Docs

Flat-priced backend for AI-built apps on Cloudflare. One subscription, hard caps instead of overage bills.

Agents can read the same pages as Markdown, starting from llms.txt.

API

Authentication: dashboard sign-in, email confirmation and password reset, owner second factor, personal access tokens and deploy tokens, auth error codes.
Billing: plans, Stripe Checkout signup, upgrades, downgrades, add-ons, effective limits, failed payments (402 account_locked), cancellation and deletion.
Teams and roles: owner, admin, developer and viewer, seats, invites, and how roles limit tokens.
Usage: this period's usage against each capped limit, pooled across the account or per project, and the warn/capped levels.
Environment variables and secrets: project-wide and per-environment values, overrides, write-only secrets, name rules, next-deploy timing.
Notification preferences: per-member email topics, defaults, and which emails always send.
Files: the file browser API for any environment: buckets, listing with sizes, upload tickets, download links, confirmed deletes, data:read and data:write.
Projects: creating projects, regions, engines and subdomains, provisioning and retries, delete and restore, transfers between accounts.
Custom domains: attaching your own domain, CNAME and apex ALIAS records, automatic TLS, pending/active/failed statuses, per-plan limits, domain_taken.

Apps

How your app is served: what counts as a request, what happens at each limit, read-only and suspended accounts, blocked outbound calls, CPU per request.
Functions and routes: fn(), auth modes, typed input errors, routes under /api and the reserved prefixes, and what ctx offers.
Deploying: what a deploy does, the deploy API, failed and blocked deploys, rollback to the last 20, deploy tokens.
Cron jobs: flatstack/cron.ts and cron(), five-field UTC schedules and macros, per-plan minimum interval (15/5/1 min) and cron_interval_too_short, 30 s timeout, ctx.cron, retries 3 times with backoff, skipped runs when locked or capped, last 100 runs, the jobs and runs API.
Sending email: ctx.email.send fields, default sender, monthly/per-minute/recipient limits and their errors, preview and sandbox policies, templates with preview and test send, the email log, the suppression list, suspension at 5% bounces or 0.1% complaints and appeals, BYO SES.
Sending from your own domain: the one CNAME record, check statuses and diagnostics, DMARC, moving a domain between projects, key rotation, removal.
Data and access rules: table(), owner(), the five access rules and their defaults, ctx.db.asUser() and asAdmin().
Data API: expose: true, /api/data/<table> CRUD under access rules, filters (column=op.value), sorting, paging, body validation, errors.
Postgres: engine: "postgres" on Pro and Studio, same ctx.db code, compute and autosuspend, CU-h caps (0.25 CU at 100%, read-only at 150%), always-on, owner-only connection strings (rotate to see, shown once), IP allowlist, the database API.
File storage: buckets and bucket(), owner means the user's folder, signed direct uploads and multipart over 100 MB, downloads and signed links, cached image transforms (?w=&h=&fit=&format=&q=), ctx.storage, limits and 507 when full.
Security scan: the nine deploy-time checks and their severities, critical findings blocking a deploy, forceInsecure with the project's slug, deploy.blocked and deploy.forced_insecure audit entries, scan output in the API, CLI, MCP and PR comments, OSV dependency check.
Migrations: db diff, applying on deploy or alone, all-or-nothing rollback on D1 and Postgres, destructive changes and --allow-destructive, conflicts, the migrations API.
Importing an app: what the Supabase, Lovable Cloud, Clerk, Vercel, Resend, Base44, Firebase, InstantDB and Postgres importers will bring across and what needs you; not available yet.