SnackBase – Open-Source BaaS for Python Teams

TL;DR

TL;DR: SnackBase is an open-source, self-hosted BaaS that gives Python/FastAPI teams auto-generated REST APIs, multi-tenancy, SQL-native row-level security, and a full React admin UI — deployable to Railway or any Docker host.

What Is SnackBase?

SnackBase is an open-source Backend-as-a-Service built with Python/FastAPI and React 19. It positions itself as a self-hosted alternative to Supabase, targeting Python teams that want a production-grade back end without building it from scratch.

From the README:

SnackBase is a Python/FastAPI-based BaaS providing auto-generated REST APIs, multi-tenancy, row-level security, authentication, enterprise OAuth/SAML, and comprehensive admin UI.

The project is actively developed across six phases covering foundation, security, operations, advanced features, enterprise readiness, data layer, background processing, and extensibility. Phase 6 (data layer competitiveness) and Phase 7 (background processing) are marked as 100% complete as of the current main branch.

Setup Workflow

Prerequisites

• Python 3.12 or higher
• uv (for dependency management)
• Node.js 18+ (for the React admin UI)
• PostgreSQL (optional, for production use) or SQLite (for local dev)

Step 1: Clone and Install

git clone https://github.com/lalitgehani/snackbase
cd snackbase

The project uses uv for Python dependency management. Install dependencies:

# Install uv if you don't have it
curl -LsSf https://astral.sh/uv/install.sh | sh

# Install Python dependencies
uv sync

Step 2: Configure Environment

cp .env.example .env
# Edit .env with your database URL, JWT secret, and domain

Key environment variables to set:

DATABASE_URL=postgresql://user:pass@localhost:5432/snackbase
JWT_SECRET=your-256-bit-secret
CORS_ORIGINS=https://your-admin.example.com

Step 3: Run Migrations

uv run alembic upgrade head

Step 4: Start the Server

# Start the FastAPI backend
uv run uvicorn app.main:app --reload --port 8000

# In another terminal, start the React admin UI
cd frontend && npm install && npm run dev

The admin UI runs on http://localhost:5173 by default, proxying API calls to the FastAPI backend.

Step 5: Deploy to Railway (One-Click)

From the README, SnackBase ships with one-click Railway deployment buttons for both SQLite and PostgreSQL configurations, eliminating the local setup step entirely for initial evaluation.

Deeper Analysis

Auto-Generated REST API

SnackBase inspects your dynamic collection schemas and generates REST endpoints automatically. This means you define your data model through the admin UI or API, and CRUD endpoints (GET, POST, PUT, DELETE, PATCH) appear without any custom controller code.

The Phase 6 roadmap item F6.7 notes cursor-based pagination is implemented for large datasets, with both cursor and cursor_before parameters and a page-vs-scroll mode toggle in the UI.

Multi-Tenancy and Row-Level Security

Multi-tenancy in SnackBase is implemented via shared-table architecture with account-scoped storage. Every record belongs to an account, and the rule engine enforces data isolation at the query level.

Permissions have three layers:

1. Workspace-level roles — owner, admin, member
2. Collection-level rules — define who can read, write, or delete records within a collection
3. Field-level access control — restrict access to specific fields per role

Rules can be written in Python or as SQL macros. The SQL-native row-level security (RLS) approach means permission checks happen at the database query layer, not in application code.

Authentication

SnackBase ships with built-in JWT-based authentication. For enterprise environments, OAuth 2.0 and SAML support is listed as a completed feature, enabling integration with identity providers like Okta, Azure AD, or Google Workspace.

Real-Time Subscriptions

Phase 4 shipped WebSocket and SSE-based real-time subscriptions. You can subscribe to collection changes and receive push updates when records are created, updated, or deleted — useful for live dashboards or collaborative features.

Background Jobs and Workflow Engine

The background job queue (Phase 7) handles async work with retry logic and a monitoring UI. Scheduled tasks use a cron-based scheduler with a scheduler admin UI for configuration.

The workflow engine (Phase 8.3) supports multi-step automation with directed-graph execution, triggered by events, schedules, manual invocations, or webhooks.

GxP Compliance

GxP (Good Practices) compliance is highlighted as a key differentiator for regulated industries. Features supporting this claim include:

• Immutable audit trails (Phase 1 F1.12)
• GxP-compliant audit logging with per-operation capture (Phase 2 F2.14)
• SQL-compiled rule audit logging (Phase 2 F2.14)

GxP frameworks cover FDA 21 CFR Part 11, EMA Annex 11, and similar regulations for pharmaceutical, biotech, and medical device software.

Database Support

SnackBase supports both SQLite (for local development) and PostgreSQL (for production). Phase 4.3 added PostgreSQL support with dialect-aware queries, meaning SQL syntax adapts to the underlying database engine. Phase 4.5 added local filesystem storage and Amazon S3 integration for file storage.

Practical Evaluation Checklist

• Auto-generated REST API from collection schemas
• JWT authentication built in
• OAuth/SAML for enterprise identity providers
• Multi-tenancy via shared-table architecture
• Three-layer permission system (workspace, collection, field)
• SQL-native row-level security enforcement
• GxP-compliant immutable audit logs
• Real-time subscriptions via WebSocket/SSE
• Background job queue with retry logic
• Cron-based scheduled tasks
• Multi-step workflow automation
• PostgreSQL and SQLite support
• Railway one-click deployment
• React admin dashboard

Security Notes

• JWT token management for session handling
• SQL macros for parameterized, injection-safe permission queries
• Field-level access control in the permission system
• Security headers (HSTS, CSP, Permissions-Policy) implemented per Phase 5
• Rate limiting (IP-based and user-based, configurable per endpoint)

FAQ

Q: How does SnackBase compare to Supabase? A: SnackBase positions itself as a self-hosted alternative with a stronger focus on Python/FastAPI as the native stack and GxP compliance. Supabase is more opinionated about Postgres features and ships a larger managed cloud ecosystem.

Q: Is SnackBase production-ready? A: The README shows Phase 1-4 and 6-8 at or near 100% completion, with Phase 4 (Advanced Features) and Phase 5 (Enterprise Features) still in progress. Core features covering CRUD, auth, permissions, and audit logging are marked complete. For production use, evaluate your specific feature requirements against the phase status.

Q: Does it support PostgreSQL-only features like full-text search? A: F6.6 (Full-Text Search) is listed as skipped in the README. Advanced monitoring (Prometheus) and APM integration are also not yet implemented. If you need these, they are on the roadmap.

Q: Can I self-host on a VPS without Railway? A: Yes. The backend is a standard FastAPI application deployable via Docker. The README shows Railway deployment as the primary quick-start path, but the Docker-based architecture is portable to any host.

Source and Accuracy Notes

• Project page: snackbase.dev
• Source repository: github.com/lalitgehani/snackbase
• License: AGPL v3 (verified via LICENSE file in repository)
• HN launch thread: news.ycombinator.com/item?id=46600092
• Source last checked: 2026-08-02 (commit main, README Phase 4/5 status)