Auth & access control

Auth and access rules, built in.

Magic-link email, 25+ OAuth providers, generic OIDC for any IdP, guest sessions, and API keys are built in. Policy expressions live next to your schema and gate every row in the hot path.

Create your account →Read the docs
schema.ts — a policy
import { policy } from "@pylonsync/sdk";
 
const messagePolicy = policy({
  name: "message_access",
  entity: "Message",
  allowRead: "true",
  allowInsert: "auth.userId != null and data.authorId == auth.userId",
  allowUpdate: "false",
  allowDelete: "data.authorId == auth.userId",
});
  • Magic-link, Google / GitHub / Apple / Microsoft / Discord / Slack and 20+ more
  • Generic OIDC discovery for any enterprise IdP; SAML SSO on Cloud
  • Guest sessions and API keys for public apps and machine clients
  • Row-level policies compile to bytecode and run on every read and write

How it works.

providers
Magic linkGoogleGitHubAppleOIDC
session · auth.userId set

Turn on magic-link and a wall of OAuth providers from the same auth() block. Generic OIDC discovery means any IdP that publishes a discovery document works without a bespoke integration. Guest sessions let anonymous users interact before they sign up; API keys authenticate scripts and machine clients.

What you’d otherwise wire up.

Each line is a piece teams normally assemble for this one capability. On Pylon it is part of the runtime.

  • A hosted auth provider and its SDK on every client
  • Session storage, refresh, and revocation handling
  • Route middleware that re-checks permissions on each endpoint
  • A second rules language for row-level access

Apps built with it.

Scaffold any of these with npm create @pylonsync/pylon.

All examples →
liveMarketplace

A trading marketplace deployed from a monorepo, with listings, watchlists, an activity feed, faceted search, and per-user ownership.

Faceted searchfield.owner()Optimistic inserts
template: marketplaceOpen
SaaS starter

A complete SaaS product with a marketing site, onboarding, a multi-tenant dashboard, and Stripe billing. Reach for this one to build a product.

Stripe billingMarketing + dashboardOnboarding
template: saas
Consumer app

A social feed with live posts and likes, public reads, and owner-only writes.

Live feedPublic readsfield.owner()
template: consumer
Keep exploring
Database
Typed schema. Migrations on save.
Server functions
Backend logic in TypeScript.
Sync engine
Live queries over WebSocket.

Build it on Pylon.

One framework for your schema, sync, auth, functions, realtime, and SSR. Free to start.

Create your account →Read the docs