Production-ready · Auth · REST · Realtime · Storage · Vector · Edge · Jobs · Obs

The open-source backend
your frontend was waiting for.

Pluto ships a complete Backend-as-a-Service — authentication, auto-generated APIs, realtime, storage, vector search and edge functions — behind a typed SDK and an admin dashboard. Run it on your laptop with docker compose up, or one-click deploy to Fly, Railway or Render.

Launch Admin Console View SDK API Docs

~ / pluto-quickstart

auto

$ git clone pluto-baas && cd pluto-baas && docker compose up -d
$ pluto status --url /api/pluto
→ probing modules...
filtersortsearchshowing 8 / 8
module              status   latency   http   try
──────              ──────   ───────   ────   ───

canonical modules

shipped migrations

40+

API route modules

official SDKs (JS, Python, Go, CLI)

Core modules

Everything your app needs, already wired.

Eight canonical services, all namespaced, all versioned, all covered by integration tests.

/auth

Authentication

Email/password, magic link, phone OTP, OAuth (Google, GitHub), MFA (TOTP), SAML SSO. JWT + refresh, session revocation.

/data-api

Auto REST + GraphQL

Instant CRUD endpoints from Postgres tables. Filters, ordering, pagination, RLS enforced per JWT claim.

/realtime

Realtime v5

WebSocket subscriptions, presence, ordered broadcast, sharded rooms, backpressure policies.

/storage

Storage v4

Public/private buckets, signed URLs, resumable uploads. Local disk or S3-compatible (MinIO, R2, S3).

/edge

Edge Functions v7

Deploy TypeScript handlers to isolates. KV, queues, secrets, cron triggers.

/vector

Vector v3

pgvector-backed HNSW indexes, hybrid rerank (linear/RRF), streaming embeddings.

/jobs

Jobs & Workflows

Durable multi-step workflows with step ledger, retries, side-effect idempotency.

/obs

Observability v3

Structured logs, request-id tracing, Prometheus metrics, per-tenant usage & quotas.

Typed SDK

Two lines of setup. Then you're shipping.

One @pluto/js works from React, Vue, React Native and Node — plus first-party Python, Go and CLI SDKs. Same surface as Supabase-JS.

install@pluto/js v0.1.0step 1 of 2 · takes ~10 seconds

# JavaScript / TypeScript / React / Vue / React Native / Node

# ── Option A · npm registry (recommended, works everywhere) ──────────
npm  i @timescard/pluto-js
bun  add @timescard/pluto-js
pnpm add @timescard/pluto-js

# ── Option B · Direct tarball (no npm account needed) ────────────────
# Pinned + immutable (1-year CDN cache):
npm  i https://backend-joy.lovable.app/sdk/download/pluto-js-0.1.0.tgz
# Always-latest (short cache + ETag revalidation):
npm  i https://backend-joy.lovable.app/sdk/download/pluto-js-latest.tgz

# ── Verify the tarball before installing (SHA-256) ───────────────────
curl -fLO https://backend-joy.lovable.app/sdk/download/pluto-js-0.1.0.tgz
echo "789097fdbc4d5d081e5599b9171c0d7eb396cd2558ec1364ce292be238a88c2a  pluto-js-0.1.0.tgz" | sha256sum -c -
#   pluto-js-0.1.0.tgz: OK        ← must print OK
npm i ./pluto-js-0.1.0.tgz

# Machine-readable hashes for every release:
#   https://backend-joy.lovable.app/sdk/download/manifest.json

# Python
pip install pluto-sdk

# Go
go get github.com/pluto-baas/pluto/sdks/go/pluto

app.ts@pluto/js · step 2 of 2

import { createClient } from "@pluto/js";

// 1) Initialize once — createClient(url, publishableKey)
const pluto = createClient(
  "https://api.timescard.cloud",
  import.meta.env.VITE_PLUTO_PUBLISHABLE_KEY!, // Dashboard → API keys
  { auth: { persistSession: true, autoRefreshToken: true } },
);

// 2) Sign in with email + password
const { data, error } = await pluto.auth.signInWithPassword({
  email: "ada@example.com",
  password: "hunter2",
});
if (error) throw error;

// 3) Grab tokens — send access_token as "Authorization: Bearer <token>"
const accessToken  = data.session?.access_token;
const refreshToken = data.session?.refresh_token;

// 4) Any authenticated REST call the SDK makes now carries the Bearer token
await pluto.from("posts").select("id,title");

// Sign up + reset + listen
await pluto.auth.signUp({ email: "ada@example.com", password: "hunter2" });
await pluto.auth.resetPasswordForEmail("ada@example.com");
pluto.auth.onAuthStateChange((event, session) => {
  console.log(event, session?.user?.email);
});

Anon key + service-role key: Dashboard → API. CORS whitelist your frontend origin at Dashboard → CORS before going live.

Admin dashboard

A control panel, not just a placeholder.

Every module has a real UI. Manage keys, whitelist origins, edit schemas, revoke sessions — without touching SQL.

Projects & Keys

Anon + service-role keys per workspace with copy-safe minting.

CORS whitelist

Per-project allow-list — no wildcards in production.

Database Studio

Visual table editor, SQL runner, migrations timeline.

RLS & RBAC

Native Postgres RLS policies + role registry, tested end-to-end.

User Management

List users, revoke sessions, assign roles, manage MFA.

Health & Verify

/readyz + one-click smoke run of every canonical endpoint.

Explore the dashboard

For SaaS builders

Built for teams shipping their own SaaS.

Whether you're a solo founder, an agency, or a regional team — Pluto gives you a Supabase-grade backend without the lock-in.

Indie founders

Ship a real backend on your side project without an egress-cost surprise or a rug-pull.

Postgres + auth + storage from day 1
Predictable $29/mo Pro tier
Full data export any time

Agencies

One backend you resell to every client. Per-workspace isolation, custom domains, no lock-in.

Multi-workspace admin
Bring-your-own-domain
Self-host or managed — same SDK

Bangladesh & South Asia

Local latency, local pricing, local support. Host in Dhaka or Singapore, invoice in BDT.

BDT tier with bKash/Nagad (soon)
Bangla + English docs in-app
Community support in Messenger

Read the full go-to-market playbook at docs/GO-TO-MARKET.md.

Pricing

Free to self-host. Fair when you scale.

Pluto is MIT-licensed and free forever on your own hardware. Managed cloud plans are per-project — no per-seat surprises.

Self-Hosted

Run Pluto on your own hardware, VPS, or Kubernetes cluster.

FreeMIT licensed · forever

All 8 canonical modules (Auth, REST, Realtime, Storage, Vector, Edge, Jobs, Obs)
Unlimited projects, users, and API calls
Docker Compose stack (Postgres + MinIO + API + Dashboard)
34 shipped SQL migrations · RLS + RBAC out of the box
Community support via GitHub issues

Deploy: Docker · Any VPS · Kubernetes

Start Self-Hosted setup

Managed hosting

We run Pluto for you on dedicated infrastructure with SLA and priority support.

Contactcustom quote per workload

Dedicated VPS or cloud region of your choice
Managed Postgres backups + point-in-time restore
TLS, WAF, and DDoS-protected edge (Cloudflare / Fly)
SAML SSO · audit log export · on-call support
Custom quotas, migration help, and on-boarding

Deploy: Any cloud · Fly · Render · dedicated infra

Talk to us

Self-hosted বাসাতেই সব features free — MIT license। Managed hosting চাইলে যোগাযোগ করুন — আমরা আপনার workload অনুযায়ী quote দেব।

Deploy anywhere

Your infrastructure. Your data.

Config files ship with the repo — pick a target and go live in minutes.

Docker Composelocal

docker compose up -d

Fly.iorecommended

flyctl deploy

Railway1-click

railway.json ready

Render1-click

render.yaml ready

Any VPSdiy

Caddy + systemd

FAQ

Answers before you ask.

Common questions from teams evaluating Pluto against Firebase and Supabase.

How does Pluto handle CORS?

Every project has a strict allow-list managed in Dashboard → CORS. No wildcards in production. Preflight is served by the API, and disallowed origins are rejected before they hit any module. Add your published frontend origin (e.g. https://backend-joy.lovable.app) before going live.

What is Row-Level Security (RLS) and how do I use it?

Pluto uses native Postgres RLS. Every request sets a Postgres session with the JWT claims (sub, role, workspace_id), so policies like posts.owner = auth.uid() run server-side. The Dashboard ships a policy editor and end-to-end regression tests so bad policies are caught before deploy.

How is realtime implemented?

Realtime v5 is a WebSocket gateway with sharded rooms, presence, ordered broadcast and backpressure. It piggybacks on Postgres logical replication for row-change events (subscribeTable) and adds application-level channels for chat, cursors and presence.

Is pricing per-project or per-workspace?

Cloud plans are billed per project. A workspace can hold many projects, each on its own plan. Self-hosted is free forever regardless of workspace or project count.

How do I deploy Pluto?

Four common paths: (1) docker compose up -d locally; (2) flyctl deploy using the shipped deploy/fly.toml; (3) Railway 1-click via railway.json; (4) Render blueprint via render.yaml. All four boot the same image and pass /readyz before serving traffic.

Can I migrate from Firebase or Supabase?

Yes. The Data API mirrors PostgREST semantics, so Supabase-JS query patterns port directly. For Firebase, use the Pluto CLI import command to move Auth users and Firestore collections into Postgres tables.

Ready when you are

Stop stitching backends together.

Spin up Pluto, point your React app at it, and get back to building features your users care about.

Open Dashboard Try the SDK demo

The open-source backendyour frontend was waiting for.