Backend as a Service

Appwrite57.5k★

Appwrite gives you auth, database, storage, functions, and messaging as a single self-hosted backend platform, so you don't have to build it all from scratch. It's an open source Firebase: one service instead of stitching together five. The self-hosted version is free with all features under BSD-3-Clause. Appwrite Cloud has a free tier (75K monthly active users, 2GB storage, 5GB bandwidth, 750K function executions) and a Pro plan from $25/mo per organization that lifts you to 200K MAU with dedicated resources and unlimited team members. Self-hosting runs via Docker Compose. The install script handles everything, but you're running 15+ containers (database, cache, workers) and the resource requirements are real: 4GB+ RAM minimum. Solo developers: the Cloud free tier is generous enough for most side projects. Small teams: self-host for unlimited everything, or take Cloud Pro at $25/mo. Larger teams that need SLAs, SSO, and 24/7 support are into custom Enterprise pricing, which is the point where self-hosting on your own infrastructure starts to look a lot cheaper. The catch: Appwrite tries to be everything, auth, database, storage, functions, messaging, real-time. Jack of all trades. If you need any one of those at depth (complex queries, advanced auth flows, heavy file processing), you'll hit limitations before you would with a specialized tool. It's excellent for MVPs and small-to-medium apps. For complex production systems, you'll likely outgrow parts of it.

PostgREST27.7k★

PostgREST turns a Postgres database into a REST API without you writing one. Point it at your schema and every table, view, and function becomes an endpoint, with permissions decided by the roles and row-level security already defined in the database. MIT licensed, free, and a single small binary. It is also the API layer inside Supabase, which is about the best production reference you could ask for. Running it is light. One stateless binary or the official Docker image next to Postgres 14 or later, scaled horizontally when you need more. It does not do HTTPS, so it sits behind Nginx or another reverse proxy. Auth is JSON Web Tokens mapped to database roles, minted inside the database or by an outside service. Free at every size, with no paid edition. The real decision is where your logic lives. With PostgREST, validation and permissions are SQL: grants, policies, views, functions. Teams fluent in Postgres move fast. Teams that are not should look at supabase/supabase, which wraps PostgREST with auth, storage, and a dashboard, or directus/directus for an API plus an admin UI. The catch: the schema cache goes stale when you change the database, so you reload it with a NOTIFY or a signal. And one sloppy grant on the anonymous role exposes data to the internet. Your DBA is now your API security team.