# Flatstack

> Flat-priced backend for AI-built apps on Cloudflare. One subscription, hard caps instead of overage bills.

## API

- [Authentication](/docs/api/authentication.md): dashboard sign-in, email confirmation and password reset, owner second factor, personal access tokens and deploy tokens, auth error codes.
- [Billing](/docs/api/billing.md): plans, Stripe Checkout signup, upgrades, downgrades, add-ons, effective limits, failed payments (402 account_locked), cancellation and deletion.
- [Teams and roles](/docs/api/teams.md): owner, admin, developer and viewer, seats, invites, and how roles limit tokens.
- [Usage](/docs/api/usage.md): this period's usage against each capped limit, pooled across the account or per project, and the warn/capped levels.
- [Environment variables and secrets](/docs/api/environment.md): project-wide and per-environment values, overrides, write-only secrets, name rules, next-deploy timing.
- [Notification preferences](/docs/api/notifications.md): per-member email topics, defaults, and which emails always send.
- [Files](/docs/api/storage.md): the file browser API for any environment: buckets, listing with sizes, upload tickets, download links, confirmed deletes, data:read and data:write.
- [Projects](/docs/api/projects.md): creating projects, regions, engines and subdomains, provisioning and retries, delete and restore, transfers between accounts.
- [Custom domains](/docs/api/domains.md): attaching your own domain, CNAME and apex ALIAS records, automatic TLS, pending/active/failed statuses, per-plan limits, domain_taken.

## Apps

- [How your app is served](/docs/apps/serving.md): what counts as a request, what happens at each limit, read-only and suspended accounts, blocked outbound calls, CPU per request.
- [Functions and routes](/docs/apps/functions.md): fn(), auth modes, typed input errors, routes under /api and the reserved prefixes, and what ctx offers.
- [Deploying](/docs/apps/deploying.md): what a deploy does, the deploy API, failed and blocked deploys, rollback to the last 20, deploy tokens.
- [Cron jobs](/docs/apps/cron.md): flatstack/cron.ts and cron(), five-field UTC schedules and macros, per-plan minimum interval (15/5/1 min) and cron_interval_too_short, 30 s timeout, ctx.cron, retries 3 times with backoff, skipped runs when locked or capped, last 100 runs, the jobs and runs API.
- [Sending email](/docs/apps/email.md): ctx.email.send fields, default sender, monthly/per-minute/recipient limits and their errors, preview and sandbox policies, templates with preview and test send, the email log, the suppression list, suspension at 5% bounces or 0.1% complaints and appeals, BYO SES.
- [Sending from your own domain](/docs/apps/email-domains.md): the one CNAME record, check statuses and diagnostics, DMARC, moving a domain between projects, key rotation, removal.
- [Data and access rules](/docs/apps/data.md): table(), owner(), the five access rules and their defaults, ctx.db.asUser() and asAdmin().
- [Data API](/docs/apps/data-api.md): expose: true, /api/data/<table> CRUD under access rules, filters (column=op.value), sorting, paging, body validation, errors.
- [Postgres](/docs/apps/postgres.md): engine: "postgres" on Pro and Studio, same ctx.db code, compute and autosuspend, CU-h caps (0.25 CU at 100%, read-only at 150%), always-on, owner-only connection strings (rotate to see, shown once), IP allowlist, the database API.
- [File storage](/docs/apps/storage.md): buckets and bucket(), owner means the user's folder, signed direct uploads and multipart over 100 MB, downloads and signed links, cached image transforms (?w=&h=&fit=&format=&q=), ctx.storage, limits and 507 when full.
- [Security scan](/docs/apps/security-scan.md): the nine deploy-time checks and their severities, critical findings blocking a deploy, forceInsecure with the project's slug, deploy.blocked and deploy.forced_insecure audit entries, scan output in the API, CLI, MCP and PR comments, OSV dependency check.
- [Migrations](/docs/apps/migrations.md): db diff, applying on deploy or alone, all-or-nothing rollback on D1 and Postgres, destructive changes and --allow-destructive, conflicts, the migrations API.
- [Importing an app](/docs/apps/importing.md): what the Supabase, Lovable Cloud, Clerk, Vercel, Resend, Base44, Firebase, InstantDB and Postgres importers will bring across and what needs you; not available yet.