service — no add-on fee.

All 16, in every plan

Free included. No add-on fee, and nothing to unlock: you pay for capacity, when your app grows.

Sign up free

Your data

REST API

Fetch, filter, sort and page your collections over HTTP

GraphQL Apps

A GraphQL app is a schema and a mapping you configure — no resolvers to write

Change streams

Your UI updates when the data does — over WebSocket or SSE

Aggregations

Pipelines defined server-side and called by name, so the client sends no query

Indexes

Keep the queries fast as the collection grows

Schemas

Turn away a document that does not match your JSON Schema

Users and access

Authentication

useAuth(): sign in, sign out, and a reload that keeps the session

Permissions

Roles and rules on the server, which the client cannot talk its way past

Sign-up Management

The whole account story, already working. Registration with email verification, Google and GitHub sign-in, password reset, team invitations with roles, multi-tenancy. The screens are in the starter app and the state is in a hook, so what you write is your product.

What you get:
  • useAuth() for sign-in, sign-up, reset and team switching
  • Google and GitHub sign-in with no OAuth code of yours
  • Team invitations with role-based access, and multi-tenancy
  • Email templates you can rewrite

Included in your plan, Free tier included

Documentation React Starter App Angular Starter App Start free

Guards

Rules of your own on top of permissions: a user who has not accepted the current terms, a lapsed subscription, a feature that is not in their plan. Each request is checked in order and the first rule that matches blocks it or redirects it—so the check lives in one place instead of in every screen.

What you get:
  • Conditions over the signed-in user, their team and the request
  • Block with a status code, or redirect to a page of yours
  • Evaluated in order, first match wins
  • Never applied to the service administrator, so you cannot lock yourself out

Included in your plan, Free tier included

Documentation Start free

Origin Allowlist

List the origins your app is served from and a browser request from anywhere else is turned away with a 403. It is the answer to somebody else's page calling your API with your user's session. Server-to-server calls send no Origin header and are unaffected.

What you get:
  • Allow only the origins your app is served from
  • Everyone else’s fetch gets a 403
  • Server-to-server integrations unaffected
  • Edit the list whenever, nothing to redeploy

Included in your plan, Free tier included

Documentation Start free

Integrations

Email

Verification, reset and invitation mail sent for you

Documentation

Webhooks

Say what should happen when a request matches a condition: call an HTTP endpoint, or send a templated email. A welcome message on sign-up, a Slack ping on a new order, another system kept in step—none of it needs a backend of yours to run it.

What you get:
  • Fires on the requests you choose, matched by predicate
  • Calls an endpoint, or sends an email
  • Body shaped with Mustache templates
  • Retries on failure, with a log of every attempt

Included in your plan, Free tier included

Documentation How it works Start free

Stripe

Charge the people using your app, on your own Stripe account. Subscription plans with trials, seats and per-plan limits, or a catalogue of products with orders. The checkout session, the payment events and the refunds are handled for you.

What you get:
  • usePayments() for plans, checkout and order history
  • Subscriptions with trials, seats and limits, or one-off products
  • Payment, refund and dispute events handled for you
  • Test mode and live mode, decided by the keys you set

Included in your plan. Free runs Stripe in test mode; live payments need Shared or above

Documentation Shop Starter App Start free

AI

MCP Server

Publish your service to AI agents over the Model Context Protocol. Collections, aggregations, change streams and GraphQL apps appear as MCP resources, and an agent using them goes through exactly the permissions your own app goes through: there is no second access model to keep in sync. The same server lets a coding assistant set the service up, within the role you give it.

What you get:
  • Collections, aggregations, change streams and GraphQL apps published as MCP resources
  • Agents read and write under the same permissions as your app
  • Nothing is exposed until you publish it
  • Works with Claude, Cursor, VS Code and any MCP client

Included in your plan, Free tier included

Documentation Start free

Your AI assistant already knows this

Add one MCP server and Claude Code, Cursor, VS Code or IntelliJ can read the whole Ulabase documentation — the API shapes, the permissions, the kit, the pricing. The code it writes for you is right the first time instead of guessed.

$ claude mcp add --transport http ulabase-docs https://api.bysophia.ai/mcp/ulabase

It reads our documentation, never your data. Letting an agent reach your own collections is a separate feature, and it is coming.

Already wired up in the starters

The Ulabase Kit is the client for everything above, and it ships for React, Angular and Vue. Clone a starter and sign-up, teams and checkout already work — what is left to write is your app. The Vue package is ready today; its starter is next.

Building for iOS or Android? Everything above is plain HTTPS with a JWT, so Swift, Kotlin, Flutter and React Native call it the same way. The Kit itself is for the web.

Kit documentation React Starter App Angular Starter App Shop Starter App

When not to use Ulabase

Four cases where the honest answer is somebody else

You are not on MongoDB

RESTHeart is built for MongoDB. If your data lives in PostgreSQL or MySQL, look at Supabase or Hasura instead.

You need a protocol we do not speak

REST, GraphQL and WebSocket are what a service exposes. Anything else, and you need more control than this gives you.

You are optimising in microseconds

If the tuning you need is specific to your workload and measured in microseconds, a build of your own will beat a managed one.

You want the infrastructure itself

Kubernetes manifests, your own load balancers, the whole stack in your hands — then self-host the open-source server.

And the rest is a plugin

Everything on this page is built on RESTHeart's plugin framework. If your product needs something that is not here, it is built the same way and runs in your service — tell us what you are missing.

Tell us what you need