Lesson 1 / 96 min read
Architecture overview
Where a generated app runs, how it reaches data, and what the boundaries are.
Layers
Generated app
Single-file HTML (inline CSS/JS)Sandboxed iframe, opaque originwindow.devany SDK is injected
Bridges (same-origin)
/api/data · /api/user · /api/auth/api/assets · /api/mail · /api/ai · /api/hookCSP: connect-src is its own origin only
Data and authorization
Postgres + row-level securitySigned session token (HMAC)Background functions for long work
The path of a data call
devany.db.list()
From inside the app
Same-origin bridge
Token travels in the body
Signature verified
Inside the database function
Only that app's data
Cannot reach beyond scope
What's available, what isn't
| Status | |
|---|---|
| Cloud database (JSON collections) | |
| File/image storage | |
| Transactional email | |
| End-user accounts | |
| localStorage / sessionStorage | |
| External API / CDN calls |
Key takeaways
- The app runs in a sandboxed iframe on its own origin.
- All bridges are same-origin; CSP blocks exfiltration.
- Authorization comes from verifying the signed token inside the database.
Related topics
Still stuck? Ask the assistant in the corner, or browse the FAQ.