oneclient
Sign inStart building
Quickstart

A working backend in a few deliberate steps.

Create the project once, then use the same identity from your terminal, application, CI, and agent.

1. Install and sign in

terminalbash
npm install oneclientnpx oneclient login --email you@company.com

The CLI sends a short-lived email OTP and stores the resulting session in your operating system’s credential store when available. It does not ask you to paste a password or permanent API token.

2. Create your first project

terminalbash
npx oneclient init# or non-interactivelynpx oneclient project:create --name "Northline" --slug northline

An organization receives one tightly capped development project before subscription. The CLI reports provisioning state and only presents project URLs as ready when the backend confirms that they are live.

3. Add the TypeScript client

src/oneclient.tstypescript
import { createClient } from "oneclient"; const one = createClient({  baseUrl: process.env.ONECLIENT_API_URL!,  publishableKey: process.env.NEXT_PUBLIC_ONECLIENT_PUBLISHABLE_KEY,}); const session = await one.auth.getSession();

Use a publishable key in browser or mobile code. Use a server key only in a trusted runtime and keep it out of client bundles, logs, repositories, and build artifacts.

4. Define data policy before client access

oneclient.policy.jsonjson
{  "tables": {    "profiles": {      "select": {        "where": ["eq", ["field", "user_id"], ["claim", "auth.user.id"]],        "maxRows": 50      },      "insert": {        "fields": ["display_name", "avatar_url"]      }    }  }}

Client policy is deny-by-default. The backend validates the JSON query AST, turns allowed operations into parameterized SQL, and pushes row predicates into the query. Clients never submit raw SQL.

5. Inspect and deploy

terminalbash
npx oneclient statusnpx oneclient doctornpx oneclient deploy --project prj_... --environment developmentnpx oneclient deployments --project prj_...
Production activates deliberately.Choose a plan and fund sufficient credits before production workloads. Included credits are consumed first; top-ups fund additional usage; configured hard stops block unfunded dynamic work.

Next steps

  • Set trusted auth origins and callback URLs.
  • Create narrowly scoped server keys and deploy tokens.
  • Configure usage alert thresholds and hard project limits.
  • Connect a custom app/API domain after production is ready.
  • Read AI & MCP before giving an agent platform access.