Nhost

What Nhost does

Nhost calls itself an open source Firebase alternative with GraphQL. Each project gets a PostgreSQL database, and a GraphQL API is generated from its schema: queries, mutations and live subscriptions, without resolvers to write. The engine is Hasura; Nhost also has its own Hasura-compatible engine, Constellation, which is in alpha and can be switched on per project. Nhost Auth, Storage and Node.js serverless functions sit around the database. Events adds webhooks fired by database changes, cron schedules or one-off timers, and Run lets you deploy your own containers next to the project.

Development happens mostly through the Nhost CLI, which starts the full stack locally, tracks database migrations and Hasura metadata, and includes an MCP server for AI coding assistants. Official SDKs cover JavaScript/TypeScript and Dart/Flutter.

Security and access control

Permissions are declared per role and per table for select, insert, update and delete, and they can restrict both rows and columns. The model is deny-by-default: apart from the admin role, no role can do anything until you grant it. Rules can refer to session values such as the signed-in user’s ID, so “users see only their own rows” is a single condition. The documentation notes that complex permission checks can slow some queries and explains how to diagnose this.

Nhost Auth supports email and password, magic links, one-time codes, WebAuthn, anonymous users, TOTP multi-factor authentication, sign-in with ID tokens and a long list of OAuth providers, including Apple, Google, GitHub, Microsoft Entra ID and WorkOS. Tokens are RSA-signed JWTs with a JWKS endpoint, and sign-in and sign-up endpoints have built-in rate limits.

Self-hosting Nhost

The monorepo includes a reference Docker Compose setup that runs PostgreSQL, the GraphQL engine and its console, Auth, Storage backed by MinIO, Functions, the dashboard, Traefik and a test mail server. Nhost labels it a demonstration: it says it does not officially support self-hosting without a support agreement, and that some dashboard options tied to Nhost Cloud are greyed out. For production you are expected to adapt the configuration, remove development services and harden the settings yourself. The documentation lists three paths: the free community edition, a paid support agreement, or a dedicated cluster on your infrastructure operated by Nhost.

Hosted version

Nhost Cloud has a free Starter plan and paid plans, billed per organization. A Starter organization can have one active project at a time with lower resource limits, and moving a project from a paid plan back to Starter means pausing and transferring it.

Limitations

Self-hosting is possible but clearly second to the cloud service, so plan to own operations and upgrades yourself. Data access is GraphQL-first; if your team prefers REST or plain SQL from the client, Supabase is a closer fit. Functions run on Node.js only, and there is no official Firebase importer.

Who it suits

Nhost suits teams that like GraphQL and want Postgres underneath, with permissions declared next to the schema rather than in application code. It works best on Nhost Cloud or for teams willing to run and support a multi-container stack themselves.