MoonDB Blog

How to Add a Backend to a v0 App

Add a backend to a v0 app: see Vercel's Marketplace database options, then point your v0 app at a REST API you own, with a schema and auth in two calls.

Jun 9, 2026 · 8 min read · tutorial

How to Add a Database to a Lovable App

How to add a database to a Lovable app: compare Lovable Cloud and Supabase, then wire your app to your own hosted REST API, with auth, in three calls.

Jun 7, 2026 · 9 min read · tutorial

Database MCP Servers for AI Coding Agents

A database MCP server lets an AI coding agent read and write data over the Model Context Protocol. The two kinds, how they differ, and how to set one up.

Jun 3, 2026 · 9 min read · comparison

Generate a REST API From a JSON Schema (and Host It)

Generate a REST API from a JSON schema, no backend code: define tables in JSON, send one PUT, and get hosted CRUD endpoints, filtering, auth, and storage.

Jun 2, 2026 · 9 min read · tutorial

Copied! Now paste it into your AI agent

# MoonDB Backend

This project uses MoonDB (https://moondb.ai) as its backend.
MoonDB is an API-first DBaaS: you describe your data model in JSON
and get a full REST API, auth, and file storage automatically.

## Setup (do this once)

1. Get the API key (mk_...) — ask the user:
   a) New user: POST https://moondb.ai/v1/accounts/signup { "email": "...", "password": "..." } → returns api_key
   b) Existing user: https://moondb.ai/dashboard → Account → Regenerate key

2. Create a project:
   POST https://moondb.ai/v1/projects
   X-API-Key: mk_...
   { "name": "my-app" }
   Response: { data: { id, admin_key: "sk_...", public_key: "pk_..." } }

3. Set schema:
   PUT https://moondb.ai/p/{project_id}/v1/schema
   X-Admin-Key: sk_...
   { "tables": { ... } }

## Schema Format

Column types: string, text, int, float, bool, date, datetime, json, enum, ref, file

Short-form (string): "type [required] [unique] [index] [default value]"
  "name":     "string required"
  "age":      "int default 0"
  "user_id":  "ref users required"
  "active":   "bool default true"

Object form (for advanced options):
  "status":  { "type": "enum", "values": ["draft", "published"], "default": "draft" }
  "task_id": { "type": "ref", "table": "tasks", "on_delete": "cascade", "required": true }
  "avatar":  { "type": "file", "accept": ["image/*"], "max_size_mb": 5 }

Table options:
  "auth_table": true     — auto-creates email + password_hash, enables /auth/*
  "verify_email": true   — sends verification email on signup
  "access": { "read": "public", "create": "authenticated", "update": "owner", "delete": "owner" }
  "owner_field": "user_id"  — required when access is "owner". Must ref auth table.
    MoonDB compares with user id from JWT — users only access their own rows.
    Auto-filled on INSERT from Bearer token. For auth_table itself use "id".
  "unique": [["col_a", "col_b"]]

Built-in columns (never define): id, created_at, updated_at, email (auth_table), password_hash
on_delete for refs: "cascade" | "restrict" (default) | "set_null"

## REST API

GET    /p/{id}/api/{table}?field=op.value&sort=field.desc&limit=N
GET    /p/{id}/api/{table}/{row_id}
POST   /p/{id}/api/{table}              { ...fields }
PATCH  /p/{id}/api/{table}/{row_id}     { ...fields }
DELETE /p/{id}/api/{table}/{row_id}
POST   /p/{id}/api/{table}/bulk         [ {...}, {...} ]

Response: { "data": [...], "meta": { "total": N, "limit": N, "offset": N, "has_more": bool, "next_cursor": "..." | null } }
Filter ops: eq, neq, gt, gte, lt, lte, like, in, is_null, not_null
Sort:       ?sort=created_at.desc  (multiple: ?sort=col1.asc&sort=col2.desc)
Pagination: ?limit=20&offset=40  (offset)  or  ?limit=20&cursor=eyJ...  (cursor; use meta.next_cursor)
Select:     ?select=id,name  Include related: ?include=user_id

OpenAPI spec: GET /p/{id}/v1/openapi.json  (auto-generated, OpenAPI 3.0.3)

## Auth (when auth_table is set)

POST   /p/{id}/auth/signup           { email, password }             → { data: { token, refresh_token, user } }
POST   /p/{id}/auth/login            { email, password }             → { data: { token, refresh_token, user } }
POST   /p/{id}/auth/refresh          { refresh_token }               → { data: { token, refresh_token } }  (rotates)
GET    /p/{id}/auth/me               Authorization: Bearer {token}   → { data: { user } }
POST   /p/{id}/auth/change-password  { current_password, new_password }  (Bearer token; revokes existing tokens)
POST   /p/{id}/auth/forgot-password  { email, redirect_url }         → sends reset email (always 200; redirect_url must be in project's allowed_redirect_origins)
POST   /p/{id}/auth/reset-password   { token, new_password }         → resets password
       PUT  /p/{id}/v1/redirect-origins  { "allowed_redirect_origins": ["https://myapp.com"] }  (admin key, configure once)

External auth (Clerk, Auth0, Supabase, Firebase, …): PUT /p/{id}/v1/auth-config
Key rotation: POST /p/{id}/v1/rotate-keys | POST /p/{id}/v1/rotate-jwt-secret  (admin key)

Headers: Authorization: Bearer {token} | X-Public-Key: pk_... | X-Admin-Key: sk_...
Token expires in 1 hour. Use refresh_token (30 days) to get a new token.

## File Storage

POST   /p/{id}/storage/upload  multipart/form-data → { data: { id, url, size } }
GET    /p/{id}/storage/{file_id}  → download
DELETE /p/{id}/storage/{file_id}
After upload, store the returned url in the file column via PATCH.

## AI Endpoints

Define in schema: { "ai_endpoints": { "summarize": { "model": "gemma", "prompt": "Summarize: {{text}}" } } }
Call: POST /p/{id}/ai/{name}  { "param": "value" }
Text models: gemma (fast), gpt-oss (intelligent). Image models: flux-schnell (fast), flux-dev (photorealistic).

Every error response has a "suggestion" field — read it to self-correct.