Nexa BaaS

Key Features

• Authentication, users, and permissions (RBAC) Sign-up that starts with email verification (3 approval modes), sign-in and token refresh (rotation and reuse detection), password reset, MFA (TOTP), and Google social login. It also provides user and group management and deny-first (deny > allow > group) permission evaluation.
• Data API + declarative access rules Provides CRUD on collections of JSONB records, with access declared as rules (owner, authenticated, public, permission:key) rather than in code. You can also specify unique constraints that prevent duplicates on a given combination of fields.
• Offline sync Merges offline changes with revision-based delta pull and batch push. Supports 3 conflict policies (last write wins, field merge, server wins), deletion markers (tombstones), and client-generated UUIDs.
• File storage Presigned direct uploads that bypass the server save bandwidth, and large files use resumable multipart uploads. It reuses the same access rules as the Data API, and orphaned files are cleaned up automatically.
• Scheduled push (reminders) Once a device is registered, a single scheduling call sends a push at the time you choose. Scheduling runs on a delay queue (BullMQ), with a delivery ledger and a recovery sweep.
• Webhooks and connectors Events are written atomically to an outbox inside the domain transaction so none are lost, and delivered with HMAC signatures and exponential backoff retries. Provides Slack, Telegram, and KakaoWork connectors, along with delivery history and resend.
• Developer console Sign in with a developer account to create projects, and manage users, the data playground, webhook registration, OAuth credentials, logs, and the usage dashboard on screen.
• Client SDK with 0 dependencies @nexa/sdk runs with no external dependencies. A single sync option on a collection makes it offline-first, and local storage is handled with IndexedDB on the web and an injected SQLite driver on React Native.
• PostgreSQL RLS multi-tenancy Row Level Security isolates data between projects (tenants) at the database level. Every request runs inside a transaction with the tenant context set.
• Plan limits and usage metering The server automatically enforces per-plan limits on user count and storage capacity, and usage is aggregated daily so you can check 7-, 30-, and 90-day trends in the console.
• Per-project OAuth (BYO OAuth) When a developer registers their own Google credentials (stored with AES-GCM encryption), the consent screen shows the developer's app brand. If none are registered, it falls back to the server default.
• Docker self-hosting Use docker compose to start PostgreSQL, Redis, and object storage, then run the API and console. External technologies are wrapped in adapters, so the runtime can be replaced.