Table of Contents
🌏 中文版
Appwrite is an open-source BaaS for Auth, Databases or TablesDB, Storage, Functions, Realtime, Messaging, and Sites through client and server SDKs, REST, GraphQL, and WebSockets. Teams can use Appwrite Cloud or deploy the same product line themselves.
Client and server APIs have different authority
Client SDKs use user sessions, and resource permissions govern rows and files. Grants can target users, teams and roles, labels, authenticated users, or guests. Client-created resources receive creator defaults, while Console or Server SDK resources without explicit permissions are inaccessible to clients.
Server SDKs use scoped API keys and can bypass resource permissions. That enables administration and magnifies key leaks. When a backend acts for a user, prefer a short-lived JWT preserving user permissions; reserve minimally scoped API keys for genuine administration.
Realtime inherits the session at subscription time
Realtime sends only events the subscriber can read. Authenticate before subscribing and recreate subscriptions after session changes; the existing connection does not gain a new identity automatically. Role.any() exposes updates to every client, even if transport is WebSocket.
Design TablesDB rows, relationships, queries, indexes, and transactions around access patterns; Storage has separate bucket and file permissions. Workflows spanning data, files, messages, and external APIs are not one transaction, so use status records, outboxes, idempotency keys, and compensation.
Functions are a trusted boundary, not infinite workers
Functions run from SDK or HTTP calls, platform events, webhooks, or schedules. Code updates create deployments and one becomes active. Minimize execute access, dynamic API-key scopes, and environment variables. Deduplicate payments, email, and transformations because asynchronous events can retry.
Appwrite operates Cloud. With self-hosting, the team owns databases, storage backends, workers, runtimes, SMTP or SMS, proxies, TLS, migrations, monitoring, capacity, and backups. A running Compose stack is not production readiness; rehearse restoration of data and platform state.
Appwrite fits web and mobile teams wanting a complete BaaS API with cloud and self-host choices. Compare Supabase or Nhost for SQL and RLS, Firebase for Google's mobile ecosystem, and PocketBase for a smaller single-host system. Test permission denial, session changes, function redelivery, migration, database and file restoration, and upgrade rollback.
References
Loading...