![\"screenshot](\"https://codehooks.io/assets/images/stop-building-admin-apps-07d31f3ae8de9bb5e61c227e42ed3190.webp\")
Every developer has built some version of the same admin application. Users table, CRUD forms, list views, search, filters, auth, role management, a REST API. You know the drill. You scaffold the project, wire up the endpoints, build the forms, handle validation, add pagination, implement auth — and a week later you have something that looks like every other admin app.
\nWhat if you could skip all of that and just describe what you need?
\n
See the below example screenshots of the default admin app generated from a json datamodel:\n
The React Admin Dashboard template for Codehooks.io takes a fundamentally different approach. Instead of writing components, routes, and API endpoints, you define your entire application in a single JSON file — your collections, field types, relationships, validation rules, and UI behavior. The template reads that schema at runtime and generates everything: the sidebar navigation, list views, search and filters, detail pages, create/edit forms, lookup fields with live search, file uploads, and a complete REST API with Swagger docs.
\nIt's not code generation. There are no files to maintain. The UI renders dynamically from the schema stored in the database. Change a field, add a collection, reconfigure a relationship — it takes effect immediately. No rebuild, no redeploy.
\nHere's where it gets interesting. The datamodel format uses an OpenAPI-style JSON structure — standard JSON Schema conventions that every major AI model has been trained on extensively. That means Claude, ChatGPT, Gemini, or any other AI agent can produce valid schemas on the first try.
\nA collection definition looks like this:
\n{
\"app\": {
\"title\": \"Veterinary Clinic\",
\"subtitle\": \"Manage patients, appointments, and treatments\",
\"icon\": \"heart-pulse\"
},
\"collections\": {
\"patients\": {
\"label\": \"Patients\",
\"icon\": \"paw-print\",
\"schema\": {
\"type\": \"object\",
\"required\": [\"name\", \"species\"],
\"properties\": {
\"name\": { \"type\": \"string\", \"title\": \"Pet Name\" },
\"species\": {
\"type\": \"string\",
\"title\": \"Species\",
\"enum\": [\"Dog\", \"Cat\", \"Bird\", \"Reptile\", \"Other\"]
},
\"breed\": { \"type\": \"string\", \"title\": \"Breed\" },
\"owner\": {
\"type\": \"string\",
\"title\": \"Owner\",
\"format\": \"lookup\",
\"collection\": \"owners\",
\"displayField\": \"name\"
},
\"dateOfBirth\": { \"type\": \"string\", \"title\": \"Date of Birth\", \"format\": \"date\" },
\"photo\": { \"type\": \"string\", \"title\": \"Photo\", \"format\": \"file-upload\" }
}
}
}
}
}
Standard JSON Schema properties (type, enum, required, format) plus a handful of extensions for relationships (format: \"lookup\") and UI behavior. If you've ever written an OpenAPI schema definition or used JSON Schema for form validation, this will feel immediately familiar.
The template ships with a built-in \"Copy Prompt\" button on the Datamodel Editor page. Click it, and you get a carefully crafted prompt that explains the entire schema format to an AI agent — every field type, relationship pattern, validation option, and UI configuration. Paste it into your AI of choice, describe what you need in plain language, and you get back valid JSON.
\nHere's the workflow:
\nNo code written. No components built. No API endpoints configured.
\nThis isn't a toy demo. The template generates a production-grade admin interface:
\nDynamic CRUD — List views with column sorting, full-text search, and filter buttons. Detail panels with related data from linked collections. Create/edit forms with proper validation, enum dropdowns, date pickers, markdown editors, and file uploads.
\nRelationships — Lookup fields with live search across collections (single-select and multi-select). Parent-child views on detail pages showing related records. Tree views for hierarchical data with expandable sub-items.
\nAuthentication — JWT-based login with httpOnly cookie sessions. Two built-in roles (admin and user). User management UI. The sidebar dynamically hides admin-only sections.
\nVisual Datamodel Editor — Add, remove, and configure collections and fields through a form-based UI. Switch to a JSON tab with syntax highlighting for power users. Full version history with one-click rollback.
\nREST API + Swagger — Every collection automatically gets a complete CRUD API. The OpenAPI documentation at /docs updates dynamically when you change the schema. No code generation, no sync issues.
Modern UI — React 18 with Vite, Tailwind CSS v4, and shadcn/ui components. Dark mode with system preference support. Responsive layout with a collapsible sidebar that works on mobile.
\nThe reason I call this a Swiss army knife is that the same template handles wildly different use cases just by swapping the JSON:
\nProject management — tasks, milestones, team members, time tracking with status pipelines
\nCRM — companies, contacts, deals, activities with lookup relationships across collections
\nInventory system — products, categories, suppliers, purchase orders with file uploads for product images
\nContent management — articles, authors, categories, tags with markdown editing and status workflows
\nHackathon platform — events, participants, teams, submissions, judges, scores with cross-linked detail views
\nEach of these is a different datamodel.json. Same template, same codebase, same deployment process. The schema is the application.
npm i -g codehooks
coho login
coho create myapp --template react-admin-dashboard
cd myapp && mv config.json backend
coho set-env JWT_ACCESS_TOKEN_SECRET $(openssl rand -hex 32)
coho set-env JWT_REFRESH_TOKEN_SECRET $(openssl rand -hex 32)
npm run install:all
npm run deploy
That's it. You have a running admin dashboard. Log in with admin / admin, open the Datamodel Editor, and start building.
Or skip the manual editing entirely — copy the prompt, tell an AI what you need, paste the JSON, and your app is live.
\nThe template is open source and actively developed. Some directions we're exploring:
\nThe full source code is on GitHub: react-admin-dashboard
\nIf you've ever spent a week building an admin app that could have been a JSON file, give this a try. Five minutes from coho create to a production app. No CRUD boilerplate. No auth plumbing. No form builders.
Describe what you need. Let AI write the schema. Ship it.
\nBuilt with Codehooks.io — the serverless backend platform designed for rapid development and AI workflows.
", "url": "https://codehooks.io/blog/stop-building-admin-apps", "title": "Stop Building Admin Applications", "summary": "What if you could skip all the CRUD boilerplate and just describe your admin app in JSON? The React Admin Dashboard template for Codehooks.io generates a full-stack app from a single schema file.", "date_modified": "2026-03-04T00:00:00.000Z", "author": { "name": "Jones" }, "tags": [ "admin-dashboard", "json-schema", "ai", "react", "codehooks", "templates" ] }, { "id": "https://codehooks.io/blog/vibe-coding-todo-app", "content_html": "How fast can you go from an empty folder to a fully deployed full-stack app? In this post, I'll walk through a live vibe coding session where I pair-programmed with an AI agent (Claude Code) to build a todo app using React for the frontend and Codehooks.io for the backend — all deployed to the cloud in minutes.
\nEvery prompt I typed, every decision the agent made, and every line of code it wrote is documented here. Follow along and try it yourself.
\n![\"Vibe](\"https://codehooks.io/assets/images/vibe-coding-todo-app-7bc2326ca75153a8cfdc92bd139aadfa.webp\")
vibetodo-eack on Codehooks.io (empty, freshly cleaned)Before starting, install the Codehooks Claude plugin so Claude Code understands the Codehooks platform, CLI, and APIs:
\n/plugin marketplace add RestDB/codehooks-claude-plugin
/plugin install codehooks@codehooks
Once installed, Claude Code auto-detects Codehooks projects and can deploy, query, and manage your backend directly from the conversation. Using a different AI coding agent? Check out our AI Agent Setup page for instructions on Cursor, Codex CLI, Windsurf, and more.
\nA fully functional React todo app with a complete REST API, auto-generated Swagger documentation, and cloud deployment. All created in a single vibe coding session.
\n![\"The](\"https://codehooks.io/assets/images/vibetodo-63ab8d4fff61408475b6cbde6c8ddf15.webp\")
\n\n\"Ok, in this session we'll vibe code the infamous todo app. We will use Codehooks for both frontend (React) and backend (CRUD API and database). The twist here is that we also will write about the process in a blogpost so other developers can read about and follow the dynamic process from zero to a finished deployed app. Document my prompts and your reasoning and actions in a blogpost.md file accordingly. Lets go, plan first, then code.\"
\n
Before writing a single line of code, the agent entered plan mode — exploring the project state, reading the Codehooks API reference, and designing a 4-step approach:
\npackage.json + start the blogpostcrudlify() for instant CRUD APIThe plan was approved. Let's execute.
\nThe agent created package.json with all dependencies:
codehooks-js + zod for validationreact, react-dom, vite, @vitejs/plugin-reactBoth frontend and backend dependencies live in the same project — Codehooks handles the bundling and deployment.
\nHere's the entire backend — index.js:
import { app } from 'codehooks-js';
import { z } from 'zod';
const TodoSchema = z.object({
title: z.string().min(1).describe('Todo title'),
completed: z.boolean().default(false).describe('Completion status')
});
app.crudlify({ todos: TodoSchema }, { prefix: '/api' });
app.auth('/api/*', (req, res, next) => next());
app.auth('/*', (req, res, next) => next());
app.static({
route: '/',
directory: '/static',
default: 'index.html',
notFound: '/index.html'
});
export default app.init();
\n\n\"The key decision here is using
\ncrudlify()instead of writing manual routes. One line —app.crudlify({ todos: TodoSchema }, { prefix: '/api' })— auto-generates a complete REST API with Zod validation. That single line gives us:\n
\n- \n
GET /api/todos— list all todos- \n
POST /api/todos— create a todo (validated against the Zod schema)- \n
GET /api/todos/:id— get one todo- \n
PUT /api/todos/:id— replace a todo- \n
PATCH /api/todos/:id— partial update (perfect for togglingcompleted)- \n
DELETE /api/todos/:id— remove a todoThe
\napp.static()block at the end serves the React SPA. ThenotFound: '/index.html'fallback enables client-side routing.\"
The agent created 4 files under frontend/:
frontend/vite.config.js — Vite config with a proxy to the live Codehooks API (for local dev) and build output to ../static:
import { defineConfig } from 'vite';
import react from '@vitejs/plugin-react';
export default defineConfig({
plugins: [react()],
server: {
proxy: { '/api': 'https://luminous-grove-f487.codehooks.io' }
},
build: { outDir: '../static', emptyOutDir: true }
});
frontend/src/App.jsx — The todo app component. Key features:
PATCH to update just the completed field)\n\n\"The frontend is intentionally simple. Each action (
\naddTodo,toggleTodo,deleteTodo) calls the Codehooks API and then re-fetches the list. This is the most straightforward pattern — no local state management needed beyond the form input. ThePATCHmethod is key: instead of sending the entire todo on toggle, we only send{ completed: !todo.completed }, whichcrudlifyhandles natively.\"
Three commands to go live:
\nnpm install # Install dependencies
npx vite build frontend # Build React → /static
coho deploy # Deploy to Codehooks (~5 seconds)
Output:
\nDeployed Codehook successfully!
Create:
\ncurl -X POST -H 'Content-Type: application/json' \\
-d '{\"title\":\"Buy milk\",\"completed\":false}' \\
https://luminous-grove-f487.codehooks.io/api/todos
{\"title\":\"Buy milk\",\"completed\":false,\"_id\":\"698cf5b86c156a91bb44f2ba\"}
List:
\ncurl https://luminous-grove-f487.codehooks.io/api/todos
[{\"title\":\"Buy milk\",\"completed\":false,\"_id\":\"698cf5b86c156a91bb44f2ba\"},
{\"title\":\"Write blogpost\",\"completed\":false,\"_id\":\"698cf5ba6c156a91bb44f2bc\"}]
Toggle completed (PATCH):
\ncurl -X PATCH -H 'Content-Type: application/json' \\
-d '{\"completed\":true}' \\
https://luminous-grove-f487.codehooks.io/api/todos/698cf5b86c156a91bb44f2ba
{\"title\":\"Buy milk\",\"completed\":true,\"_id\":\"698cf5b86c156a91bb44f2ba\"}
Validation (empty title rejected):
\ncurl -X POST -H 'Content-Type: application/json' \\
-d '{\"title\":\"\"}' \\
https://luminous-grove-f487.codehooks.io/api/todos
[{\"origin\":\"string\",\"code\":\"too_small\",\"minimum\":1,\"inclusive\":true,
\"path\":[\"title\"],\"message\":\"Too small: expected string to have >=1 characters\"}]
All tests passed. The React SPA loads at the base URL and is fully functional.
\nLive app: https://luminous-grove-f487.codehooks.io/
\nLet that sink in. From the moment I typed the kickoff prompt to a fully deployed, tested full-stack app live on the internet — under 5 minutes. Here's the breakdown:
\n| Phase | Time |
|---|---|
| Planning (agent explores + designs approach) | ~30 seconds |
Backend code generation (index.js) | ~10 seconds |
| Frontend code generation (4 files) | ~15 seconds |
npm install | ~9 seconds |
vite build | ~0.4 seconds |
coho deploy | ~5 seconds |
| API testing (6 curl commands) | ~15 seconds |
| Total wall time | ~90 seconds |
The rest of the time was the agent writing this blogpost. The actual app was live before the ink was dry on Step 2 of the documentation.
\nThis is the power of vibe coding with the right stack: you describe what you want, the agent figures out how, and the platform handles the where.
\n| File | Lines | Purpose |
|---|---|---|
index.js | 24 | Backend: schema + API + static serving |
frontend/src/App.jsx | 120 | React todo app component |
frontend/src/main.jsx | 8 | React entry point |
frontend/vite.config.js | 14 | Build config + dev proxy |
frontend/index.html | 12 | HTML shell |
package.json | 20 | Dependencies |
| Total | ~200 |
\n\n\"And finally lets add openapi docs and swagger.\"
\n
One more app.openapi() call — that's it. Since we used crudlify() with a Zod schema, Codehooks auto-generates the full OpenAPI 3.0 spec from the schema. No manual route documentation needed.
app.openapi({
info: { title: 'Todo API', version: '1.0.0', description: 'CRUD API for todos - built with Codehooks.io' },
tags: [{ name: 'todos', description: 'Todo operations' }]
});
One coho deploy later:
All 6 CRUD endpoints are fully documented with schemas, parameters, and response types — generated automatically from the Zod TodoSchema. Zero extra work.
\n\n\"Add a cron job that empties the todos collection every hour\"
\n
Since this is a public demo app, we want to keep the database clean. Codehooks has built-in cron job support via app.job(). Two lines:
app.job('0 * * * *', async () => {
const conn = await Datastore.open();
await conn.removeMany('todos', {});
console.log('Cron: cleared todos collection');
});
The cron expression 0 * * * * fires at minute 0 of every hour. removeMany with an empty query {} wipes the entire collection. Deployed with one coho deploy — the job is now scheduled automatically by the platform.
The entire session — from empty folder to deployed, tested app — took one conversation. The agent planned before coding, made decisions transparent, and tested everything before declaring success.
\nThe key enablers:
\ncrudlify() — turned a Zod schema into a full REST API in one lineapp.static() — served the React SPA from the same deploymentNo Docker. No CI/CD pipeline. No infrastructure config. Just code and deploy.
", "url": "https://codehooks.io/blog/vibe-coding-todo-app", "title": "Vibe Coding a Todo App: From Zero to Deployed in One Session", "summary": "How fast can you go from an empty folder to a fully deployed full-stack app? Watch a live vibe coding session where an AI agent builds a React + Codehooks todo app in under 5 minutes.", "date_modified": "2026-02-12T00:00:00.000Z", "author": { "name": "Jones" }, "tags": [ "vibe-coding", "react", "serverless", "tutorial", "ai", "claude-code" ] }, { "id": "https://codehooks.io/blog/openclaw-backend", "content_html": "OpenClaw is everywhere right now. People are running \"Jarvis\" on Mac minis 24/7, automating their entire digital lives.
\nBut here's the thing: OpenClaw runs locally. That's great for privacy and control. It's less great when you need:
\nYou could give your agent access to AWS. Let it wire up Lambda, API Gateway, DynamoDB, and SQS. Watch it burn through your free tier and leak credentials.
\nOr you could give it a backend designed for agents.
\n![\"Codehooks](\"https://codehooks.io/assets/images/codehooks-openclaw-17de5361beb4270c2ed9585e549c343e.webp\")
Codehooks.io is a serverless backend with everything wired together: REST APIs, database, queues, cron, workers. Your agent can build anything from a simple CRUD API to a multi-step workflow — and deploy it in seconds.
\nHere's your agent deploying a Stripe webhook handler with signature verification:
\nimport { app, Datastore } from 'codehooks-js';
import { verify } from 'webhook-verify';
// Allow Stripe to call this without JWT auth
app.auth('/webhook/*', (req, res, next) => next());
app.post('/webhook/stripe', async (req, res) => {
// Verify signature using rawBody (essential for HMAC validation)
const isValid = verify('stripe', req.rawBody, req.headers, process.env.STRIPE_WEBHOOK_SECRET);
if (!isValid) {
return res.status(401).send('Invalid signature');
}
const conn = await Datastore.open();
await conn.insertOne('payments', {
...req.body,
receivedAt: new Date().toISOString()
});
res.json({ received: true });
});
export default app.init();
coho deploy # live in seconds
That's a production webhook endpoint with signature verification and persistent storage. Your agent could just as easily deploy a CRUD API, a data pipeline, or a scheduled report — same workflow, same coho deploy.
Run coho prompt and you get the complete development prompt — REST routes, CRUD patterns, database operations, queue workers, and workflow examples. Feed it into context and your OpenClaw can build any backend feature without hallucinating.
coho prompt | pbcopy # copy to clipboard on macOS
This is what \"AI-friendly\" actually means: not a buzzword, but a structured prompt that lets agents build correctly on the first try.
\nYour OpenClaw agent runs on your Mac mini. But what happens when Stripe sends a payment webhook at 3am and your machine is updating macOS? Missed event. What about the CRUD API your mobile app depends on? Down.
\nWith Codehooks, your endpoints live in the cloud. Your agent deploys them, and they stay up whether your Mac is awake or not.
\nSecurity researchers have called OpenClaw \"a security nightmare\" — and they're not wrong. An agent with full system access is powerful but risky.
\nOffloading sensitive integrations (payment webhooks, API keys, customer data) to a separate backend limits the blast radius. Your agent interacts with the backend via API, not raw credentials scattered across your machine.
\nNeed a daily digest? Weekly report? Hourly data sync? Define it once:
\nimport { app } from 'codehooks-js';
app.job('0 9 * * *', async () => {
// runs every day at 9am, whether your agent is awake or not
});
export default app.init();
Need async processing too? Add a worker queue alongside your cron jobs:
\nimport { app, Datastore } from 'codehooks-js';
app.worker('notify', async (req, res) => {
console.log('Sending notification:', req.body.payload);
// process the task...
res.end();
});
app.post('/enqueue', async (req, res) => {
const conn = await Datastore.open();
await conn.enqueue('notify', req.body);
res.json({ queued: true });
});
export default app.init();
Deploys take seconds, not minutes. Your agent can:
\ncoho prompt to load contextcoho deploycoho log -fSomething break? Your agent reads the logs, fixes the code, and redeploys — all in the same loop. No rollback ceremony, no CloudFormation stacks. Just fix and ship.
\nWe've published a Codehooks skill for OpenClaw that bundles everything your agent needs — context, examples, and CLI commands:
\n→ codehooks-backend skill on GitHub
\nYou do this once:
\nnpm install -g codehooks
coho login
coho create openclaw-backend
cd openclaw-backend
npm install codehooks-js
coho add-admintoken
Give the admin token to your agent. From here, it can deploy code, query data, and manage the backend on its own using coho deploy --admintoken $CODEHOOKS_ADMIN_TOKEN.
Your agent can also start from a ready-made template:
\ncoho create my-webhooks --template stripe-webhook-handler
cd my-webhooks
npm install codehooks-js
coho deploy
Either way, your agent now has a live webhook URL, a database, queues, and cron — all deployable in seconds.
\nSet aside 10 minutes. By the end you'll have:
\nYour Mac mini runs OpenClaw. Codehooks runs everything else.
\nA note on responsibility: Giving your agent the ability to deploy and run code on a live server is powerful — and risky. Review what your agent deploys, set appropriate permissions, and monitor usage. You're responsible for any code your agent ships. The good news: Codehooks has no pay-per-use pricing, so a busy agent won't surprise you with a bill.
\n\ncohoapp.job() patterncoho prompt to generate agent contextYour API is only as useful as its documentation. Without clear docs, developers waste hours reverse-engineering endpoints, partners struggle to integrate, and AI agents can't understand your API at all.
\nBut writing OpenAPI specs by hand? That's tedious, error-prone, and constantly out of sync with your actual code.
\nWhat if your documentation wrote itself?
\nWith the latest codehooks-js update, it does. Define your schemas once, and Codehooks generates complete OpenAPI 3.0 documentation—served as an interactive Swagger UI at /docs.
Good API documentation isn't optional—it's the difference between adoption and abandonment:
\nThe OpenAPI specification has become the industry standard. It powers Swagger UI, Postman, and countless code generators. But maintaining it manually creates a constant documentation burden.
\nDRY (Don't Repeat Yourself) means defining things once and reusing them everywhere. The best documentation comes from your code itself. With Codehooks, you focus on what matters:
\nThat's it. Codehooks handles the OpenAPI generation automatically.
\nThe fastest path to documented APIs is crudlify. Define a schema, and you get full CRUD endpoints with complete OpenAPI docs:
import { app } from 'codehooks-js';
import { z } from 'zod';
// Define your schema once
const todoSchema = z.object({
title: z.string().min(1).max(200).describe('Task title'),
completed: z.boolean().default(false).describe('Completion status'),
priority: z.enum(['low', 'medium', 'high']).default('medium')
});
// Enable OpenAPI documentation
app.openapi({
info: {
title: 'Todo API',
version: '1.0.0',
description: 'A simple task management API'
}
});
// Generate CRUD endpoints with validation and docs
app.crudlify({ todos: todoSchema });
export default app.init();
Deploy with coho deploy, then visit:
/docs — Interactive Swagger UI/openapi.json — Raw OpenAPI specificationYou now have 8 fully documented endpoints:
\n| Method | Path | Operation |
|---|---|---|
| POST | /todos | Create todo |
| GET | /todos | List todos |
| GET | /todos/{ID} | Get by ID |
| PUT | /todos/{ID} | Replace |
| PATCH | /todos/{ID} | Update |
| DELETE | /todos/{ID} | Delete |
| PATCH | /todos/_byquery | Batch update |
| DELETE | /todos/_byquery | Batch delete |
Each endpoint includes request/response schemas, validation rules, and examples—all generated from your Zod schema.
\n![\"Swagger](\"https://codehooks.io/assets/images/swagger-ui-todo-api-f620012734258f0e0398f8f25c4ac527.png\")
\nExample: Auto-generated Swagger UI for the Todo API with all CRUD endpoints documented
The generated Swagger UI is fully functional—not just documentation. Enter your API token in the authorize dialog, and you can test all endpoints directly from the browser.
\nNot everything fits the CRUD pattern. For custom endpoints, use the openapi() middleware helper:
import { app, openapi } from 'codehooks-js';
app.get('/health',
openapi({
summary: 'Health check',
tags: ['System'],
responses: {
200: { description: 'Service is healthy' }
}
}),
(req, res) => {
res.json({ status: 'ok', timestamp: new Date().toISOString() });
}
);
app.post('/analyze',
openapi({
summary: 'Analyze text',
tags: ['AI'],
requestBody: {
required: true,
content: {
'application/json': {
schema: {
type: 'object',
required: ['text'],
properties: {
text: { type: 'string', maxLength: 10000 },
language: { type: 'string', default: 'en' }
}
}
}
}
},
responses: {
200: { description: 'Analysis complete' },
400: { description: 'Invalid input' }
}
}),
async (req, res) => {
// Your analysis logic
}
);
The openapi() middleware attaches OpenAPI metadata to your route without affecting its behavior. Your documentation stays next to your code—always in sync.
For the best DRY experience, use your Zod schemas directly in custom routes:
\nimport { app, Datastore, openapi } from 'codehooks-js';
import { z } from 'zod';
const UserSchema = z.object({
name: z.string().min(1).max(100).describe('Full name'),
email: z.string().email().describe('Email address'),
role: z.enum(['admin', 'user']).default('user')
});
// Validation middleware
function validate(schema) {
return async (req, res, next) => {
try {
req.body = schema.parse(req.body);
next();
} catch (error) {
res.status(400).json({
error: 'Validation failed',
details: error.issues
});
}
};
}
// Schema used for BOTH validation AND OpenAPI docs
app.post('/users',
openapi({
summary: 'Create user',
tags: ['Users'],
requestBody: {
required: true,
content: {
'application/json': {
schema: UserSchema // Zod schema auto-converts to JSON Schema
}
}
},
responses: {
201: { description: 'User created' },
400: { description: 'Validation error' }
}
}),
validate(UserSchema),
async (req, res) => {
const db = await Datastore.open();
const user = await db.insertOne('users', req.body);
res.status(201).json(user);
}
);
One schema. Validation and documentation. No duplication.
\nFor production APIs, you'll want more control:
\napp.openapi({
info: {
title: 'Production API',
version: '2.0.0',
description: 'Full-featured API with authentication'
},
// Multiple environments
servers: [
{ url: 'https://myapi.api.codehooks.io/dev', description: 'Development' },
{ url: 'https://myapi.api.codehooks.io/prod', description: 'Production' }
],
// Organize endpoints
tags: [
{ name: 'Users', description: 'User management' },
{ name: 'Orders', description: 'Order processing' },
{ name: 'System', description: 'Health and status' }
],
// Filter what appears in docs
filter: (op) => {
// Hide internal endpoints
if (op.path.startsWith('/internal')) return false;
// Hide batch delete (dangerous)
if (op.method === 'delete' && op.path.includes('_byquery')) return false;
return true;
},
// Link to external docs
externalDocs: {
description: 'Full API Guide',
url: 'https://docs.mycompany.com/api'
}
}, '/api-docs'); // Custom Swagger UI path
The filter function gives you precise control over what appears in your documentation:
// Only show public endpoints
filter: (op) => op.tags.includes('Public')
// Hide all DELETE operations
filter: (op) => op.method !== 'delete'
// Exclude admin routes
filter: (op) => !op.path.startsWith('/admin')
Codehooks supports the three most popular schema libraries:
\nconst schema = z.object({
email: z.string().email(),
age: z.number().min(0).max(150).optional()
});
const schema = yup.object({
email: yup.string().email().required(),
age: yup.number().min(0).max(150)
});
const schema = {
type: 'object',
required: ['email'],
properties: {
email: { type: 'string', format: 'email' },
age: { type: 'integer', minimum: 0, maximum: 150 }
}
};
All three automatically convert to OpenAPI-compatible JSON Schema in your documentation.
\nHere's a complete API with multiple collections, custom endpoints, and full OpenAPI configuration:
\nimport { app, Datastore, openapi } from 'codehooks-js';
import { z } from 'zod';
// Schemas
const productSchema = z.object({
name: z.string().min(1).max(200),
price: z.number().positive(),
category: z.enum(['electronics', 'clothing', 'books']),
inStock: z.boolean().default(true)
});
const orderSchema = z.object({
productId: z.string(),
quantity: z.number().int().positive(),
status: z.enum(['pending', 'shipped', 'delivered']).default('pending')
});
// OpenAPI config
app.openapi({
info: {
title: 'E-Commerce API',
version: '1.0.0',
description: 'Product catalog and order management'
},
tags: [
{ name: 'Products', description: 'Product catalog' },
{ name: 'Orders', description: 'Order management' },
{ name: 'Analytics', description: 'Business insights' }
],
filter: (op) => !op.path.includes('_byquery')
});
// Custom analytics endpoint
app.get('/analytics/sales',
openapi({
summary: 'Get sales summary',
tags: ['Analytics'],
parameters: [
{ name: 'period', in: 'query', schema: { type: 'string', enum: ['day', 'week', 'month'] } }
],
responses: {
200: { description: 'Sales data' }
}
}),
async (req, res) => {
const db = await Datastore.open();
const orders = await db.getMany('orders', { status: 'delivered' }).toArray();
res.json({
totalOrders: orders.length,
period: req.query.period || 'all'
});
}
);
// Auto-generate CRUD for both collections
app.crudlify({
products: productSchema,
orders: orderSchema
});
export default app.init();
Deploy and visit /docs to explore your complete, interactive API documentation.
Stop treating documentation as an afterthought. With Codehooks OpenAPI support:
\nopenapi() middleware keeps specs next to code/docs, spec at /openapi.jsonYour API consumers—whether developers, partners, or AI agents—will thank you.
\nGet started:
\nnpm install codehooks-js@latest
Then add app.openapi() to your project and deploy. Your documentation is ready.
For the complete API reference, see the OpenAPI Documentation guide.
\n\nCommon questions about auto-generating API docs with Codehooks
.describe('Your description'). For Yup, use .meta({ description: 'Your description' }). For JSON Schema, add a description property directly. These descriptions appear in your Swagger UI documentation.filter function in your app.openapi() config. For example: filter: (op) => op.method !== 'delete' hides all DELETE endpoints, or filter: (op) => !op.path.startsWith('/internal') hides internal routes.app.openapi(): app.openapi({ info: {...} }, '/api-docs'). The Swagger UI will be available at /api-docs instead of the default /docs.app.crudlify() with a schema, all 8 CRUD endpoints are automatically documented with proper request/response schemas, validation rules, and examples.openapi() middleware: app.get('/custom', openapi({ summary: '...', responses: {...} }), handler). You can pass Zod schemas directly to requestBody for automatic schema conversion./openapi.json endpoint provides a machine-readable spec that AI agents, code generators, and API clients can use to understand and interact with your API automatically.Every modern SaaS needs to react to events: a user signs up, a payment succeeds, a trial expires. Webhooks are the glue that connects these events to your business logic—but building reliable webhook infrastructure means managing servers, queues, retries, and databases.
\nEmail automation platforms promise to handle this, but they come with baggage: vendor lock-in, limited webhook integrations, and opaque pricing that scales against you.
\nWhat if your webhook endpoints could directly power your email automation?
\nMailchimp, ConvertKit, ActiveCampaign—they all solve the same problem: sending automated email sequences. But they come with baggage:
\nWhat if you could own the entire stack—starting with your webhook endpoints?
\nCodehooks.io is built for webhooks. Deploy endpoint handlers in seconds, connect them to databases and queues, and let the platform handle the infrastructure.
\nI built a drip email template that showcases this:
\n✅ Webhook-first architecture - Receive events from Stripe, signup forms, Zapier, or any service
\n✅ Full control - You own the code, subscribers, and sending logic
\n✅ Any email provider - SendGrid, Mailgun, Postmark—switch with one env var
\n✅ Built-in queues & cron - No external services to configure
\n✅ Production-ready - Scales to 100k+ subscribers with streaming architecture
\nAnd it deploys in 5 minutes.
\nView the source code: github.com/RestDB/codehooks-io-templates/drip-email-workflow
\nHere's the webhook-driven architecture:
\n\nWebhook endpoints receive events. Cron processes them. Queues deliver emails. That's it.
\n{
\"workflowSteps\": [
{
\"step\": 1,
\"hoursAfterSignup\": 24,
\"template\": {
\"subject\": \"Welcome to Our Community! 🎉\",
\"heading\": \"Welcome, {{name}}!\",
\"body\": \"Thanks for signing up...\",
\"buttonText\": \"Get Started\",
\"buttonUrl\": \"https://example.com/get-started\"
}
},
{
\"step\": 2,
\"hoursAfterSignup\": 96,
\"template\": {
\"subject\": \"Quick Tips to Get You Started 💡\",
\"heading\": \"Here are some tips, {{name}}\",
\"body\": \"...\"
}
}
]
}
Add 3 steps or 30—same architecture, same simplicity.
\n# 1. Create from template
coho create my-drip-campaign --template drip-email-workflow
cd my-drip-campaign
npm install
# 2. Deploy
coho deploy
# 3. Configure email provider (pick one)
coho set-env EMAIL_PROVIDER \"sendgrid\"
coho set-env SENDGRID_API_KEY \"SG.your-key\"
coho set-env FROM_EMAIL \"noreply@yourdomain.com\"
coho set-env FROM_NAME \"Your Company\"
# 4. Add a subscriber
curl -X POST https://your-project.api.codehooks.io/dev/subscribers \\
-H \"Content-Type: application/json\" \\
-H \"x-apikey: YOUR_API_KEY\" \\
-d '{\"name\":\"Jane Doe\",\"email\":\"jane@example.com\"}'
Done. Your drip campaign is running.
\nBuilding reliable webhook infrastructure traditionally requires stitching together:
\nThat's a lot of DevOps for receiving a webhook.
\nCodehooks gives you all of this in one platform, purpose-built for webhooks:
\nimport { app, Datastore } from 'codehooks-js';
// Webhook endpoint - receives events from any service
app.post('/subscribers', async (req, res) => {
const conn = await Datastore.open();
await conn.insertOne('subscribers', { email: req.body.email });
res.json({ success: true });
});
// Webhook from Stripe - handle payment events
app.post('/stripe-webhook', async (req, res) => {
const event = req.body;
if (event.type === 'checkout.session.completed') {
const conn = await Datastore.open();
await conn.insertOne('subscribers', {
email: event.data.object.customer_email,
name: event.data.object.customer_details.name,
source: 'stripe'
});
}
res.json({ received: true });
});
// Built-in cron job - process subscribers periodically
app.job('*/15 * * * *', async (req, res) => {
// Find subscribers ready for next email
// Queue them for sending
});
// Built-in queue worker - handle async email delivery
app.worker('send-email', async (req, res) => {
// Send the email
});
export default app.init();
No Docker. No Kubernetes. No infrastructure YAML files. Just write webhook handlers and deploy.
\nHere's what makes this production-ready:
\nInstead of loading all subscribers into memory:
\n// ❌ Memory issues with large lists
const subscribers = await conn.getMany('subscribers').toArray();
for (const sub of subscribers) {
await processSubscriber(sub);
}
// ✅ Constant memory usage
await conn.getMany('subscribers').forEach(async (sub) => {
await processSubscriber(sub);
});
Handles 100k subscribers as easily as 100.
\nThe cron job atomically marks emails as sent before queueing:
\nconst result = await conn.updateOne(
'subscribers',
{
_id: subscriber._id,
emailsSent: { $nin: [step] } // Only if not already sent
},
{ $push: { emailsSent: step } }
);
// Only queue if we won the race
if (result) {
await conn.enqueue('send-email', { subscriberId, step });
}
No duplicate emails even if cron jobs overlap.
\nIf email sending fails, the worker removes it from the sent list:
\ncatch (error) {
await conn.updateOne(
'subscribers',
{ _id: subscriberId },
{ $pull: { emailsSent: step } }
);
// Next cron run will retry
}
Ensures delivery without manual intervention.
\nWhen a customer completes checkout, automatically start their onboarding sequence:
\napp.post('/stripe-webhook', async (req, res) => {
const sig = req.headers['stripe-signature'];
const event = stripe.webhooks.constructEvent(req.rawBody, sig, webhookSecret);
if (event.type === 'checkout.session.completed') {
const session = event.data.object;
const conn = await Datastore.open();
await conn.insertOne('subscribers', {
email: session.customer_email,
name: session.customer_details.name,
plan: session.metadata.plan,
source: 'stripe_checkout'
});
}
res.json({ received: true });
});
Point your Stripe webhook to https://your-project.api.codehooks.io/dev/stripe-webhook and customers automatically enter your drip sequence.
Connect any form provider—Typeform, Tally, your own frontend:
\napp.post('/subscribers', async (req, res) => {
const conn = await Datastore.open();
await conn.insertOne('subscribers', {
email: req.body.email,
name: req.body.name,
source: req.body.source || 'api'
});
res.json({ success: true });
});
Add users to campaigns directly from your application:
\n// In your app's signup flow
await fetch('https://your-project.api.codehooks.io/dev/subscribers', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'x-apikey': process.env.DRIP_API_KEY
},
body: JSON.stringify({
name: user.name,
email: user.email,
source: 'app_signup'
})
});
The cron job handles everything else automatically.
\ncoho set-env DRY_RUN \"true\"
# Watch logs to verify workflow logic
coho logs --follow
No redeployment needed—DRY_RUN is checked at runtime.
\n# Currently using SendGrid? Switch to Mailgun:
coho set-env EMAIL_PROVIDER \"mailgun\"
coho set-env MAILGUN_API_KEY \"your-key\"
coho set-env MAILGUN_DOMAIN \"mg.yourdomain.com\"
Your campaign keeps running. Zero downtime.
\nReceive delivery status, bounces, and unsubscribes from your email provider:
\n// SendGrid Event Webhook
app.post('/sendgrid-events', async (req, res) => {
const events = req.body;
const conn = await Datastore.open();
for (const event of events) {
if (event.event === 'bounce' || event.event === 'dropped') {
await conn.updateOne('subscribers',
{ email: event.email },
{ $set: { status: 'bounced', bouncedAt: new Date() }}
);
}
if (event.event === 'unsubscribe') {
await conn.updateOne('subscribers',
{ email: event.email },
{ $set: { status: 'unsubscribed' }}
);
}
}
res.json({ received: true });
});
Your email provider sends events to your webhook, and your campaign stays clean automatically.
\nHere's what running a production drip campaign actually costs:
\nSelf-hosted:
\nEmail automation SaaS:
\nSavings: $193-1,033/year while owning your infrastructure.
\nSelf-hosted:
\nEmail automation SaaS:
\nSavings: $2,293-4,693/year at scale.
\nThe difference? You own the code, control the data, and can switch email providers anytime. No vendor lock-in, no surprise overage fees, complete transparency.
\nThe drip email workflow template is open source and ready to deploy:
\nnpm install -g codehooks
coho create my-campaign --template drip-email-workflow
cd my-campaign
coho deploy
What's included:
\nBrowse all templates: codehooks.io/templates
\nThis webhook-driven approach is perfect for:
\nBut maybe not ideal for:
\nWebhooks are the backbone of modern SaaS integrations. But building reliable webhook infrastructure—endpoints that validate, store, queue, and process events—shouldn't require a DevOps team.
\nWith Codehooks, you get:
\nThe template showcases what's possible: webhook endpoints, cron scheduling, queue workers, database, email delivery—all in one platform. No Docker, no Kubernetes, no infrastructure complexity.
\nThis is what Codehooks is built for: turning webhooks into action.
\nThe drip email template currently supports SendGrid, Mailgun, and Postmark—but we're actively expanding provider support based on community feedback.
\nAmazon SES - AWS's cost-effective email service ($0.10 per 1,000 emails) is perfect for high-volume campaigns. With its proven reliability and deep AWS integration, SES is a natural fit for teams already on AWS infrastructure.
\nBrevo (formerly Sendinblue) - European privacy-focused alternative with generous free tier (300 emails/day) and advanced marketing automation features. Great for GDPR-conscious teams and startups testing their first drip campaigns.
\nPostal (Open Source) - For teams that want complete control, Postal offers a self-hosted email delivery platform. Deploy it alongside your Codehooks webhooks and own your entire email infrastructure—from webhook to inbox.
\nEmail deliverability isn't one-size-fits-all:
\nThe template's provider abstraction makes adding new integrations straightforward—just implement the email sending interface and configure the environment variables.
\nWant a specific provider? Open an issue or contribute an integration. The template is open source and accepts pull requests.
\nNew to Codehooks? Sign up for free and deploy your first webhook endpoint:
\nnpm install -g codehooks
coho create my-drip-campaign --template drip-email-workflow
Explore the code: Browse the complete template source code on GitHub to see how it works.
\nWant to explore more? Check out our backend API integration guide, other templates, webhook documentation, and queue workers.
\nQuestions? Email us at info@codehooks.io.
\nThis template is open source and production-ready. Deploy your webhook endpoints today and take back control of your automation stack.
", "url": "https://codehooks.io/blog/2026/01/01/webhook-email-automation", "title": "Webhook-Driven Email Automation in 5 Minutes", "summary": "Build production-ready webhook endpoints that power drip email campaigns. Connect Stripe, signup forms, and any service—own your automation stack.", "date_modified": "2026-01-01T00:00:00.000Z", "author": { "name": "Jones" }, "tags": [ "webhooks", "serverless", "email", "automation", "nodejs", "templates" ] }, { "id": "https://codehooks.io/blog/secure-zapier-make-n8n-webhooks-signature-verification", "content_html": "You've built a powerful automation: Stripe payment → Zapier → Slack notification + Google Sheet update + email confirmation. It works beautifully.
\nBut there's a problem: anyone who knows your Zapier webhook URL can trigger your automation with fake data.
\nThe same is true for Make (Integromat), n8n, and IFTTT. These platforms prioritize ease-of-use, but they don't verify that incoming webhooks are actually from Stripe, GitHub, or whoever you think is sending them.
\nThe solution? Use Codehooks as a verified webhook gateway that sits between the webhook sender and your automation platform.
\nIf you're used to no-code tools, the JavaScript examples below might look intimidating. You can use ChatGPT, Claude, or any AI assistant to generate and customize this code for you. Just share the Codehooks AI agent setup or point the AI to codehooks.io/llms.txt — it will understand how to write Codehooks code for your specific use case. AI coding agents like Claude Code can even run the CLI commands to deploy and configure everything for you.
![\"Secure](\"https://codehooks.io/assets/images/secure-automation-webhooks-572671b626b3765597c1a459ae34abbc.webp\")
When you set up a webhook trigger in Zapier, Make, n8n, or IFTTT, you get a URL like:
\nhttps://hooks.zapier.com/hooks/catch/123456/abcdef/
https://hook.eu1.make.com/abc123xyz
https://your-n8n.cloud/webhook/stripe-payments
https://maker.ifttt.com/trigger/{event}/with/key/{your_key}
These endpoints accept any HTTP POST request. There's no verification that:
\nIFTTT uses a key embedded in the URL, but this only authenticates your account — it doesn't verify the payload came from a legitimate source like Stripe.
\nZapier: The Zapier Community confirms that \"Webhooks by Zapier\" trigger does not support signature verification.
\nMake: Users in the Make Community discuss workarounds like header filtering and API keys, but there's no built-in signature verification for services like Stripe or GitHub.
\nn8n: There's an active feature request for HMAC verification. Currently, you need to implement it manually with Code nodes.
\nIFTTT: Uses a secret key embedded in the webhook URL. If someone obtains your key, they can trigger any event on your account. There's even a GitHub project created specifically to address this security gap.
\nAn attacker who discovers your webhook URL could:
\nInstead of sending webhooks directly to your automation platform, route them through Codehooks:
\n\nCodehooks handles the complex signature verification for each service, then forwards verified events to your automation platform.
\nHere's a complete example that verifies Stripe webhooks before forwarding to Zapier:
\ncoho create webhook-gateway
cd webhook-gateway
npm install stripe
Replace index.js with:
import { app, Datastore } from 'codehooks-js';
import Stripe from 'stripe';
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
// Bypass JWT for webhook endpoints
app.auth('/webhook/*', (req, res, next) => {
next();
});
// Verified Stripe → Zapier gateway
app.post('/webhook/stripe', async (req, res) => {
const sig = req.headers['stripe-signature'];
const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;
let event;
try {
// Verify the webhook is actually from Stripe
event = stripe.webhooks.constructEvent(req.rawBody, sig, webhookSecret);
} catch (err) {
console.error('Stripe signature verification failed:', err.message);
return res.status(400).json({ error: 'Invalid signature' });
}
// Log verified event for audit trail
const conn = await Datastore.open();
await conn.insertOne('verified_events', {
source: 'stripe',
eventId: event.id,
type: event.type,
verified: true,
receivedAt: new Date().toISOString(),
});
console.log(`Verified Stripe event: ${event.type}`);
// Forward to Zapier (now we know it's legitimate)
const zapierUrl = process.env.ZAPIER_WEBHOOK_URL;
try {
await fetch(zapierUrl, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
verified: true,
source: 'stripe',
eventType: event.type,
eventId: event.id,
data: event.data.object,
timestamp: new Date().toISOString(),
}),
});
} catch (err) {
console.error('Failed to forward to Zapier:', err.message);
// Store for retry
await conn.enqueue('retryForward', { event, target: 'zapier' });
}
res.status(200).json({ received: true, verified: true });
});
export default app.init();
Deploy and configure:
\ncoho deploy
coho set-env STRIPE_SECRET_KEY sk_live_xxxxx --encrypted
coho set-env STRIPE_WEBHOOK_SECRET whsec_xxxxx --encrypted
coho set-env ZAPIER_WEBHOOK_URL https://hooks.zapier.com/hooks/catch/xxxxx --encrypted
Now in your Stripe Dashboard, set the webhook URL to your Codehooks endpoint instead of Zapier directly.
\nVerify GitHub webhooks before forwarding to Make:
\nimport { app, Datastore } from 'codehooks-js';
import crypto from 'crypto';
app.auth('/webhook/*', (req, res, next) => {
next();
});
// Verified GitHub → Make gateway
app.post('/webhook/github', async (req, res) => {
const signature = req.headers['x-hub-signature-256'];
const secret = process.env.GITHUB_WEBHOOK_SECRET;
// Verify GitHub signature
const expectedSignature = 'sha256=' + crypto
.createHmac('sha256', secret)
.update(req.rawBody)
.digest('hex');
if (!crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expectedSignature)
)) {
console.error('GitHub signature verification failed');
return res.status(401).json({ error: 'Invalid signature' });
}
const event = req.headers['x-github-event'];
const delivery = req.headers['x-github-delivery'];
// Log verified event
const conn = await Datastore.open();
await conn.insertOne('verified_events', {
source: 'github',
eventId: delivery,
type: event,
verified: true,
receivedAt: new Date().toISOString(),
});
console.log(`Verified GitHub event: ${event}`);
// Forward to Make
const makeUrl = process.env.MAKE_WEBHOOK_URL;
await fetch(makeUrl, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
verified: true,
source: 'github',
event: event,
deliveryId: delivery,
payload: req.body,
timestamp: new Date().toISOString(),
}),
});
res.status(200).json({ received: true });
});
export default app.init();
Handle multiple webhook sources in one deployment:
\nimport { app, Datastore } from 'codehooks-js';
import Stripe from 'stripe';
import crypto from 'crypto';
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
app.auth('/webhook/*', (req, res, next) => {
next();
});
// Stripe webhooks
app.post('/webhook/stripe', async (req, res) => {
try {
const event = stripe.webhooks.constructEvent(
req.rawBody,
req.headers['stripe-signature'],
process.env.STRIPE_WEBHOOK_SECRET
);
await forwardVerified('stripe', event.type, event.id, event.data.object);
res.status(200).json({ received: true });
} catch (err) {
console.error('Stripe verification failed:', err.message);
res.status(400).json({ error: 'Invalid signature' });
}
});
// GitHub webhooks
app.post('/webhook/github', async (req, res) => {
const signature = req.headers['x-hub-signature-256'];
const expected = 'sha256=' + crypto
.createHmac('sha256', process.env.GITHUB_WEBHOOK_SECRET)
.update(req.rawBody)
.digest('hex');
if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
return res.status(401).json({ error: 'Invalid signature' });
}
await forwardVerified(
'github',
req.headers['x-github-event'],
req.headers['x-github-delivery'],
req.body
);
res.status(200).json({ received: true });
});
// Shopify webhooks
app.post('/webhook/shopify', async (req, res) => {
const hmac = req.headers['x-shopify-hmac-sha256'];
const expected = crypto
.createHmac('sha256', process.env.SHOPIFY_WEBHOOK_SECRET)
.update(req.rawBody)
.digest('base64');
if (hmac !== expected) {
return res.status(401).json({ error: 'Invalid signature' });
}
await forwardVerified(
'shopify',
req.headers['x-shopify-topic'],
req.headers['x-shopify-webhook-id'],
req.body
);
res.status(200).json({ received: true });
});
// Generic forward function
async function forwardVerified(source, eventType, eventId, data) {
const conn = await Datastore.open();
// Audit log
await conn.insertOne('verified_events', {
source,
eventType,
eventId,
verified: true,
receivedAt: new Date().toISOString(),
});
// Forward based on routing rules
const routes = {
stripe: process.env.ZAPIER_STRIPE_URL,
github: process.env.MAKE_GITHUB_URL,
shopify: process.env.N8N_SHOPIFY_URL,
// IFTTT example: https://maker.ifttt.com/trigger/{event}/with/key/{key}
paypal: process.env.IFTTT_PAYPAL_URL,
};
const targetUrl = routes[source];
if (!targetUrl) {
console.log(`No route configured for ${source}`);
return;
}
await fetch(targetUrl, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
verified: true,
source,
eventType,
eventId,
data,
verifiedAt: new Date().toISOString(),
}),
});
console.log(`Forwarded verified ${source} event to automation`);
}
export default app.init();
If your automation platform is temporarily down, queue events for retry:
\nimport { app, Datastore } from 'codehooks-js';
import Stripe from 'stripe';
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
app.auth('/webhook/*', (req, res, next) => {
next();
});
app.post('/webhook/stripe', async (req, res) => {
let event;
try {
event = stripe.webhooks.constructEvent(
req.rawBody,
req.headers['stripe-signature'],
process.env.STRIPE_WEBHOOK_SECRET
);
} catch (err) {
return res.status(400).json({ error: 'Invalid signature' });
}
const conn = await Datastore.open();
// Store verified event
await conn.insertOne('verified_events', {
source: 'stripe',
eventId: event.id,
type: event.type,
data: event.data.object,
forwarded: false,
receivedAt: new Date().toISOString(),
});
// Queue for async forwarding (handles retries automatically)
await conn.enqueue('forwardToZapier', {
eventId: event.id,
type: event.type,
data: event.data.object,
});
// Respond immediately to Stripe
res.status(200).json({ received: true });
});
// Worker handles forwarding with retries
app.worker('forwardToZapier', async (req, res) => {
const { eventId, type, data } = req.body.payload;
const response = await fetch(process.env.ZAPIER_WEBHOOK_URL, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
verified: true,
source: 'stripe',
eventType: type,
eventId,
data,
timestamp: new Date().toISOString(),
}),
});
if (!response.ok) {
throw new Error(`Zapier returned ${response.status}`);
}
// Mark as forwarded
const conn = await Datastore.open();
await conn.updateOne('verified_events', { eventId }, {
$set: { forwarded: true, forwardedAt: new Date().toISOString() }
});
console.log(`Forwarded event ${eventId} to Zapier`);
res.end();
});
export default app.init();
The examples above verify incoming webhooks from Stripe/GitHub/etc., but what about the forwarding to your automation platform? Here are three approaches:
\nAdd a shared secret as a custom header. Configure your automation platform to check for it:
\nawait fetch(zapierUrl, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'X-Gateway-Secret': process.env.GATEWAY_SECRET,
},
body: JSON.stringify({ verified: true, source, data }),
});
In Zapier/Make/n8n, add a filter step that checks X-Gateway-Secret matches your expected value. Requests without the correct header are rejected.
Let your automation platform verify events by calling back to Codehooks:
\n// Store verified events with a verification token
app.post('/webhook/stripe', async (req, res) => {
const event = stripe.webhooks.constructEvent(/* ... */);
const verificationToken = crypto.randomUUID();
const conn = await Datastore.open();
await conn.insertOne('verified_events', {
eventId: event.id,
token: verificationToken,
data: event.data.object,
expiresAt: new Date(Date.now() + 5 * 60 * 1000), // 5 min TTL
});
// Forward with verification token
await fetch(zapierUrl, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
eventId: event.id,
verificationToken,
verifyUrl: `https://your-app.api.codehooks.io/dev/verify/${event.id}`,
data: event.data.object,
}),
});
res.json({ received: true });
});
// Verification endpoint for automation platforms to call
app.get('/verify/:eventId', async (req, res) => {
const { eventId } = req.params;
const { token } = req.query;
const conn = await Datastore.open();
const event = await conn.getOne('verified_events', { eventId, token });
if (!event || new Date(event.expiresAt) < new Date()) {
return res.status(404).json({ verified: false });
}
res.json({ verified: true, eventId });
});
Your automation workflow first calls the verifyUrl to confirm the event is legitimate before processing.
At minimum, treat webhook URLs as secrets:
\ncoho set-env ... --encryptedThe random tokens in Zapier/Make/n8n URLs provide basic authentication — anyone with the URL can trigger your automation, so protect it accordingly.
\nWhich approach to use? For notifications and logging, secret URLs are sufficient. For business workflows, add header authentication. For financial or security-sensitive operations, consider callback verification.
\n| Feature | Direct to Zapier/Make/n8n/IFTTT | Via Codehooks Gateway |
|---|---|---|
| Signature verification | No | Yes |
| Audit trail | No | Yes (database) |
| Retry on failure | Limited | Built-in queues |
| Event replay | No | Yes |
| Rate limiting | No | Configurable |
| Data transformation | Limited | Full code control |
| Cost | Automation credits only | Small Codehooks cost |
Use a verified gateway when:
\nSkip it when:
\nCodehooks can verify signatures from any service. Here are guides for popular platforms:
\nCommon questions about securing automation webhooks
Deploy your verified webhook gateway in 5 minutes:
\ncoho create webhook-gateway
cd webhook-gateway
npm install stripe # or other SDKs you need
coho deploy
Configure your secrets:
\ncoho set-env STRIPE_WEBHOOK_SECRET whsec_xxxxx --encrypted
coho set-env ZAPIER_WEBHOOK_URL https://hooks.zapier.com/xxxxx --encrypted
Point your webhook sources (Stripe, GitHub, etc.) to your Codehooks URL instead of directly to Zapier/Make/n8n/IFTTT.
\nYour automations are now protected by cryptographic signature verification.
\nQuestions? Open an issue on GitHub or check the Codehooks documentation.
", "url": "https://codehooks.io/blog/secure-zapier-make-n8n-webhooks-signature-verification", "title": "Secure Your Automation Webhooks with Signature Verification (Zapier, Make, n8n, IFTTT)", "summary": "Generic webhook triggers in Zapier, Make, n8n, and IFTTT accept any incoming request without built-in cryptographic signature verification. Learn how to protect your automations by using Codehooks as a secure webhook gateway for Stripe, GitHub, Shopify, and other webhook sources.", "date_modified": "2025-12-07T00:00:00.000Z", "author": { "name": "Jones" }, "tags": [ "webhooks", "zapier", "make", "n8n", "ifttt", "automation", "security", "signature verification", "webhook gateway", "stripe webhooks", "github webhooks" ] }, { "id": "https://codehooks.io/blog/building-llm-workflows-javascript", "content_html": "Most AI projects don't need a fleet of orchestration tools to run a few prompt chains. The real work is state management, retries, scheduling, and simple persistence—the operational glue between LLM API calls.
\nThis post shows you how to build a production-ready text summarization workflow using Codehooks.io, the Workflow API, and OpenAI. You'll learn:
\nBy the end, you'll have a working summarizer that caches results, stores them in a NoSQL database, and can be triggered via REST API or GitHub webhooks—all deployed with a single command.
\nHere's the workflow we'll build:
\n\n![\"LLM](\"https://codehooks.io/assets/images/llm-workflows-with-javascript-fabcc4248110c188fad9f63bff9494db.webp\")
If you've built more than one \"simple\" AI script, you've likely met these issues:
\nThese are engineering problems, not “AI problems.” The question is: what’s the lightest reliable runtime that gives you state, retries, scheduling, and storage — without spinning up a new platform?
\nBetween prompt-chaining libraries and heavyweight workflow engines, there’s a practical middle:
\nThat’s the layer Codehooks provides. You write JavaScript; the platform handles routing, persistence, and workflow state. No extra orchestrator.
\n\n\nUseful links: Workflow API · AI agent setup
\n
Before diving into examples, let's establish solid patterns for OpenAI API integration in production workflows.
\nA reusable helper with retries and exponential backoff:
\nconst callOpenAIWithRetry = async (messages, options = {}, maxRetries = 3) => {
for (let attempt = 1; attempt <= maxRetries; attempt++) {
try {
const response = await fetch(
'https://api.openai.com/v1/chat/completions',
{
method: 'POST',
headers: {
'content-type': 'application/json',
authorization: `Bearer ${process.env.OPENAI_API_KEY}`,
},
body: JSON.stringify({
model: options.model || 'gpt-4o-mini',
messages,
temperature: options.temperature ?? 0.3,
max_tokens: options.max_tokens ?? 300,
}),
}
);
if (response.status === 429) {
// Rate limit - exponential backoff and retry
const delay = Math.pow(2, attempt) * 1000;
if (attempt < maxRetries) {
await new Promise((resolve) => setTimeout(resolve, delay));
continue;
}
}
if (!response.ok) {
const error = await response.text().catch(() => 'Unknown error');
throw new Error(`OpenAI API error ${response.status}: ${error}`);
}
const data = await response.json();
return data?.choices?.[0]?.message?.content?.trim() || '';
} catch (error) {
if (attempt === maxRetries) throw error;
// Wait before retry for network errors
await new Promise((resolve) => setTimeout(resolve, 1000 * attempt));
}
}
};
gpt-4o-mini for most tasks (significantly cheaper than GPT‑4 while still very capable)max_tokens limitsOpenAI rate limits depend on your account, model, and tier. They also change over time.
\nBest practices:
\ngpt-4o-mini) where possibleWe'll build a small workflow that accepts text, checks a cache, calls OpenAI, stores the result, and returns it. We’ll also add a webhook endpoint that can summarize GitHub issues and comments.
\nnpm install -g codehooks
coho create aipipeline
cd aipipeline
npm install codehooks-js node-fetch
coho set-env OPENAI_API_KEY 'sk-******' --encrypted
# Optional: for webhook signature verification (recommended for production)
coho set-env GITHUB_WEBHOOK_SECRET 'your-webhook-secret' --encrypted
index.jsReplace the default index.js created by coho create with this workflow code (all in one file for simplicity):
import { app, Datastore } from 'codehooks-js';
import fetch from 'node-fetch';
import crypto from 'crypto';
// Reusable OpenAI helper with retries and exponential backoff
async function callOpenAIWithRetry(messages, options = {}, maxRetries = 3) {
for (let attempt = 1; attempt <= maxRetries; attempt++) {
try {
const response = await fetch(
'https://api.openai.com/v1/chat/completions',
{
method: 'POST',
headers: {
'content-type': 'application/json',
authorization: `Bearer ${process.env.OPENAI_API_KEY}`,
},
body: JSON.stringify({
model: options.model || 'gpt-4o-mini',
messages,
temperature: options.temperature ?? 0.3,
max_tokens: options.max_tokens ?? 300,
}),
}
);
if (response.status === 429) {
// Rate limit - exponential backoff and retry
const delay = Math.pow(2, attempt) * 1000;
if (attempt < maxRetries) {
await new Promise((resolve) => setTimeout(resolve, delay));
continue;
}
}
if (!response.ok) {
const error = await response.text().catch(() => 'Unknown error');
throw new Error(`OpenAI API error ${response.status}: ${error}`);
}
const data = await response.json();
return data?.choices?.[0]?.message?.content?.trim() || '';
} catch (error) {
if (attempt === maxRetries) throw error;
// Wait before retry for network or transient errors
await new Promise((resolve) => setTimeout(resolve, 1000 * attempt));
}
}
}
// Helper function to verify GitHub webhook signature using raw body
function verifyGitHubSignature(rawBody, signatureWithPrefix, secret) {
if (!signatureWithPrefix || !secret) return false;
if (!signatureWithPrefix.startsWith('sha256=')) return false;
const signature = signatureWithPrefix.slice('sha256='.length);
const expected = crypto
.createHmac('sha256', secret)
.update(rawBody)
.digest('hex');
// Use timingSafeEqual to avoid timing attacks
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected)
);
}
// Workflow: summarize text and store
const summarizeWorkflow = app.createWorkflow(
'summarize',
'Summarize text using OpenAI and store the result',
{
start: async (state, goto) => {
if (!state?.text) return goto(null, { error: 'Missing text input' });
goto('checkCache', { ...state, steps: ['start'] });
},
checkCache: async (state, goto) => {
const db = await Datastore.open();
// Use MD5 hash of entire text for proper cache key
const key = `summary:${crypto
.createHash('md5')
.update(state.text)
.digest('hex')}`;
const cached = await db.get(key);
const newState = {
...state,
steps: [...(state.steps || []), 'checkCache'],
};
// If cached, skip to finish without storing duplicate
if (cached) {
return goto('finish', {
...newState,
summary: cached,
cached: true,
});
}
goto('callOpenAI', newState);
},
callOpenAI: async (state, goto) => {
const newState = {
...state,
steps: [...(state.steps || []), 'callOpenAI'],
};
// OpenAI API call via the reusable helper
const summary = await callOpenAIWithRetry(
[
{ role: 'system', content: 'You are a helpful assistant.' },
{ role: 'user', content: `Summarize this:
${state.text}` },
],
{
model: 'gpt-4o-mini', // Cost-effective model for summarization
temperature: 0.3, // Lower temperature for consistent summaries
max_tokens: 300, // Limit tokens to control costs
}
);
goto('cacheAndStore', { ...newState, summary });
},
cacheAndStore: async (state, goto) => {
const db = await Datastore.open();
// Use MD5 hash for consistent cache key
const key = `summary:${crypto
.createHash('md5')
.update(state.text)
.digest('hex')}`;
// TTL is in milliseconds – 60 * 1000 = 60 seconds
await db.set(key, state.summary, { ttl: 60 * 1000 });
goto('store', {
...state,
steps: [...(state.steps || []), 'cacheAndStore'],
});
},
store: async (state, goto) => {
const db = await Datastore.open();
const doc = await db.insertOne('summaries', {
text: state.text,
summary: state.summary,
cached: !!state.cached,
source: state.source || 'api',
repository: state.repository || null,
createdAt: new Date().toISOString(),
});
goto('finish', {
...state,
...doc,
steps: [...(state.steps || []), 'store'],
});
},
finish: async (state, goto) => {
const steps = [...(state.steps || []), 'finish'];
console.log('Workflow finished');
console.log('WorkflowId:', state._id || 'N/A');
console.log('Steps executed:', steps.join(' → '));
goto(null, { ...state, steps });
},
}
);
// HTTP endpoints
// Direct API trigger for summarization
app.post('/summaries', async (req, res) => {
const result = await summarizeWorkflow.start({ text: req.body?.text });
res.json(result);
});
// Fetch stored summaries
app.get('/summaries', async (req, res) => {
const db = await Datastore.open();
const items = await db
.getMany('summaries', {}, { sort: { createdAt: -1 }, limit: 10 })
.toArray();
res.json(items);
});
// Webhook endpoint - trigger summarization from GitHub issues, comments, or generic payloads
app.post('/webhook/summarize', async (req, res) => {
// Verify webhook signature for security (GitHub-style HMAC)
if (process.env.GITHUB_WEBHOOK_SECRET) {
const signature = req.headers['x-hub-signature-256'];
const ok = verifyGitHubSignature(
req.rawBody,
signature,
process.env.GITHUB_WEBHOOK_SECRET
);
if (!ok) {
return res.status(401).json({ error: 'Invalid signature' });
}
}
// Extract text from GitHub issue webhook payload
// Supports: issue opened, issue comment, pull request, or generic text
let text = '';
let source = 'webhook';
if (req.body.issue) {
// GitHub issue or PR
text = `${req.body.issue.title}
${req.body.issue.body || ''}`;
source = `github-issue-${req.body.issue.number}`;
} else if (req.body.comment) {
// GitHub issue/PR comment
text = req.body.comment.body;
source = `github-comment-${req.body.comment.id}`;
} else {
// Generic fallback for other webhook providers
text = req.body?.content || req.body?.text || req.body?.message || '';
}
if (!text || text.trim().length === 0) {
return res
.status(400)
.json({ error: 'No text content in webhook payload' });
}
// Start workflow asynchronously
const result = await summarizeWorkflow.start({
text: text.trim(),
source,
repository: req.body.repository?.full_name || 'unknown',
});
// Return a lightweight response while the workflow runs in the background
res.json({ status: 'processing', workflowId: result._id });
});
export default app.init();
\n\nIn Codehooks,
\nreq.rawBodycontains the unparsed request body, which is required for correct webhook signature verification with providers like GitHub.
Now deploy your code and get your API endpoint:
\n$ coho deploy
Project: aipipeline-4cqe Space: dev
Deployed Codehook successfully! 🙌
Check your logs with: coho logs --follow
The coho info command shows your deployment details and if you add the --examples parameter it also provides example cURL commands. Here's what to look for:
$ coho info --examples
Project name: aipipeline-4cqe
Team: Amy Jones (personal account)
API endpoints:
https://funny-wizard-xyz9.codehooks.io
https://aipipeline-4cqe.api.codehooks.io/dev
https://api.example.com
Examples in cURL:
curl -H 'x-apikey: 73c53e83-c8b5-4b5f-8452-65ebca859ac1' -H 'Content-Type: application/json' https://funny-wizard-xyz9.codehooks.io/users
curl -H 'x-apikey: 73c53e83-c8b5-4b5f-8452-65ebca859ac1' -H 'Content-Type: application/json' --data-raw '{\"name\": \"Mr. Code Hooks\", \"active\": true }' --request POST https://funny-wizard-xyz9.codehooks.io/users
Spaces:
┌──────────────┬────────────────────────────────────────────┬───────────────┬──────┬────────────────────────────┐
│ Name │ Tokens │ Allowed Hosts │ Jwks │ Env │
├──────────────┼────────────────────────────────────────────┼───────────────┼──────┼────────────────────────────┤
│ dev (active) │ xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (RW) │ │ │ OPENAI_API_KEY=(encrypted) │
└──────────────┴────────────────────────────────────────────┴───────────────┴──────┴────────────────────────────┘
API Endpoint: Use any of the URLs listed. The first one is a unique random name for the space. The second one (https://aipipeline-4cqe.api.codehooks.io/dev) includes the project name and space name. The third one is a custom domain you can set up for your project.
API Token: Copy one of the tokens from the Tokens column in the Spaces table (the UUID values marked with RW for read-write access). Use this token as the value for the x-apikey header in your API calls.
You can test the workflow using cURL commands, a reusable shell script, or API clients like Bruno, Postman, or Insomnia.
\nReplace the URL and token with your values from coho info:
# Start a summarization
curl -X POST https://aipipeline-4cqe.api.codehooks.io/dev/summaries \\
-H \"Content-Type: application/json\" \\
-H \"x-apikey: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\" \\
-d '{
\"text\": \"Artificial intelligence is transforming software development. Modern AI tools help developers write code faster, debug more efficiently, and build smarter applications. From code completion to automated testing, AI is becoming an essential part of the developer toolkit.\"
}'
# Response example:
# {
# \"_id\": \"abc123...\",
# \"text\": \"Artificial intelligence is transforming...\",
# \"summary\": \"AI tools are revolutionizing software development by enhancing code writing, debugging, and application intelligence.\",
# \"cached\": false,
# \"source\": \"api\",
# \"repository\": null,
# \"createdAt\": \"2025-11-15T10:30:00.000Z\"
# }
# Fetch stored summaries
curl https://aipipeline-4cqe.api.codehooks.io/dev/summaries \\
-H \"x-apikey: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\"
# Trigger via webhook (simulating GitHub issue webhook)
curl -X POST https://aipipeline-4cqe.api.codehooks.io/dev/webhook/summarize \\
-H \"Content-Type: application/json\" \\
-d '{
\"action\": \"opened\",
\"issue\": {
\"number\": 123,
\"title\": \"Application crashes on startup\",
\"body\": \"When I run the application, it immediately crashes with error code 500. This happens on both macOS and Linux.\"
},
\"repository\": {
\"full_name\": \"myorg/myrepo\"
}
}'
For a more visual testing experience, use API clients. All three support importing cURL commands - just copy any of the cURL examples from Option 1 above and use the \"Import from cURL\" feature in your preferred tool.
\nFor easier repeated testing, create a summarize.sh script that handles text via argument, stdin, or uses sample text:
#!/bin/bash
PROJECTNAME=your-project-name
API_KEY=\"your-api-key\"
# Check if text is provided as argument
if [ -n \"$1\" ]; then
TEXT=\"$1\"
echo \"Original text length: ${#TEXT} characters\"
elif [ ! -t 0 ]; then
# Read from stdin if available (not a TTY)
TEXT=$(cat)
echo \"Read from stdin, length: ${#TEXT} characters\"
else
# Use a sample text
TEXT=\"Artificial intelligence is transforming software development...\"
echo \"Using sample text\"
fi
# Escape the text for JSON
TEXT_ESCAPED=$(echo \"$TEXT\" | jq -Rs .)
curl -X POST https://${PROJECTNAME}.api.codehooks.io/dev/summaries \\
-H \"Content-Type: application/json\" \\
-H \"x-apikey: $API_KEY\" \\
-d \"{\\\"text\\\": $TEXT_ESCAPED}\"
Usage examples:
\n# Make it executable
chmod +x summarize.sh
# Use sample text
./summarize.sh
# Provide text as argument
./summarize.sh \"Your custom text here\"
# Read from file via stdin
cat article.txt | ./summarize.sh
./summarize.sh < article.txt
# Test with long texts without truncation
echo \"Very long text content...\" | ./summarize.sh
When testing with long texts, always use stdin (piping or redirection) rather than command-line arguments. Shell arguments have length limits that can truncate your text. The script automatically detects the input method and reports text length before sending.
After running your workflows, you can inspect their execution status with live updates:
\n# One-time snapshot
coho workflow-status
# Live updates (recommended) - updates every 2 seconds
coho workflow-status --follow
The coho workflow-status --follow command provides live monitoring of your workflows, updating every 2 seconds. This is invaluable for watching workflows execute in real-time:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Workflow Status (Live) - Press Ctrl+C to exit
Last updated: 20:22:08 | Next update in 2s
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Workflow Report
===============
Total workflow instances: 4
Unique steps: 6
Workflow Structure (6 steps):
1. start
2. checkCache
3. callOpenAI
4. cacheAndStore
5. store
6. finish
Current State Distribution:
start checkCache callOpenAI cacheAndStore store finish
------------ -------------- -------------- ----------------- ------------ ------------
1 0 1 0 0 2
What this tells you:
finish in this example)This visibility is crucial for debugging production workflows and understanding execution patterns. Use --follow during development and testing to see your workflows in action!
state and Datastore; steps remain small and testable.callOpenAI without duplicating store).app.job() if you want periodic summaries.MD5 hash for cache keys: Using crypto.createHash('md5').update(state.text).digest('hex') creates a unique, consistent cache key based on the entire text content.
Proper cache flow: When a cached summary is found, the workflow goes directly to the finish step instead of creating a duplicate database record. This prevents storing the same summary multiple times while still allowing cache hits to avoid expensive OpenAI API calls. The TTL is set to 60 seconds, so the summary will be refreshed after 60 seconds. This is a trade-off between freshness and cost. You can change the TTL to your needs.
Finish step with tracking: Every workflow path ends at a finish step that logs:
start → checkCache → finish for cached vs start → checkCache → callOpenAI → cacheAndStore → store → finish for uncached)This makes it easy to verify caching is working and debug any issues.
\nStep tracking: Each step adds itself to a steps array in the state, providing full visibility into the workflow execution path. This is invaluable for debugging and understanding how workflows behave in production.
To add more LLM calls (e.g., classify → summarize → sentiment analysis), simply add more steps to the workflow. Each step receives the state from the previous step and can add new properties before calling goto():
classify: async (state, goto) => {
// Call OpenAI for classification
const category = await callOpenAIWithRetry(
[{ role: 'user', content: 'Classify this: ' + state.text }],
{ model: 'gpt-4o-mini' }
);
goto('summarize', {
...state,
category,
steps: [...(state.steps || []), 'classify'],
});
},
summarize: async (state, goto) => {
// Use category in the prompt
const summary = await callOpenAIWithRetry(
[
{
role: 'user',
content: `Summarize this ${state.category} text: ${state.text}`,
},
],
{ model: 'gpt-4o-mini' }
);
goto('sentiment', {
...state,
summary,
steps: [...(state.steps || []), 'summarize'],
});
},
sentiment: async (state, goto) => {
const sentiment = await callOpenAIWithRetry(
[{ role: 'user', content: 'Analyze sentiment: ' + state.text }],
{ model: 'gpt-4o-mini' }
);
goto('store', {
...state,
sentiment,
steps: [...(state.steps || []), 'sentiment'],
});
},
The pattern remains the same regardless of how many steps you chain together. Split steps into separate files for larger workflows.
\nWebhooks enable event-driven AI workflows. External services (GitHub, Slack, Stripe) can trigger workflows automatically when events occur — no polling required.
\nHere’s a variation on the previous webhook example, where a workflow triages newly opened issues. You can reuse the same verifyGitHubSignature helper from the main index.js example above.
app.post('/webhook/github', async (req, res) => {
// Verify signature using req.rawBody
if (process.env.GITHUB_WEBHOOK_SECRET) {
const signature = req.headers['x-hub-signature-256'];
const ok = verifyGitHubSignature(
req.rawBody,
signature,
process.env.GITHUB_WEBHOOK_SECRET
);
if (!ok) {
return res.status(401).json({ error: 'Invalid signature' });
}
}
const event = req.body;
if (event.action === 'opened' && event.issue) {
// Classify and tag new issues automatically
await issueTriageWorkflow.start({
title: event.issue.title,
body: event.issue.body,
issueNumber: event.issue.number,
repository: event.repository.full_name,
});
}
res.json({ received: true });
});
req.rawBody (not parsed JSON)Workflows can be triggered through multiple channels, each suited to different use cases:
\nreq.rawBody| Trigger Type | Use Case | Best For |
|---|---|---|
| REST API | Direct invocation | User-initiated actions, manual triggers |
| Webhooks | External events | GitHub issues, Slack messages, payment events |
| Scheduled Jobs | Time-based | Periodic summaries, daily reports, cleanup tasks |
For interactive prompting setups, see: AI agent setup.
\nYou might still want Airflow, Prefect, or other orchestration platforms when you have:
\nCodehooks can still host the execution layer for these systems (expose endpoints, persist results, schedule jobs), but it's not a replacement for large ETL platforms.
\nIf the hard part of your AI project is connecting steps reliably—not training models—then a light workflow runtime is usually enough. Codehooks gives you small functions, a state machine, storage, and a single deploy target.
\nThese LLM workflows can be triggered and managed through APIs, CLI, or webhooks—giving you flexible control while maintaining clear operational boundaries.
\nIf you’re already calling OpenAI from Node, you’re only a few minutes away from turning your script into a resilient workflow.
\nCommon questions about building LLM workflows, orchestration, and OpenAI API integration
Useful links: Workflow API · AI agent setup
", "url": "https://codehooks.io/blog/building-llm-workflows-javascript", "title": "Building Webhook-Enabled LLM Workflows in JavaScript with Codehooks.io", "summary": "Learn how to build reliable, production-ready LLM workflows using Codehooks.io, the Workflow API, and JavaScript — with OpenAI integration, webhook triggers (like GitHub issues), and state management.", "date_modified": "2025-11-24T00:00:00.000Z", "author": { "name": "Martin", "url": "https://github.com/canuto" }, "tags": [ "ai", "llm", "backend", "workflow", "serverless", "javascript", "webhooks" ] }, { "id": "https://codehooks.io/blog/build-webhook-delivery-system-5-minutes-codehooks-io", "content_html": "You've built an amazing application. Users love it. Now they're asking: \"Can you send webhooks when events happen?\"
\nMaybe it's:
\nThe problem? Building a production-ready webhook delivery system from scratch takes weeks. Setting up webhook infrastructure, managing webhook queues, and handling webhook retries is complex.
\nThe solution? Use this Codehooks.io webhook template and have webhook delivery running in 5 minutes.
\n![\"webhook](\"https://codehooks.io/assets/images/webhook.delivery-1b3c347742ac971d85b8541a4fd84809.webp\")
Imagine you're building an order management system. Your customers want to know immediately when orders are created, payments are processed, or items are shipped.
\nThey don't want to poll your API every few seconds. They want webhooks - real-time HTTP callbacks with webhook delivery when events occur.
\nBut you don't want to spend weeks building webhook infrastructure, webhook queues, and webhook retry logic. You want to focus on your core product.
\nThis webhook template solves that. Deploy it once, and you have a complete webhook delivery system with automatic retries, HMAC signing, and queue-based processing.
\nBuilding webhooks from scratch means implementing:
\nEstimated time: 2-4 weeks for an experienced developer.
\nMaintenance: Ongoing updates, security patches, webhook scaling issues.
\nSeveral services exist for webhook delivery:
\nWebhook Relay - Webhook forwarding and tunneling service. Great for routing webhooks to private networks, but you still need to build the webhook delivery logic yourself. Pricing starts at $7.50/month.
\nHookdeck - Webhook infrastructure platform. Excellent for receiving and routing webhooks, but primarily focused on inbound webhooks. For outbound webhooks, you need their paid plans starting at $15/month.
\nSvix - Dedicated webhook sending service. Powerful but expensive ($250/month for production). Closed-source SaaS with vendor lock-in.
\nZapier Webhooks - Webhook automation. Great for no-code workflows, but limited customization and can be costly at scale ($20-$50+/month).
\nCodehooks.io takes a different approach: Instead of a rigid SaaS platform, you get full source code that you can deploy, customize, and enhance with AI assistance.
\nWhy this matters:
\nFull Control - You own the code. Modify webhook payload structure, add custom headers, implement tenant-specific logic, or integrate with your existing systems. No API limitations.
\nAI-Powered Customization - Use Claude, ChatGPT, or any LLM to modify the template instantly:
\nCost-Effective - Free tier for development. Production plans start at $19/month with generous API limits and predictable costs. No surprise bills as you scale.
\nNo Vendor Lock-In - The code is yours. Move it anywhere if needed. Export your webhook data anytime.
\nProduction-Ready Template - Don't start from scratch. Get queue-based delivery, HMAC signing, retry logic, SSRF protection, and webhook monitoring out of the box.
\nServerless Scaling - Automatic scaling built into Codehooks.io. Handle 10 webhooks or 10,000 without infrastructure changes.
\nThe code-first approach means you get the best of both worlds: rapid deployment like a SaaS platform, but with the flexibility and cost-effectiveness of custom code.
\nInstead of weeks of development or expensive SaaS subscriptions:
\ncoho create mywebhooks --template webhook-delivery
cd mywebhooks
npm install
coho deploy
Time: 5 minutes.
\nCost: Free tier for development, pick a paid plan suitable for production volumes.
\nCustomization: Ask an AI to modify the code for your exact needs.
\nMaintenance: Platform handles scaling, security, and infrastructure.
\ncoho create mywebhooks --template webhook-delivery
cd mywebhooks
npm install
coho deploy
You'll get a URL like: https://my-webhooks-abc123.api.codehooks.io/dev
export API_URL=\"https://my-webhooks-abc123.api.codehooks.io/dev\"
export CODEHOOKS_API_KEY=\"your-api-key-here\"
# Register a webhook (use webhook.site for testing)
curl -X POST $API_URL/webhooks \\
-H \"Content-Type: application/json\" \\
-H \"x-apikey: $CODEHOOKS_API_KEY\" \\
-d '{
\"clientId\": \"test-client-1\",
\"url\": \"https://webhook.site/your-unique-id\",
\"events\": [\"order.created\"]
}'
# Trigger an event
curl -X POST $API_URL/events/trigger/order.created \\
-H \"Content-Type: application/json\" \\
-H \"x-apikey: $CODEHOOKS_API_KEY\" \\
-d '{\"orderId\": \"12345\", \"total\": 99.99}'
Check webhook.site - your webhook was delivered! 🎉
\nOnce deployed, integrate webhook triggering into your application code:
\n// In your order creation code
async function createOrder(orderData) {
const order = await db.orders.insertOne(orderData);
// Trigger webhook event
fetch(`${WEBHOOK_SERVICE_URL}/events/trigger/order.created`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'x-apikey': process.env.CODEHOOKS_API_KEY
},
body: JSON.stringify({
orderId: order.id,
total: order.total,
createdAt: order.createdAt
})
}).catch(err => console.error('Webhook trigger failed:', err));
return order;
}
import requests
import os
def create_order(order_data):
order = db.orders.insert_one(order_data)
# Trigger webhook event
try:
requests.post(
f\"{WEBHOOK_SERVICE_URL}/events/trigger/order.created\",
headers={\"x-apikey\": os.environ[\"CODEHOOKS_API_KEY\"]},
json={\"orderId\": str(order.inserted_id), \"total\": order_data[\"total\"]},
timeout=5
)
except Exception as e:
print(f\"Webhook trigger failed: {e}\")
return order
Just make an HTTP POST request:
\ncurl -X POST https://your-webhook-service.api.codehooks.io/dev/events/trigger/order.created \\
-H \"Content-Type: application/json\" \\
-H \"x-apikey: YOUR_CODEHOOKS_API_KEY\" \\
-d '{\"orderId\": \"12345\", \"total\": 99.99}'
That's it! The webhook delivery service handles:
\nHere’s how webhook events are triggered, queued, and delivered at scale:
\n\nYour application manages webhook subscriptions on behalf of customers:
\nPOST /webhooks # Register webhook endpoint
GET /webhooks # List all webhook subscriptions
GET /webhooks/:id # Get webhook details
PATCH /webhooks/:id # Update webhook configuration
DELETE /webhooks/:id # Delete webhook subscription
GET /webhooks/:id/stats # Webhook delivery statistics
POST /webhooks/:id/retry # Retry failed webhook deliveries
Important: This webhook API is for your application, not directly exposed to customers. Build your own UI where customers configure webhook endpoints, then your backend calls this webhook service.
\nWebhook Integration Flow:
\nPOST /webhooks to register the webhookPOST /events/trigger/:eventTypeAny webhook event name works - no configuration needed:
\nPOST /events/trigger/order.created
POST /events/trigger/payment.succeeded
POST /events/trigger/sensor.reading
POST /events/trigger/anything.you.want
// When order is created
await fetch(`${WEBHOOK_URL}/events/trigger/order.created`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'x-apikey': process.env.CODEHOOKS_API_KEY
},
body: JSON.stringify({ orderId, items, shippingAddress })
});
# When report is ready
requests.post(
f\"{webhook_url}/events/trigger/report.completed\",
headers={\"x-apikey\": os.environ[\"CODEHOOKS_API_KEY\"]},
json={\"reportId\": report_id, \"downloadUrl\": url}
)
// When sensor detects anomaly
import (
\"bytes\"
\"encoding/json\"
\"net/http\"
\"os\"
)
payload := map[string]interface{}{
\"deviceId\": device.ID,
\"temperature\": reading.Temperature,
}
jsonData, _ := json.Marshal(payload)
req, _ := http.NewRequest(\"POST\",
webhookURL+\"/events/trigger/sensor.alert\",
bytes.NewBuffer(jsonData))
req.Header.Set(\"Content-Type\", \"application/json\")
req.Header.Set(\"x-apikey\", os.Getenv(\"CODEHOOKS_API_KEY\"))
http.DefaultClient.Do(req)
Common questions about webhook delivery, security, and customization
/webhooks/:id/retry endpoint to re-enable webhook delivery.\"events\": [\"*\"] to receive all webhook events./events/trigger/order.created with {\"orderId\": \"123\", \"total\": 99.99}, customers receive a structured payload with id, type, created timestamp, and your data in the data field.node test-receiver.js).Deploy your webhook system in minutes:
\ncoho create mywebhooks --template webhook-delivery
cd mywebhooks
coho deploy
Integrate webhook delivery into your app:
\nawait fetch(`${WEBHOOK_URL}/events/trigger/${eventType}`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'x-apikey': process.env.CODEHOOKS_API_KEY
},
body: JSON.stringify(eventData)
});
The webhook delivery system handles everything else automatically.
\nvs. Building from Scratch: Save 2-4 weeks of development time. Get production-ready webhook infrastructure immediately.
\nvs. Webhook Relay / Hookdeck: You own the webhook code. Full customization with AI assistance. Lower cost at scale.
\nvs. Svix: 10x cheaper for webhook delivery. No vendor lock-in. Modify webhook logic directly in your codebase.
\nvs. Zapier: Developer-focused webhook solution. API-first, not UI-first. Unlimited webhook customization.
\nThe Codehooks.io difference: Code-first webhook platform that combines rapid deployment, AI-powered customization, and cost-effective scaling.
\nQuestions about webhook delivery? Open an issue on GitHub.
", "url": "https://codehooks.io/blog/build-webhook-delivery-system-5-minutes-codehooks-io", "title": "Build a Webhook Delivery System in 5 Minutes with Codehooks.io", "summary": "Instantly deploy a production-grade webhook delivery system with retries, queues, HMAC signing, and full customization using Codehooks.io. Save weeks of engineering time—add secure, reliable webhooks to any app in minutes.", "date_modified": "2025-11-23T00:00:00.000Z", "author": { "name": "Jones" }, "tags": [ "webhook delivery", "webhooks", "webhook infrastructure", "webhook API", "webhook system", "outgoing webhooks", "webhook queue", "webhook retries", "webhook HMAC signing", "webhook monitoring", "webhook integration", "webhook service", "webhook platform", "webhook management" ] }, { "id": "https://codehooks.io/blog/api-rest-api-guide", "content_html": "An API is an interface that lets software communicate by defining how to make requests and receive responses. A REST API is a specific kind of API that follows REST principles over HTTP—using methods like GET, POST, PUT, and DELETE to work with resources. All REST APIs are APIs, but not all APIs are REST.
\nConfused? Don't worry. In this post, you'll learn everything about the API and REST API domain—from core concepts and key differences to how REST+JSON became the web's standard. We'll explore why REST APIs dominate today's development landscape, compare different backend service models, and finally show you how to build your own APIs in practice using Codehooks.io.
\n| Topic | API (general) | REST API |
|---|---|---|
| Definition | Interface for software to communicate | API that follows REST constraints |
| Protocols | Any (HTTP, gRPC, SOAP, SDK) | HTTP with standard methods |
| Data format | Any (JSON, XML, binary) | Usually JSON |
| URLs | Not required | Resource URLs like /users/123 |
| Examples | GraphQL API, SOAP service, SDK calls | GitHub REST API, Twitter REST API |
![\"API](\"https://codehooks.io/assets/images/api-integration-5d16e3ccd4d12275b6ac4ca2ead45935.webp\")
API stands for Application Programming Interface.
\nThink of an API as a messenger that allows two different applications to communicate. For example:
\nAPIs hide complexity and give developers clean, documented entry points. Instead of dealing with internal systems directly, you simply make calls to the API and get back data or results.
\nA textbook classic: think of an API as a restaurant menu.
A REST API is an API designed around REST (Representational State Transfer): a resource‑oriented way to use HTTP so clients and servers can interact predictably and at scale.
\nREST constraints (plain English):
\n/users/123.Accept/Content-Type.GET (read), POST (create), PUT (replace), PATCH (partial update), DELETE (delete).In practice, REST models “things” (resources) with nouns, exposes them at URLs, and manipulates them with standard HTTP methods, returning machine‑readable representations (often JSON) plus meaningful status codes.
\nIf you're new to HTTP, this is the text which is actually sent and received when you POST a new todo resource. The client here is actually the curl command (as you can see from the User-Agent header).
Request (create a new todo resource with HTTP POST)
POST https://<project>.api.codehooks.io/dev/api/todos HTTP/1.1
Host: <project>.api.codehooks.io
Authorization: Bearer <your_api_token>
Content-Type: application/json
Accept: application/json
User-Agent: curl/8.6.0
{
\"title\": \"Read about REST\",
\"done\": false
}
Response
HTTP/1.1 201 Created
Content-Type: application/json; charset=utf-8
Cache-Control: no-store
Date: Tue, 24 Sep 2025 10:15:32 GMT
{
\"_id\": \"66f2c47b7f7b4d7f9d2d5a41\",
\"title\": \"Read about REST\",
\"done\": false,
\"createdAt\": \"2025-09-24T10:15:32.421Z\"
}
Request
https://<project>.api.codehooks.io/dev/api/todos{ \"title\": \"Read about REST\", \"done\": false }Response
{ \"_id\": \"...\", \"title\": \"Read about REST\", ... }Developers love REST APIs because they’re:
\nThat’s why REST APIs are everywhere—from social media and e-commerce to finance and IoT.
\n/users, /orders/:id200, 201, 204, 400, 401, 404, 429, 500PUT and DELETE; keep GET safe?limit=20&cursor=<token>ETag, Cache-ControlAuthorization: Bearer <token>/createUser) instead of resource nouns (/users)200 OK for all outcomes instead of specific status codesPUT (replace) with PATCH (partial update)Over the past decade, REST combined with JSON has become the default way for applications, platforms, and services to integrate. There are several reasons for this dominance:
\nIn short, REST and JSON became the industry standard because they hit the sweet spot: simple, universal, and good enough for most integration scenarios.
\nTo understand REST’s dominance, it helps to see where it came from:
\nDespite newer entrants like GraphQL or gRPC, REST and JSON remain dominant because they're simple, universal, and \"good enough\" for most integrations.
\nAs REST APIs became the standard for integration, developers needed better ways to build and host them. This led to the rise of specialized cloud services that handle the heavy lifting of API development and deployment.
\nLet's look at how different backend service models support API development, and what that means for your tech stack choices.
\nWhen choosing where to build your APIs, you’ll often encounter Backend-as-a-Service (BaaS) and Database-as-a-Service (DBaaS) platforms. Both help you move faster, but they differ in what they provide out of the box.
\n| Category | Popular Examples | What You Get | API Support |
|---|---|---|---|
| BaaS (Backend-as-a-Service) | Firebase, Supabase, Codehooks.io | Full backend services: auth, database, serverless functions, hosting, queues, workflows | Rich API support, often automatic REST/GraphQL endpoints for data + custom logic APIs |
| DBaaS (Database-as-a-Service) | MongoDB Atlas, AWS DynamoDB, PlanetScale | Managed database only: scaling, replication, backups | APIs are database-centric; usually SDKs or query APIs, REST/GraphQL APIs must be built separately |
For most developers looking to build modern apps quickly, BaaS solutions with strong API support are the better starting point.
\nTraditionally, building a REST API means:
\nWith Codehooks.io, you can skip all that.
\nCodehooks.io gives you:
\nHere’s how you can create a REST API in seconds:
\nimport { app } from 'codehooks-js';
// Use Crudlify to create a CRUD REST API for any database collection
app.crudlify();
export default app.init();
Deploy it, and you instantly have endpoints like:
\nGET /api/todos → list todosPOST /api/todos → create a new todoPUT /api/todos/:id → update a todoDELETE /api/todos/:id → delete a todo👉 That’s a fully functional REST API without servers, frameworks, or database setup.
\nCommon questions about APIs, REST APIs, and modern backend development
If you want to experiment, prototype, or launch production-ready REST APIs fast, try Codehooks.io. You can deploy your first REST API in minutes—without servers, frameworks, or endless configuration.
", "url": "https://codehooks.io/blog/api-rest-api-guide", "title": "API vs REST API: Simple Guide with Clear Differences and Examples", "summary": "Learn API vs REST API in minutes. Clear definitions, difference table, real HTTP request/response example, REST principles, and when to use each.", "date_modified": "2025-09-18T00:00:00.000Z", "author": { "name": "Jones" }, "tags": [ "api", "rest-api", "backend", "integration", "json", "serverless", "baas", "development" ] }, { "id": "https://codehooks.io/blog/vibe-coding-tools", "content_html": "Updated February 2026 with new tools (Windsurf, OpenAI Codex CLI, Gemini CLI) and refreshed pricing, stats, and feature descriptions across all entries.
\nEver notice how some days you're a caffeinated code ninja ready to refactor an entire codebase, while other days you can barely muster the energy to fix a typo? Welcome to the wonderfully human world of vibe coding – and the tools that get it.
\nThe term \"vibe coding\" and the concept of \"vibe coding tools\" was popularized by Andrej Karpathy in a February 2025 tweet, where the renowned AI researcher and former Tesla AI director coined the phrase to describe development tools that seem to intuitively understand your current energy level and coding mood – tools that adapt to you rather than forcing you to adapt to them.
\n![\"Vibe](\"https://codehooks.io/assets/images/vibe-coding-tools-bc5b05aceb9407accdcc00a83d143de9.webp\")
The concept resonated deeply with the developer community because it captured something we'd all experienced but never quite articulated. Picture this: It's 2 AM, you're debugging a particularly stubborn API integration, your coffee has gone cold, and suddenly your AI assistant suggests exactly the right solution with minimal fuss. That's a vibe coding tool – it just gets what you need right now.
\nKarpathy's observation sparked widespread discussion about how our development tools should feel more human-centered. The concept gained traction as developers started sharing their own experiences of tools that felt more intuitive during different coding sessions. Some tools excel when you're in deep-focus mode, others shine during collaborative sessions, and some are perfect for those \"I just want to ship something quickly\" moments.
\nBefore we dive deeper, let's address the elephant in the room. Some people mistakenly assume that vibe coding tools are a crutch for developers who \"can't really code.\" This couldn't be further from the truth.
\nVibe coding isn't about replacing programming skills – it's about amplifying them. The most skilled developers often embrace these tools because they understand that writing code is just one part of building great software. Senior engineers don't prove their worth by manually typing boilerplate or reinventing wheels; they prove it by solving complex problems efficiently and shipping quality products.
\nThink of it this way: a master chef doesn't grind their own spices to prove they can cook – they use the best tools available to focus on creating amazing dishes. Similarly, experienced developers use vibe coding tools to eliminate repetitive tasks and focus on architecture, problem-solving, and innovation.
\nThe reality is that vibe coding tools often require more programming knowledge to use effectively, not less. Understanding when and how to leverage AI assistance, knowing which abstractions to trust, and being able to debug generated code all require deep technical expertise.
\nVibe coding tools share several characteristics:
\nThe last point deserves special mention. As any experienced developer knows, \"lazy\" programmers often write the best code – not because they cut corners, but because they naturally gravitate toward solutions that require less maintenance, fewer lines of code, and more automation. Why write 50 lines of boilerplate when app.crudlify() does it in one? Why manually configure CORS, rate limiting, and database connections when your tool handles it intelligently? Vibe coding tools embody this philosophy by doing the heavy lifting so you can focus on solving actual business problems rather than fighting infrastructure.
The vibe coding tools landscape is exploding with innovation. From AI-powered IDEs to natural language app builders, there are dozens of tools emerging that understand and adapt to developer energy and workflow. The tools we'll explore here represent just the tip of the iceberg – a curated selection of standout platforms that exemplify what makes a tool truly \"vibe-friendly.\"
\nReal-world vibe scenario: Sarah's got a weekend project idea – a mood-tracking app for her team. She's feeling creative but not in the mood for infrastructure setup. She spins up a Codehooks backend (app.crudlify() for instant CRUD), uses v0 to generate a clean React dashboard, and Cursor to refactor the logic. Three hours later, she's got a working app deployed. That's vibe coding in action – tools that match her energy level and let her focus on the creative problem-solving.
v0 is Vercel's AI-powered development agent that has evolved from a UI component generator into a full-stack application builder. It can plan, code, and deploy entire Next.js applications from natural language descriptions. While it supports various frameworks, it really works best using React, Tailwind and shadcn/ui components. What makes v0 a perfect vibe tool: You can preview, modify and seamlessly deploy these pages to the cloud.
\nThe \"Rapid Prototyping\" Vibe: v0 excels when you're in that \"I need a frontend for my API\" mood. You can literally describe your UI in plain English and get React components that work immediately. Perfect for Codehooks developers who want to quickly build frontends for their serverless APIs.
\n// Prompt: \"Create a dashboard showing API statistics with charts\"
// v0 generates: Complete React component with charts, responsive design, and clean styling
Best Vibe: When you're feeling experimental and want to see ideas come to life instantly without getting bogged down in setup
\nCursor has quickly become the gold standard for AI-powered code editors. Unlike traditional IDEs with AI bolted on, Cursor was built from the ground up with AI as a first-class citizen. It supports multiple LLMs (Claude Sonnet 4.5, GPT-5, Gemini, and others), letting you choose the model that matches your current task and preference. It understands your entire codebase context and can make suggestions that anticipate your next move. Like many modern AI coding tools, Cursor supports MCP (Model Context Protocol), enabling seamless integration with external data sources and services.
\nThe \"I'm in the zone\" Vibe: Cursor's AI can follow your coding patterns and suggest entire functions or refactors that match your style. It's like having a coding partner who's read your entire codebase and knows exactly what you're trying to build.
\nBest Vibe: When you're in flow state and want an AI that keeps up with your thought process without breaking your rhythm
\nBolt.new is an AI-driven platform that lets you prompt, edit, and deploy full-stack web apps right in your browser. It's built on WebContainers tech, meaning you get a legit dev environment—NPM packages, Supabase integration, and Netlify deployment included.
\nThe \"Build Everything Fast\" Vibe: Bolt shines when you want to iterate quickly. Its \"diffs\" feature means you can make changes and see updates instantly without full rebuilds. Think of it as the tool for \"weekend hackathon energy\" – when you want to build a complete MVP in hours, not days.
\nBest Vibe: When you're in that \"let's ship something complete\" mood and want AI that can handle frontend, backend, and deployment with speed
\nLovable.dev emphasizes ease of use and accessibility for full-stack application development. It uses AI to translate user prompts into functional code with minimal input and focuses on collaborative workflows.
\nThe \"Thoughtful Architecture\" Vibe: Unlike Bolt's \"ship fast\" approach, Lovable takes time to plan. It suggests project structure, discusses trade-offs, and integrates with GitHub for proper version control. Perfect when you're building something that needs to scale or when working with a team. Lovable supports multiple backends, but has a deep integration with Supabase which enables advanced features like schemas, migrations and authentication.
\nBest Vibe: When you're feeling methodical and want an AI that thinks through architecture, considers maintainability, and helps you avoid technical debt from day one
\nClaude Code is the agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster through natural language commands. This is the ultimate vibe tool for developers who live in the terminal.
\nThe \"Terminal Native\" Vibe: Claude Code maps and explains entire codebases in a few seconds. It uses agentic search to understand project structure and dependencies without you having to manually select context files. When you're feeling like a command-line wizard and want AI that speaks your language.
\nBest Vibe: When you're in deep-work mode and want powerful AI assistance without leaving your terminal environment
\nGitHub Copilot and Claude (through various VS Code extensions and integrations) have revolutionized the vibe coding experience. Both VS Code and Claude support MCP (Model Context Protocol), creating a powerful ecosystem where AI assistants can access external data sources, databases, and services. Copilot has evolved well beyond autocomplete — its Coding Agent mode can autonomously create pull requests, modify multiple files, and run tests, while offering model selection across Claude Opus 4, GPT-5, and o3. Claude shines in conversational debugging and architectural discussions through extensions and API integrations. These tools adapt to your coding energy – suggesting simple completions when you're tired, or diving deep into complex refactors when you're energized.
\nBest Vibe: When you're prototyping and want to focus on logic rather than syntax, or when you need a rubber duck that actually codes back
\nCline is the autonomous AI coding agent that's taken the developer community by storm with over 5M installs and 57k GitHub stars. Unlike traditional autocomplete tools, Cline operates as your collaborative AI partner directly within VS Code (and other IDEs), capable of creating files, editing code, executing terminal commands, and even browsing the web. What sets Cline apart is its thoughtful, human-in-the-loop approach – it breaks down complex tasks into clear steps, explains its reasoning, and asks for approval before making changes. With full MCP support, Cline can connect to external databases, live documentation, and hundreds of specialized tools, making it incredibly versatile for different development workflows.
\nThe \"Autonomous Assistant\" Vibe: Cline shines when you're dealing with complex, multi-step tasks or unfamiliar codebases. It's like having a skilled junior developer who can handle the heavy lifting while you focus on architecture and business logic. Perfect for those \"I need to scaffold this entire feature\" or \"help me debug this mysterious issue\" moments.
\nBest Vibe: When you're feeling overwhelmed by a large task and want an AI that can break it down, execute it step-by-step, and learn from your codebase context while maintaining full transparency about what it's doing
\nWindsurf (formerly Codeium) is a full AI IDE that rivals Cursor with its own take on agentic development. Its standout feature is Cascade — a multi-file AI agent that can reason across your entire codebase, plan changes, and execute them across multiple files in a single flow. It also includes Supercomplete (predictive autocomplete), MCP integrations, and a built-in memory system that learns your project over time.
\nThe \"Integrated Flow\" Vibe: Windsurf shines when you want everything in one place. In-editor app previews, deployment, and multi-file refactoring without ever leaving the IDE. It's the tool for developers who want deep AI integration without configuring plugins or extensions.
\nBest Vibe: When you're building something substantial and want an AI that can see and modify your whole project at once, not just the file you're looking at
\nOpenAI Codex CLI is an open-source terminal coding agent built in Rust. It's OpenAI's answer to Claude Code — a lightweight, fast agent that lives in your terminal and can read, write, and execute code autonomously. It supports MCP, follows the AGENTS.md convention for project context, and works with multiple GPT-5 models.
\nThe \"Open Source Terminal\" Vibe: Codex CLI appeals to developers who want the terminal-native workflow of Claude Code but prefer OpenAI's models or want a fully open-source tool they can customize and self-host.
\nBest Vibe: When you want a fast, hackable terminal agent with no vendor lock-in on the tool itself
\nGemini CLI is Google's free, open-source terminal AI agent. The standout feature is its 1M token context window — it can ingest massive codebases in a single pass. It's completely free with a Google account (1,000 requests/day), supports MCP, and handles multi-file operations.
\nThe \"Massive Context\" Vibe: When you're working on a large codebase and need an AI that can hold the entire project in context without chunking or summarizing. The free tier makes it an easy addition to any developer's toolkit.
\nBest Vibe: When you're exploring or refactoring a large codebase and want an AI that can see everything at once without hitting context limits
\nEmergent is one of the fastest-growing vibe coding platforms, reaching $100M ARR just eight months after launch with over 6 million users. Founded by the twin brothers behind Amazon SageMaker and Dunzo, it takes a fundamentally different approach — instead of helping you write code, you describe the app you want and Emergent's multi-agent system handles planning, coding, testing, and deployment autonomously. The platform generates full-stack applications you can export to GitHub, so you own the code.
\nThe \"Describe and Ship\" Vibe: Emergent shines when you have a clear app idea and want to go from description to deployed product with minimal hands-on coding. It's particularly powerful for domain experts and non-technical founders who know exactly what they want to build. Like Bolt.new and Lovable, it handles the full stack — but leans harder into autonomous end-to-end generation rather than interactive editing. Keep an eye on credit consumption for complex projects.
\nBest Vibe: When you have a specific app vision and want AI to handle the entire build pipeline — planning, coding, and deployment — while you focus on product decisions
\nHere's something I've noticed after using all these tools: the most beautiful AI assistant in the world becomes useless the moment you hit backend complexity. You can have Cursor suggesting perfect React components and Claude helping with brilliant algorithms, but if deploying your app requires juggling AWS services, configuring databases, and debugging CORS issues, your creative flow dies a brutal death.
\nEven worse is the version nightmare – trying to make a PostgreSQL client, Redis cache, message queue library, job scheduler, and authentication middleware all play nicely together. Each service has its own connection patterns, error handling, and configuration quirks. Your AI assistant might suggest brilliant code, but it can't debug why your job queue isn't talking to your database, or why your authentication tokens work in development but fail in production.
\nThe dirty secret of most \"vibe coding\" tools is that they solve the easy part (generating code) but ignore the hard part (making it actually work in production). This is why coherent backend approaches matter so much for AI-powered development. When your AI agents can understand your entire stack through a simple, consistent interface, they become exponentially more useful.
\nSome platforms get this right. Supabase deserves huge credit here – their consistent MCP-supported environment works beautifully with tools like Lovable and Bolt.new. When your database, authentication, real-time subscriptions, and edge functions all share the same client patterns and error handling, AI tools can reason about your entire stack instead of just fragments.
\nThink about it: an AI assistant that can deploy your code, query your database, and handle authentication through a unified CLI is fundamentally different from one that can only suggest React components while you manually handle everything else. CLI-native platforms make this real — when every operation is a shell command, any agent with terminal access becomes a full-stack developer.
\nThis is why coherent backend platforms matter for vibe coding – not because they're magical, but because they eliminate the integration complexity that breaks your flow. Whether it's Supabase's unified PostgreSQL ecosystem, Codehooks' CLI-native serverless simplicity (coho deploy and app.crudlify() handle everything in one abstraction), or other platforms designed for consistency, the key is having fewer moving parts that work together seamlessly.
Full disclosure: you're reading this on the Codehooks blog, so take this with a grain of salt. But after using these AI tools extensively, I've learned some things about what infrastructure actually enables vibe coding rather than killing it.
\nThe tools above adapt to your coding style and energy, but they need a solid foundation to shine. Here's what I look for in vibe-friendly backend platforms:
\nCodehooks — CLI-native backend for AI agents: The serverless backend that just works. When your AI tools are suggesting brilliant solutions, the last thing you want is to get bogged down in deployment configs, database setup, or CORS issues. Codehooks handles all of this invisibly:
\ncoho create, coho deploy, coho log -f. Any AI agent with shell access (Claude Code, Codex CLI, Cursor) can autonomously create, deploy, and verify a backendapp.crudlify() gives you a full REST API with validation in one line/codehooks:backend commandimport { app } from 'codehooks-js';
import { z } from 'zod';
const Todo = z.object({
title: z.string().min(1),
completed: z.boolean().default(false)
});
// One line: full CRUD API with Zod validation
app.crudlify({ todos: Todo }, { prefix: '/api' });
// Serve a React SPA from the same deployment
app.static({ route: '/', directory: '/static', default: 'index.html' });
export default app.init();
# The full deploy cycle — what your AI agent runs
coho deploy # Backend live in ~5 seconds
coho log -f # Stream logs to verify
A note on lock-in: Yes, using Codehooks represents a (tiny) vendor lock-in, but not more than you could replace in an afternoon with Node.js, Redis, and MongoDB. The codehooks-js library is essentially a convenient wrapper around standard web APIs and database operations. Your business logic remains portable, and the abstractions map directly to common patterns any Node.js developer would recognize.
Think of Codehooks as the reliable friend who handles logistics while you focus on the creative work. When v0 generates your frontend and Cursor refines your logic, Codehooks ensures your backend never becomes a bottleneck.
\nThe best vibe coding tools are deeply personal. What feels intuitive to one developer might feel clunky to another. Here's how to evaluate whether a tool will actually improve your workflow:
\nCan you get meaningfully productive within 15 minutes of starting? Great vibe tools have exceptional onboarding. If you're fighting with configuration or unclear documentation in the first quarter-hour, it's probably not going to get better.
\nHow well does it play with your existing stack? The most powerful individual tool becomes useless if it doesn't integrate with your current workflow. Look for:
\nDoes the tool maintain or break your coding flow? Pay attention to:
\nThe ultimate test: Could you use this tool to build and deploy a weekend project without getting frustrated? If a tool can handle the full cycle from idea to production smoothly, it's probably vibe-friendly.
\nAs AI becomes more prevalent in development, we're seeing tools that adapt to individual coding styles and preferences. The tools we've covered are just the beginning. The next wave will likely include:
\nThe MCP protocol adoption we're seeing in tools like Codehooks and Cursor suggests a future where vibe coding tools talk to each other, creating seamless workflows that feel almost telepathic.
\nThe ultimate vibe coding setup is one that feels invisible – tools that amplify your capabilities without demanding attention. The key is understanding that different tools serve different roles in your vibe stack.
\nAdaptive development tools like Cursor, Claude, and v0 adapt to your coding style and energy level. They're the ones that \"feel\" your mood and adjust their suggestions accordingly, whether you're working on frontend, backend, or full-stack code.
\nBackend infrastructure like Codehooks and Supabase is different – it's the invisible foundation that makes vibe coding possible. When your backend \"just works\" without configuration, deployment headaches, or infrastructure management, your adaptive AI tools can focus on the creative work. These platforms don't adapt to your coding style; instead, they eliminate the friction that would break your vibe in the first place.
\nThink of it as the difference between responsive collaborators and reliable foundations. You need both: AI tools that understand your energy and infrastructure that never interrupts your flow.
\nRemember: the goal isn't to use every trending tool, but to curate a toolkit where frontend intelligence meets backend simplicity. Your vibe coding setup should make you excited to open your laptop and start building.
\nWhat's your current coding vibe, and what tools are helping you achieve it? The beauty of vibe coding tools is that they're as unique as the developers who use them.
\nStart small: pick one category to focus on first and build from there. Maybe begin with a vibe-friendly code editor like Cursor, then add backend infrastructure that doesn't break your flow. The goal isn't to use every tool, but to curate a setup that amplifies your natural coding rhythm.
\nReady to experience vibe-friendly backend development? Try Codehooks.io and discover why developers love having their infrastructure just work. When your backend vibes with your workflow, everything else falls into place.
", "url": "https://codehooks.io/blog/vibe-coding-tools", "title": "Best Vibe Coding Tools & Why AI Agents Work Better with Simple Backend Infrastructure", "summary": "Discover some of the best vibe coding tools that adapt to your mood and energy levels. From AI-powered assistants to MCP-powered serverless backends, find tools that match your coding vibe or learn more about what vibe coding is.", "date_modified": "2025-07-01T00:00:00.000Z", "author": { "name": "Martin", "url": "https://github.com/canuto" }, "tags": [ "vibe-coding", "development-tools", "ai", "productivity", "developer-experience", "serverless" ] }, { "id": "https://codehooks.io/blog/building-stateful-workflows-javascript", "content_html": "At Codehooks, our mission is to simplify the development of automations, integrations, and backend APIs. As your app logic grows more complex — onboarding flows, async jobs, conditional steps — it becomes clear: You need a better way to organize and execute business logic.
\nThat's why we built the Codehooks Workflow API — a lightweight, serverless-friendly way to run stateful workflows in JavaScript, without the overhead of bulky orchestrators or external tools.
\n![\"socialcard\"](\"https://codehooks.io/assets/images/workflow-card-9944bc385856023dc3eaba5df0e3e5a6.webp\")
import { app } from 'codehooks-js'
const workflow = app.createWorkflow('parityCheck', 'Check if a number is even or odd', {
begin: async (state, goto) => {
state.number = Math.floor(Math.random() * 100)
goto('check', state)
},
check: async (state, goto) => {
const step = (state.number % 2 === 0) ? 'even' : 'odd'
goto(step, state) // branch
},
even: async (state, goto) => {
console.log(`${state.number} is even`)
goto('end', state)
},
odd: async (state, goto) => {
console.log(`${state.number} is odd`)
goto('end', state)
},
end: async (state, goto) => {
console.log('Workflow finished', state)
goto(null, state) // null complete the workflow
}
})
// REST API to start a new workflow instance
app.post('/start', async (req, res) => {
const result = await workflow.start({\"Some initial\": \"state\"});
res.json(result);
});
// export app interface to serverless runtime
export default app.init();
The above JavaScript workflow code can also be visualized as a diagram like the Flow chart diagram shown below:
\n\n** Ready to Build Smarter Backends?**
\n👉 View the Workflow API docs →
", "url": "https://codehooks.io/blog/building-stateful-workflows-javascript", "title": "Building Stateful Workflows in JavaScript: A Guide to Codehooks Workflow API", "date_modified": "2025-06-01T00:00:00.000Z", "author": { "name": "Jones" }, "tags": [ "workflows", "tutorial", "queue" ] }, { "id": "https://codehooks.io/blog/api-integration-made-easy", "content_html": "APIs and webhooks are essential for connecting different systems and creating smooth user experiences. Whether you're pulling data from external services or receiving real-time events, API integration is at the heart of modern application development.
\nThis tutorial walks you through the entire process—from understanding what API integration means to building robust integrations. You'll learn the tools, step-by-step process, and best practices that make integration work.
\n![\"socialcard\"](\"https://codehooks.io/assets/images/api-integration-f3b51f85ccf48a403ef9cfeed633173f.webp\")
API integration is the process of connecting two or more software applications through their APIs to enable data exchange and extend functionality. This is what makes modern software work together—allowing disparate systems to communicate and share information seamlessly.
\nAPI integration examples include:
\nInstead of building these features from scratch, API integration allows you to leverage existing services, saving time and effort while creating more powerful applications.
\nAPI integration enhances your application's capabilities by allowing you to leverage powerful external services. For instance, integrating a payment gateway API adds payment processing capabilities to your app without building a payment solution yourself. Similarly, APIs for analytics, location services, or messaging systems can enhance your application by providing additional features that users expect today.
\nWebhook integrations take this further by enabling real-time automation. When a customer completes a purchase, a webhook can instantly trigger inventory updates, send confirmation emails, and notify your shipping provider—all without polling or manual intervention.
\nAdditionally, APIs reduce development costs and allow you to build more robust applications faster by reusing existing solutions.
\nHere's the API integration process that works for any service:
\nUnderstand the API Documentation: Start by thoroughly reviewing the API documentation. Documentation provides a roadmap for how to authenticate, make requests, handle responses, and understand error messages. It often includes examples of how to use the API, which can be valuable.
\nGet API Access: Obtain the necessary API keys or tokens. Most services require authentication to ensure only authorized clients can access their APIs.
\nSet Up Authentication: Choose the appropriate authentication method (e.g., API key, OAuth). Implement it in your code to establish a secure connection to the service.
\nChoose the Right Tools: Use the appropriate libraries or tools for your environment. Most programming languages offer packages or modules that simplify working with HTTP requests and parsing responses.
\nTest the API Integration: Use tools like Postman, Bruno or cURL to manually test API endpoints. Make sure the API responses meet your expectations before you add them into your application's codebase.
\nHandle Errors Gracefully: Expect that things may go wrong. Build error handling into your API integration to handle common issues like network failures or rate limits.
\nSet Up Webhook Endpoints (if applicable): For services that push events to your app, create dedicated endpoints to receive webhooks. Implement signature verification to ensure requests are authentic, and use idempotency keys to handle duplicate deliveries.
\nMonitor and Maintain: APIs evolve over time, so it's important to keep your integration updated. Monitor API deprecations or updates to ensure compatibility with future versions.
\nThe right API integration tools can significantly streamline your workflow. Here's what you need for easy API integration:
\nTesting and Development Tools
\nAPI Management Platforms
\nIntegration Platforms
\nMonitoring and Analytics
\nDevelopment Libraries and SDKs
\nThese tools can help you build more reliable integrations, reduce development time, and maintain better oversight of your API ecosystem.
\nInconsistent Documentation: Sometimes API documentation can be outdated or incomplete. In such cases, contacting the provider or joining developer forums can help clarify ambiguities.
\nAuthentication and Security: Setting up authentication (especially OAuth) can be complex. Make sure to follow best practices, such as using secure protocols (HTTPS) and rotating API keys regularly.
\nHandling Rate Limits: APIs often enforce rate limits to manage the load on their servers. To overcome this, implement retry logic and manage request pacing to avoid hitting these limits.
\nError Handling: It's crucial to account for different types of errors like timeouts, 400/500 status codes, and other unexpected responses for the API integration. Use clear logging to understand when and why errors occur. When you have multiple API integrations in one \"transaction\", make sure you have a strategy to retry or undo changes.
\nVersioning Issues: API integrations evolve, and newer versions of APIs may not always be backward-compatible. To avoid integration breaking, always test and maintain version compatibility or build flexibility into your code for API changes.
\nWebhook Reliability: When receiving webhooks, you need to handle potential issues like duplicate deliveries, out-of-order events, and burst traffic during peak times. Implement idempotency checks and consider using a queue to process events reliably.
\nWhen working with multiple API integrations, managing different endpoints, authentication methods, and data formats becomes complex. Building your own backend (also known as Backend for Frontend, or BFF) provides a unified interface that makes API integration seamless and easier to maintain.
\nA Backend for Frontend (BFF) is an architectural pattern where a dedicated backend service is created specifically to support a particular frontend or client application. This approach allows you to tailor your API to the specific needs of your frontend, optimizing data transfer and simplifying client-side logic. BFFs are particularly useful when dealing with multiple external APIs or when you need to aggregate data from various sources before sending it to the client.
Using a backend like the one you can create with Codehooks.io, you can tie multiple APIs together and provide a single endpoint for your frontend to interact with. This approach offers several benefits:
\nCentralized Logic: By building a custom backend, you can consolidate business logic that involves multiple APIs. For instance, if your application needs to pull data from both a payment service and a customer management service, you can handle that logic on your backend, simplifying the frontend code.
\nConsistent Data Format: Different APIs may return data in different formats. Your backend can standardize these formats, ensuring that your frontend only needs to handle a consistent structure. This reduces complexity on the client side and makes your code easier to maintain.
\nImproved Security: Instead of exposing multiple third-party APIs directly to the frontend, which might involve managing different sets of credentials, your backend can act as a gatekeeper. This way, you only need to secure your own API, keeping the credentials and tokens for the third-party APIs safe.
\nCaching and Rate Limit Management: By building your own backend, you can implement caching strategies to reduce the number of API calls, improving performance and helping to manage rate limits. Codehooks.io allows you to easily build and deploy backend functions that can handle caching and other data optimizations.
\nIntegrated Databases and Worker Queues: Codehooks.io offers integrated document and key-value databases, which allow you to store and manage data related to API integrations easily. This means you can persist data fetched from various APIs, aggregate information, and provide a more responsive experience for your users. Additionally, worker queues and job scheduling features can help automate tasks such as making periodic API calls, processing large datasets, or handling other background jobs, making the integration process more seamless and efficient.
\nWebhook Event Processing: Your backend can receive webhooks from multiple services, validate their signatures, normalize the data, and then trigger the appropriate actions—whether that's updating your database, calling other APIs, or queuing background jobs.
\nHere's a practical API integration example using Codehooks.io. Suppose you're building an e-commerce application that needs to integrate with several services:
\nInstead of integrating each of these APIs directly in your frontend, you can use Codehooks.io to build a single backend endpoint that coordinates these services. Your backend might expose a /checkout endpoint that:
With this setup, your frontend only needs to call the /checkout endpoint, while all the complex logic and multiple API calls are handled seamlessly by your backend on Codehooks.io.
Your backend can also handle webhooks from these services. For example, when Stripe sends a payment_intent.succeeded webhook, your endpoint can verify the signature, update the order status in your database, and then call the shipping API to initiate fulfillment—creating a fully automated order flow.
Codehooks.io provides excellent resources for AI-assisted backend development:
These tools make it incredibly easy to build complex API integrations through simple conversation with AI assistants.
Common questions about API integration, tools, and best practices
Whether you're building your first API integration or managing complex multi-service architectures, the principles remain the same: understand the documentation, handle errors gracefully, and use the right tools for the job.
\nReady to start? Create a free Codehooks.io account and deploy your first API integration in minutes.
", "url": "https://codehooks.io/blog/api-integration-made-easy", "title": "Easy API Integration Tutorial: Step-by-Step Guide with Examples", "summary": "API integration tutorial with step-by-step guidance. Learn how to integrate APIs, handle webhooks, and connect multiple services. Covers tools, common challenges, and best practices.", "date_modified": "2024-10-05T00:00:00.000Z", "author": { "name": "Martin", "url": "https://github.com/canuto" }, "tags": [ "API Integration", "Backend", "NoSQL", "Backend for Frontend", "Webhooks" ] }, { "id": "https://codehooks.io/blog/sql-vs-nosql", "content_html": "Choosing between SQL and NoSQL databases is a crucial decision that can significantly impact your project's success. This guide provides an in-depth comparison of SQL vs NoSQL, helping you understand their differences and choose the right database type for your needs.
\n![\"socialcard\"](\"https://codehooks.io/assets/images/sql-vs-nosql-8e2d3b129a31dcfaa859d8cc9693228f.webp\")
Before diving into the details of each database type, let's compare the key differences between SQL and NoSQL:
\n| Feature | SQL Databases | NoSQL Databases |
|---|---|---|
| Data Model | Structured, table-based | Flexible (document, key-value, graph, etc.) |
| Schema | Predefined, fixed | Dynamic, flexible |
| Scalability | Vertical | Horizontal |
| ACID Compliance | Yes | Varies (some offer ACID compliance) |
| Consistency | Strong | Eventual (in most cases) |
| Use Cases | Complex queries, transactions | High traffic, big data, real-time web apps |
ACID is an acronym that stands for Atomicity, Consistency, Isolation, and Durability. These properties ensure database transactions are processed reliably:
SQL databases are known for strong ACID compliance, while NoSQL databases may sacrifice some ACID properties for increased performance and scalability.
\n| Aspect | SQL | NoSQL |
|---|---|---|
| Read Performance | Excellent for complex queries | Excellent for simple queries |
| Write Performance | Good, but can slow with scale | Excellent, especially at scale |
| Scalability | Vertical (harder to scale) | Horizontal (easier to scale) |
| Large Datasets | Can struggle with very large datasets | Handles large datasets well |
| Complex Joins | Excellent | Limited or not supported |
The performance difference between SQL and NoSQL can vary greatly depending on the specific use case and implementation.
\nLet's compare how you might implement a simple data storage and retrieval operation in both SQL and NoSQL. These examples highlight the syntactical and conceptual differences between the two approaches.
\n-- Create a table
CREATE TABLE items (
id SERIAL PRIMARY KEY,
name VARCHAR(100),
category VARCHAR(50)
);
-- Insert data
INSERT INTO items (name, category) VALUES ('Hammer', 'tools');
-- Retrieve data
SELECT * FROM items WHERE category = 'tools';
import { app, datastore } from 'codehooks-js';
// Store data
app.post('/items', async (req, res) => {
const conn = await datastore.open();
const result = await conn.insertOne('items', req.body);
res.json(result);
});
// Retrieve data
app.get('/items', async (req, res) => {
const conn = await datastore.open();
conn.getMany('items', { category: 'tools' }).json(res);
});
As demonstrated, SQL requires a predefined schema and uses structured query language, while NoSQL offers a more flexible, schema-less approach with a simpler API. Each has its advantages depending on your specific use case.
\nThe following list shows SQL example statements expressed as NoSQL queries. Note that this is specific to codehooks.io (which use a query language similar to MongoDB). Read more about codehooks.io NoSQL query language in the codehooks.io documentation.
\nSELECT * FROM users/*
* SQL statement:
* SELECT * FROM users
* expressed as a nosql database query
*/
const db = await Datastore.open();
db.find('users');
SELECT user_id, status FROM usersconst query = {};
const opt = {
hints: { $fields: { user_id: 1, status: 1 } },
};
db.find('users', query, opt);
SELECT * FROM users WHERE status = \"A\"const query = { status: 'A' };
db.find('users', query);
SELECT * FROM users WHERE status != \"A\"const query = { status: { $not: 'A' } };
db.find('users', query);
SELECT * FROM users WHERE status = \"A\" AND age = 50const query = { status: 'A', age: 50 };
db.find('users', query);
SELECT * FROM users WHERE status = \"A\" OR age = 50const query = { $or: [{ status: 'A' }, { age: 50 }] };
db.find('users', query);
SELECT * FROM users WHERE age > 25const query = { age: { $gt: 25 } };
db.find('users', query);
SELECT * FROM users WHERE user_id like \"bc%\"const query = { user_id: /^bc/ };
db.find('users', query);
SELECT * FROM users WHERE status = \"A\" ORDER BY name ASC// Use the CLI to create a sorted index
// $ codehooks createindex --collection users --index name
const query = { status: 'A' };
const opt = {
sort: { name: 1 },
};
db.find('users', query, opt);
SELECT * FROM users WHERE status = \"A\" ORDER BY name DESC// Use the CLI to create a sorted index
// $ codehooks createindex --collection users --index name
const query = { status: 'A' };
const opt = {
sort: { name: -1 },
};
db.find('users', query, opt);
SELECT COUNT(*) FROM usersconst query = {};
const opt = {
hints: { $onlycount: true },
};
db.find('users', query, opt);
SELECT COUNT(*) FROM users WHERE age > 30const query = { age: { $gt: 30 } };
const opt = {
hints: { $onlycount: true },
};
db.find('users', query, opt);
SELECT * FROM users LIMIT 1const query = {};
const opt = { limit: 1 };
db.find('users', query, opt);
SELECT * FROM users LIMIT 5 SKIP 10const query = {};
const opt = {
limit: 5,
offset: 10,
};
db.find('users', query, opt);
| SQL Use Cases | NoSQL Use Cases |
|---|---|
| Financial systems | Real-time big data |
| ERP systems | Content management |
| CRM applications | IoT applications |
| E-commerce platforms | Social networks |
| Legacy systems migration | Gaming applications |
Choose SQL when you need ACID compliance, complex queries, and have a well-defined, stable schema. Opt for NoSQL when dealing with large volumes of unstructured data, requiring high scalability, or needing rapid development with changing data models.
\nWhen choosing a backend service for your project, it's important to understand which database type they use. Here's a list of popular backend services and their primary database types:
\n| Service | Primary Database Type | Notes |
|---|---|---|
| Supabase | SQL (PostgreSQL) | Offers real-time capabilities and PostgREST API |
| Firebase | NoSQL | Uses Cloud Firestore, a document-based NoSQL database |
| MongoDB Atlas | NoSQL | Managed MongoDB service, document-based NoSQL |
| AWS RDS | SQL | Supports multiple SQL engines (MySQL, PostgreSQL, etc.) |
| Restdb.io | NoSQL | Document-based NoSQL with a REST API |
| Codehooks.io | NoSQL | Flexible NoSQL with built-in API and serverless functions |
| Fauna | Multi-model | Supports both relational and document models |
| Azure Cosmos DB | Multi-model | Supports multiple NoSQL models (document, key-value, graph) |
| Google Cloud Datastore | NoSQL | Schemaless NoSQL datastore |
| Amazon DynamoDB | NoSQL | Key-value and document database |
This list showcases the diversity of database options available in modern backend services. Some services, like Fauna and Azure Cosmos DB, even offer multi-model capabilities, allowing you to leverage both SQL and NoSQL paradigms within a single service.
\nWhen selecting a backend service, consider not only the database type but also factors such as:
\nRemember that the best choice depends on your specific project requirements, expected data volume, and development team's expertise.
\nChoosing between SQL and NoSQL depends on your specific project requirements. Consider factors such as data structure, scalability needs, consistency requirements, and development flexibility when making your decision.
\nSQL might be the better choice if you need:
\nNoSQL could be more suitable if you require:
\nRemember, it's not always an either-or decision. Some projects benefit from using both SQL and NoSQL databases to leverage the strengths of each.
\nAt Codehooks.io, we offer a powerful NoSQL Database API that combines the flexibility of NoSQL with the ease of use of a REST API. It's an excellent choice for projects that require rapid development and scalability.
\nReady to explore NoSQL for your project? Check out the Codehooks.io NoSQL Database API to get started.
", "url": "https://codehooks.io/blog/sql-vs-nosql", "title": "SQL vs NoSQL: When to use and key differences", "summary": "Comprehensive guide comparing SQL vs NoSQL databases. Learn when to use which, key differences, advantages, and use cases to choose the right database for your project.", "date_modified": "2024-09-10T00:00:00.000Z", "author": { "name": "Martin", "url": "https://github.com/canuto" }, "tags": [ "SQL vs NoSQL", "Database Comparison", "SQL", "NoSQL" ] }, { "id": "https://codehooks.io/blog/streamline-your-backend-with-json-schema", "content_html": "In modern app development, having a reliable backend is essential. Codehooks.io offers a powerful NoSQL datastore, JSON schema validation, and a secure REST API to keep your data consistent and your app scalable.
\n![\"socialcard\"](\"https://codehooks.io/assets/images/json-schema-cfb4aa8b9b137d03f41044ac8ea20b58.webp\")
A well-structured backend is key to:
\nnpm install -g codehooks
codehooks login
mkdir myproject && cd myproject
codehooks init
Get your project's endpoint URLs:
\ncodehooks info
Example personSchema.json:
{
\"$schema\": \"http://json-schema.org/draft-07/schema#\",
\"title\": \"Person\",
\"type\": \"object\",
\"properties\": {
\"firstName\": { \"type\": \"string\" },
\"lastName\": { \"type\": \"string\" },
\"age\": { \"type\": \"integer\", \"minimum\": 0 },
\"email\": { \"type\": \"string\", \"format\": \"email\" }
},
\"required\": [\"firstName\", \"lastName\", \"email\"]
}
Apply the schema to your collection:
\ncodehooks add-schema --collection 'person' --schema './personSchema.json'
codehooks import --filepath './persondata.json' --collection 'person'
Example for creating a record:
\nconst newRecord = {
lastName: 'Doe',
email: 'john.doe@example.com',
age: 30,
};
fetch('https://your-project-url/person', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
Authorization: 'Bearer YOUR_JWT_TOKEN',
},
body: JSON.stringify(newRecord),
})
.then((response) => response.json())
.then((data) => console.log(data))
.catch((error) => console.error('Error:', error));
JSON Schema validation ensures only data that fits your schema gets through, returning a 400 error if it doesn't.
For example, if a required field is missing, the validator will return a 400 error like this:
{
\"schemaError\": [
{
\"instancePath\": \"\",
\"schemaPath\": \"#/required\",
\"keyword\": \"required\",
\"params\": {
\"missingProperty\": \"firstName\"
},
\"message\": \"must have required property 'firstName'\"
}
]
}
Prefer using a UI? Codehooks Studio offers a clean interface for managing your datastore, importing data, and setting up schemas—all without needing to write any code.
\n
Using JSON Schema on Codehooks.io ensures your backend is solid, with enforced data validation, ready-made APIs, and the scalability to grow with your app. Let Codehooks.io manage the backend so you can focus on building your application.
\nIn this guide, we'll explore creating a dynamic web application with Alpine.js. We'll set up a frontend using Alpine.js, a minimalistic JavaScript/HTML framework, and integrate it with a comprehensive REST API database backend. For rapid design, we'll use DaisyUI and Tailwind CSS. This project offers a hands-on way to see these technologies in action.
\n![\"socialcard\"](\"https://codehooks.io/assets/images/alpine-js-rest-api-illustration-e68f022ac679cc228bb49ae30594c103.webp\")
After creating a new account (if you don't have one already), you should create a new project using the the Codehooks account web app (click the [NEW PROJECT +] button). Give your project any name you like, in this example we'll use the projectname alpine.
\n![\"new](\"https://codehooks.io/assets/images/new-project-3bd567028e33b150256a41fcff654ed4.png\")
Make sure to install the latest version of the Codehooks CLI.
\nnpm i -g codehooks
Then, log in to your account.
\ncoho login
Next, create a new directory to hold the source code, e.g. myalpine.
\nmkdir myalpine
cd myalpine
The CLI command coho init will attach the local project directory to a Codehooks project (the CLI will present a list), this creates a default Codehooks app file index.js and a project specific config.js file.
coho init
This command creates a default backend app index.js, change this code to the following:
/*
Alpine.js REST API data example
*/
import { app } from 'codehooks-js';
app.static({ route: '/static', directory: '/app' });
// Use Crudlify to create a REST API for any collection
app.crudlify();
// bind to serverless runtime
export default app.init();
In same the project directory, install the codehooks-js NPM package.
\nnpm i codehooks-js
Deploy the default CRUD backend server.
\ncoho deploy
We'll repeat the deploy command after adding the client side Alpine.js html files (see next sections).
\nTo create a database of football players we use this Kaggle dataset. The dataset is a CSV file 2021-2022-Football-Player-Stats.csv with 2921 players.
We can import the full dataset with the CLI command coho import, note that this file has a different separator (semicolon) and encoding (latin1).
coho import -f ~/Downloads/2021-2022-Football-Player-Stats.csv -c football --separator ';' --encoding 'latin1'
You can also import data in the Studio app, either way you should see a football collection like the one shown in the screen shot below.
\n![\"code](\"https://codehooks.io/assets/images/studio-fooball-b4818888b95e0470c564da32e6b2f3c1.png\")
The database backend is now ready to serve REST API calls from web client applications. Keep reading to learn how to create the Alpine.js web app.
\nIn the project directory, create a new a sub directory (e.g. app) to hold the Alpine.js files.
mkdir app
In the subdirectory app, create two new files for the alpine-js source code.
\ncd app
touch index.js script.js
The project setup is now ready, and your project directory should have the following structure:
\n.
├── app
│ ├── index.html
│ └── script.js
├── config.json
├── index.js
└── node_modules
The Alpine.js app (located in the app/index.html file) demonstrates the interactive search page for football players.
The working application is shown in the screen shot below (running locally from the file system).
\n![\"alpine.js](\"https://codehooks.io/assets/images/alpine-js-example-309bcd02a0a66912733ced49bf0bcc74.png\")
You can test a live version of the Alpine.js app here.
\nThis example app demonstrates two important features in Alpine.js:
\nThe app/index.html code is shown below, notice line 14,16 with the event listener calling a method on the global datamodel, and line 27-34 iterating on the rows in the global datamodel. Make sure to copy the source code below info your local files to test.
This example also uses DaisyUI and Tailwind CSS.
<html>
<head>
<meta charset=\"UTF-8\" />
<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />
<link
href=\"https://cdn.jsdelivr.net/npm/daisyui@3.9.4/dist/full.css\"
rel=\"stylesheet\"
type=\"text/css\"
/>
<script src=\"https://cdn.tailwindcss.com\"></script>
<script
defer
src=\"https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js\"
></script>
<script src=\"script.js\"></script>
</head>
<body class=\"p-4\">
<h1
class=\"text-2xl pb-4\"
x-data=\"{ message: 'Alpine.js: Get data from a REST API' }\"
x-text=\"message\"
></h1>
<div x-data>
<input
@keyup.enter=\"$store.coho.getData()\"
x-model=\"$store.coho.search\"
placeholder=\"Search for player ...\"
class=\"input input-bordered input-sm\"
/>
<button @click=\"$store.coho.getData()\" class=\"btn btn-primary btn-sm\">
Search
</button>
</div>
<div class=\"overflow-x-auto\">
<table class=\"table\">
<thead>
<th>Player</th>
<th>Squad</th>
<th>Nation</th>
<th>Index</th>
</thead>
<tbody x-data>
<template x-for=\"(player, index) in $store.coho.players\">
<tr>
<td x-text=\"player.Player\"></td>
<td x-text=\"player.Squad\"></td>
<td x-text=\"player.Nation\"></td>
<td x-text=\"index\"></td>
</tr>
</template>
</tbody>
</table>
<div x-data>
<span
x-show=\"$store.coho.loading\"
class=\"loading loading-dots loading-sm\"
></span>
</div>
</div>
</body>
</html>
The application global state (let's call it coho) is an Alpine store and it's implemented in the app/script.js file shown below.
// replace this with your project url, use CLI command 'coho info' to find yours
const MY_CODEHOOKS_URL = '/football';
// replace this with your own read-only key, use CLI command 'coho add-token' to create a new one
const MY_API_KEY = '0b49638f-56c3-48e9-8725-7f3c20f25316';
document.addEventListener('alpine:init', () => {
Alpine.store('coho', {
loading: false,
search: '',
players: [],
async getData() {
this.loading = true;
this.players = await getDataFromAPI(this.search);
this.loading = false;
},
});
});
// Fetch data from Codehooks REST API
async function getDataFromAPI(search) {
var myHeaders = new Headers();
myHeaders.append('x-apikey', MY_API_KEY); // read-only token
myHeaders.append('Content-Type', 'application/json');
var requestOptions = {
method: 'GET',
headers: myHeaders,
redirect: 'follow',
};
var query = '{}';
console.log('getData', search);
if (search.length > 0) {
query = JSON.stringify({ Player: { $regex: search, $options: 'gi' } });
}
var hints = JSON.stringify({
sort: { Squad: 1, Nation: 1 },
$fields: { Player: 1, Nation: 1, Squad: 1 },
});
var URL = `${MY_CODEHOOKS_URL}?q=${query}&h=${hints}`;
console.log(URL);
const response = await fetch(URL, requestOptions);
return response.json();
}
After adding the client side files as described above, you can run the CLI command deploy again.\nThis will upload the static assets so it can be served under your domain.
coho deploy
Open the app/index.html file in your web browser to test the Alpine.js web app locally, or open the auto generated domain, e.g. https://amiable-zephyr-e964.codehooks.io/static/index.html.
This tutorial provided you with a hands-on example which combined Alpine.js with a REST API backend using Codehooks.io. By following the steps outlined, you'll gain a deeper understanding of how you can apply these technologies in your own projects.
\nSource code at Github here.
\nCommon questions about connecting Alpine.js to a backend REST API