One server. Every backend.

Your data, beautifully organised.

Create isolated SQLite backends with their own schemas, users, rules, APIs, realtime streams, and backups.

SQLiteisolated storage

Realtimelive events

One binarysimple deploys

Private by design · Built for focused teams

Lightweight databases · APIs · functions

Control plane

Welcome back

Sign in to manage your databases and APIs.

Workspace name

Workspace address From your workspace name

/api/db/

This is your database address. It is generated from the name above.

Email address

Password 12+ characters

Secure, same-origin access

Lightweight Apps, Databases, APIs & FaaS

Workspace

Databases

?

—

Workspace / Overview

Your databases

Notifications

Multi-database workspace

Build without boundaries.

Every database is physically isolated, independently authenticated, and ready for its own application.

Create a database

Launch an isolated SQLite backend with its own API, users, and access rules.

Name

API slug Lowercase and hyphens

/api/db/

Description (optional)

Start from (optional)

Copies another database's collections, functions, schedules and app draft — no records, users or files.

Import a database

Restore a backup bundle (with files) as a brand-new database. It gets a fresh service key and never overwrites an existing database.

Name

API slug Lowercase and hyphens

/api/db/

If this slug already exists, drop that database first — imports never overwrite.

Backup bundle (.zip)

Create a collection

Define a typed record schema and independent API access rules.

Collection name

Fields

API access rules

List

View

Create

Update

Delete

Edit access rules

Change who may read and write this collection through the public API.

List

View

Create

Update

Delete

Add a field

Add a new field to .

Field name

Type

Options

One choice per line. Records may only store these values.

Selection

Files

Max size (MB)

Allowed types

Comma-separated MIME types. Use image/* to allow any image.

Thumbnail sizes

Comma-separated WxH specs for image thumbnails. 0 means auto; add f to fit instead of crop.

Related collection

Records

Records store ids from the related collection.

Default value

Stored in the column definition and used whenever a record omits this field. Existing records receive it too. File, relation, and multiple-choice fields cannot have one.

Required Needs a default value—SQLite cannot add a NOT NULL column to a table that already holds records without one.

Added fields are never unique—SQLite cannot add a unique column to a table that already holds records. Define unique fields when creating the collection.

Rename collection

Rename . Relation fields that reference it update automatically.

New name

Delete every record?

This removes all records from , along with any files they hold. The collection and its schema stay. This action cannot be undone.

Type to confirm

Delete this collection?

This permanently drops and every record it contains. This action cannot be undone.

Type to confirm

Edit field

Edit in .

Name

Type Allow several values

Records hold several values — keep which one?

The others are discarded. This cannot be undone from here.

Default value

Required Records without a value are filled in from the default, so a field with empty records needs one before it can be required.

Changing Required or the default rebuilds the table—SQLite cannot alter a column in place. Existing records are copied over.

Delete this field?

This permanently drops and its data from . This action cannot be undone.

Add a record

Create a new item in .

Delete this record?

This permanently removes the record from . This action cannot be undone.

Record

Add a user

Create an application identity scoped only to this database.

Email address

Display name

Shown by this database's app when it credits the records this user created. Leave blank and they appear as “Anonymous” — the email address is never published.

Password

At least 10 characters.

Email verified Allow the account to be treated as already verified. Administrator of this app Satisfies collection rules set to admin, and may manage this app's own users and sign-up policy from inside the app. It grants nothing in this dashboard and no access to any other database. Appoint the first one here; afterwards the app can appoint its own.

Delete this user?

Their sessions and pending authentication tokens will be removed immediately. Collection records they own are retained.

User

Generate a permissions scaffold

Creates a closed permissions collection and a function with the role lookup already written. Your own rules go in the marked section afterwards.

Roles

Comma separated, lowercase, letters and underscores. These are your app's roles, stored as data — separate from the Takhzeen administrator flag on a user.

Role that may manage accounts

The generated accounts branch checks for this role. Added to the list above if it is not already there.

Collection name

Function name

Add a superuser

Create another person with full control-plane access.

Email address

Initial password 12+ characters

Role

SuperuserFull access to every database and server setting. MemberManages only the databases assigned to them.

Assigned databases

Members see and manage only the databases checked here.

Superusers can manage every database, user, function, schedule, backup, and server setting.

Set a new password

Changing the password revokes every active session for this superuser.

Superuser

New password 12+ characters

Confirm action

Superuser

Assigned databases

Choose which databases this member can see and manage.

Member

New function

Choose Go or Python and build an isolated database function.

Function name

Language

Description (optional)

Source code takhzeen.local/function/takhzeen

Read JSON input from stdin. Write output to stdout. Use the imported Call helper for database capabilities.

Time limit

App access

Who may call this from a published app or form.

Account access Lets this function read and change this app's user accounts through users.* — including who is an administrator. Leave off unless the function needs it. Combined with public app access, a mistake here can create accounts, so this stays visible rather than hidden in the source.

Run

Supply the JSON event that the function will read from stdin.

JSON input

New schedule

Run a function or create a database backup automatically.

Schedule name

Job

Function

JSON input

Cron expression

Five fields: minute, hour, day, month, weekday. Interval descriptors such as “every 15m” are also accepted.

Timezone

Schedule enabled The next run is calculated and persisted as soon as this schedule is saved.

Delete ?

Send a test email

Confirm your saved delivery settings with a real message.

Recipient

Subject

Body

This uses the currently saved mail settings. Save any changes before sending.

Save your service key

This key is shown only once. Store it securely before closing this window.

Service key

Delete this database?

The database will be moved to Takhzeen’s trash directory. Its public API will stop responding immediately.

Type to confirm

Takhzeen

Version 0.23.0

One server, every backend — lightweight apps, databases, APIs, and functions in a single binary.

What's inside

Isolated SQLite databases

Typed collections & access rules

Per-database users & auth

Google / OIDC social sign-in

No-code & uploaded web apps

Go & Python functions (FaaS)

Cron schedules & backups

Realtime event streams

Relation expand on reads

Workflows: state machines & editor

v0.23.0 An app can have administrators of its own: mark a user as an administrator and they satisfy collection rules set to admin, and can manage that app's users and sign-up policy from inside the app — with no dashboard account and no reach into any other database.Pages can be marked administrators only, functions can be given account access to build a richer role model, and the Permissions scaffold writes the role-checking boilerplate for you.
v0.22.7 Published apps load faster: text files are gzipped, and content-hashed build output such as assets/index-DYkmLB72.js is cached by the browser for a year.A git-served app keeps its mapped commit between requests instead of reopening the repository for every file; index.html and unhashed files are still revalidated, so a rollback takes effect.
v0.22.6 A git-served app is fully described by its repository: app/app.json carries git mode, the site directory and the build function, and the push that sets them deploys.Templates: a new database, or every self-registered workspace, can start from another database's collections, functions, schedules and app draft.
v0.22.5 A umsg document can be read and written on its own at …/umsg/{field}, up to 16 MiB by default, and a patch or write no longer sends the whole document back.Realtime events carry a umsg field's length instead of the document, and ?fields= keeps lists and records to the fields you ask for.
v0.22.4 A database can be set up without git or a shell: upload a takhzeen/ folder as a zip under Configuration, see exactly what it will change, and apply.Apps and scripts can do the same with the database service key at /config/plan and /config/apply, and download a database's configuration from /config/export.
v0.22.3 Batch create: POST …/records/batch creates up to 500 records in one request and one transaction, so an import either lands whole or not at all.Each record is checked against the create rule and stamped with its owner as a single create would be, and realtime still sees one event per record.
v0.22.2 A json field reads back as the value written: an object as an object, not its JSON text in a string.A string written to a json field stays a string, so it can no longer be mistaken for the list or object it spells.
v0.22.1 A desktop or mobile app's loopback sign-in (http://127.0.0.1:PORT) works without configuration, instead of silently landing on the panel.Any other redirect a sign-in cannot return to is refused when the flow starts, naming TAKHZEEN_OAUTH_NATIVE_REDIRECTS.
v0.22.0 Conditional writes: every record carries a _revision, and a save or delete sent with If-Match is refused with 412 if someone changed the record first, instead of silently overwriting their work.Functions pass the same revision to records.update and records.delete and get a StaleRecordError back, and the dashboard's record editor uses it too.
v0.21.0 A database can close self-service registration: auth/register is refused, and a first social sign-in no longer creates an account.Existing users keep signing in and can still link a provider to the account they have; operators issue new accounts from the database's Users list.
v0.20.2 Git-hosted apps can be any size the repository holds; the 8 MB ceiling was a limit meant for a database's configuration.Site files stream from the commit as they are served, so a large script is not held in memory for the length of every request.
v0.20.1 A database's git repository can be deleted without deleting the database, its data, or its version history.
v0.20.0 Workflows: named state machines per database, drawn on a canvas or listed as steps in order.A workflow API says which moves are permitted and never performs one, so what happens on a move stays in the application.Booleans read back as booleans rather than 1 and 0, which a client checking its own flag depended on.
v0.19.0 Functions can authorise a file transfer: files.ticket returns a short-lived URL for one field of one record.Files reach 64 MiB with no base64 and no 1 MiB invoke cap, so a closed collection can hold media only the right people can fetch.
v0.18.0 Apps serve straight from a database's git repository: push the deploy branch, with no bundle to build or upload.Publishing records a commit, so rolling back to an earlier one is instant and needs no force push.
v0.14 Desktop OAuth: loopback redirects receive the session token as query parameters per RFC 8252, completing sign-in for native apps using a local listener.
v0.13 OAuth sign-in forwards the provider's avatar alongside the display name, so apps can seed a user's profile photo.
v0.12 Relation expand on record reads: GET ?expand=field embeds referenced records inline, view-rule enforced, so clients avoid N+1 lookups and denormalized copies.
v0.8 Control-plane Google sign-in.Self-service registration, each signup provisioned its own isolated database.
v0.7 Google (OpenID Connect) login for a database's end-users, with client secrets encrypted at rest.
v0.6 File field type with thumbnails.Backups bundle uploaded files.Database import and migration, and in-place schema editing.

Generate pages

Scaffold ready-to-use List, View, New, and Edit pages from your collections.