Introduction

• 1 binary
• SQLite inside
• TypeScript on Bun
• MIT

$curl -fsSL https://get.vaultbase.dev | sudo sh

Copy

Quick start → GitHub

Vaultbase hasn’t reached 1.0 yet

Vaultbase is moving quickly, and until 1.0 we don’t promise that every upgrade is drop-in. A 0.x release can change behaviour your app depends on, and now and then an upgrade asks you to adjust a rule, a setting or a client call by hand. Every such change is listed under Upgrade notes in the changelog — read it before you upgrade.

It’s ready for prototypes, side projects and internal tools today. For anything where downtime or an unplanned migration would really hurt, hold off for now — or pin a version and upgrade on your own schedule, changelog in hand.

Why Vaultbase

A backend you can ./vaultbase and forget about. No database to provision, no auth service to wire up, no file storage to configure. One binary does it all, with a built-in admin UI.

Collections Real SQL tables Per-collection tables, not JSON blobs. Native indexes and ALTER TABLE diffs when the schema changes. Auth Every sign-in you need Email and password, OAuth2, OTP and magic links, MFA / TOTP, anonymous sessions, admin impersonation. Realtime Subscribe to anything WebSocket topics for a collection, a single record, or * for everything. Files Local, S3 or R2 MIME and size validation, thumbnails, and per-field protection with one-time, IP-bound tokens. Hooks Server logic, edited live Before / after hooks, custom HTTP routes and cron jobs, written and saved from the admin UI. Single binary One file to ship A self-contained binary for Linux, macOS and Windows. No native dependencies alongside.

What’s in the box

REST API

List, get, create, update and delete with filter, sort, nested expand, field projection, skipTotal and batch

Collection types

base, auth and view (read-only, SQL-backed), each a vb_<name> table with native indexes

Rules

An expression language with typed autocomplete in the admin UI

OAuth2

Google, GitHub, GitLab, Apple, Microsoft, Facebook, X (Twitter), Discord, Twitch, Spotify, LinkedIn, Slack, Bitbucket, Notion, Patreon, plus generic OIDC

Email

SMTP plus verify, reset and OTP templates with {{var}} interpolation

Encrypted fields

AES-GCM at rest via VAULTBASE_ENCRYPTION_KEY

Webhooks

HMAC-signed delivery on record events, retry budget, dead-letter trail, SSRF egress guard

Feature flags

Boolean, string, number and JSON flags with targeting rules, sticky percentage rollout and variations

Cron jobs

UTC schedules, Monaco editor, run-now button, last-run status

File protection

Per-field download rules, requireAuth, single-use and IP-bound tokens, a files.download audit row per fetch

Logs

JSONL files per UTC day, kept 30 days by default, JSONPath search

Audit log

Append-only record of admin actions, with admin UI and REST query API

Sessions

List active admin sessions, revoke per token, or force-logout everyone

Brute-force lockout

Per-email and per-IP failed-login throttle

Rate limiting

Per-IP token bucket, configurable per route

CORS

Per-origin allow-list edited from Settings

Password policy

Length and character classes, with an optional HIBP k-anonymity check

Metrics

Prometheus exposition at /api/v1/metrics with optional bearer auth; /_/ready readiness probe

Backups

SQLite snapshot plus JSON schema snapshot; vaultbase backup --to s3://… writes straight to object storage

Signed releases

Every binary keyless-signed with Sigstore cosign, with a CycloneDX SBOM; --verify-sig checks before installing

MCP

A first-party Model Context Protocol server, so AI agents can work with your data through scoped API tokens

Update checker

Polls GitHub releases and shows a banner in the admin

Get started

From source

bun install && (cd admin && bun install)   # the admin has its own dependencies
bun run build   # → ./vaultbase
./vaultbase     # starts on :8091; open localhost:8091/_/ for the setup wizard

Walk through the Quick start for your first collection, or read Installation to run the signed binary on a server.