Build powerful no-code APIs
with Xano

Xano's Visual API Builder: How It Works

Xano is structured around three core concepts: the database, the API group, and the function stack. The database is a managed PostgreSQL instance with a visual schema editor — you create tables, define columns, set data types, and establish relationships without writing SQL. The API group is a collection of related endpoints — a Users API group might contain GET /users, POST /users, PUT /users/:id, and DELETE /users/:id. The function stack is the logic engine inside each endpoint: a visual sequence of operations that runs when the endpoint is called. The function stack is what makes Xano unique. Each step in the stack is a discrete operation: query a database table, filter results, transform data, call an external API, send an email, evaluate a conditional branch, or return a response. You drag operations into the stack, configure their inputs, and chain their outputs into subsequent steps. There is no code to write — you are composing logic from pre-built operations that Xano translates into server-side execution. The result is a backend that behaves like hand-written code but is built visually. Xano auto-generates an OpenAPI-compliant API documentation page for every endpoint you create. This documentation is live — it reflects your current endpoint configuration and includes a test interface where you can fire real requests and inspect real responses. This is enormously useful when connecting a WeWeb or FlutterFlow frontend: your frontend developer can browse the API documentation, understand the request and response format, and make the connection without back-and-forth with the backend developer. It also serves as the source of truth for your API contract throughout the project.

Building Your First REST Endpoint in Xano

Creating your first Xano endpoint starts with creating an API group — a logical namespace for related endpoints. Name it after the resource it manages: Products, Orders, Users. Inside the group, add an endpoint and select the HTTP method (GET for reading, POST for creating, PUT or PATCH for updating, DELETE for removing). Xano creates a blank endpoint with an empty function stack and a URL like /products or /products/:id. For a GET endpoint that returns a list of records, the minimal function stack is three steps: a Query All Records operation pointed at your table, an optional Filter step to apply WHERE conditions based on query parameters, and a Return step that sends the results as the API response. Xano handles pagination, sorting, and filtering through its built-in operations — you configure these visually rather than writing SQL clauses. The endpoint is live immediately after you save — Xano deploys changes instantly with no build step. For a POST endpoint that creates a new record, the pattern is: receive input parameters (defined in the endpoint's input section), validate them (Xano has built-in validation for required fields, data types, and format checks), run any business logic (check for duplicates, compute derived values, call a third-party API), and then insert the record with an Add Record operation. The new record's ID is returned in the response. This pattern — validate, transform, persist, respond — covers the vast majority of API endpoints in a typical SaaS application. Once you have built one endpoint this way, building the next ten is significantly faster.

Authentication Middleware and JWT in Xano

Xano has a built-in authentication system that generates and validates JSON Web Tokens. You set up an auth endpoint — typically POST /auth/login — that accepts credentials, validates them against the users table, and returns a signed JWT if the credentials are correct. Every protected endpoint in Xano then references an authentication middleware that extracts the user's ID from the JWT and makes it available inside the function stack as a variable. The authentication middleware runs before your endpoint's function stack executes. If the request includes a valid JWT in the Authorization header, the middleware extracts the user object and injects it. If the JWT is missing or expired, Xano returns a 401 Unauthorized response before your function stack runs at all. This means you never need to write auth checks inside your business logic — the middleware handles it at the framework level, which is both more secure and more maintainable. Xano's auth system also supports custom claims on the JWT — additional fields beyond the standard user ID that are embedded in the token. A common pattern is to include the user's role and organisation ID in the JWT claims so that any endpoint can access these values without querying the database. This eliminates a round-trip per request for the most commonly needed user attributes. Combined with middleware, you can build role-based access control entirely within Xano's function stack: check the user's role claim, branch conditionally, and return a 403 if they lack the required permission — all in a visual editor without writing a single line of server code.

Background Tasks and Scheduled Jobs

Xano supports two types of asynchronous processing: background tasks and scheduled jobs. A background task is a function stack that runs outside the HTTP request cycle — you trigger it from a regular endpoint, but the response is returned immediately and the task runs independently. This is the correct pattern for any operation that takes longer than a few seconds: sending bulk emails, processing an uploaded file, running a heavy database migration, or calling a slow third-party API. The user gets an instant response while the work happens in the background. Scheduled jobs are function stacks that run on a cron schedule — every hour, every day at midnight, every Monday morning. Common use cases include sending weekly digest emails, syncing data from an external source, archiving old records, computing daily analytics aggregates, and triggering billing checks. Xano's scheduling interface lets you define the cron expression and link it to any function stack in your workspace. The job runs on Xano's infrastructure without you managing any additional services. The combination of background tasks and scheduled jobs covers most of the reasons teams reach for a dedicated task queue like Sidekiq or Celery in a traditional backend. For no-code SaaS products, Xano's built-in async capabilities are sufficient for all but the highest-volume use cases. The important operational consideration is monitoring: Xano logs all background task and scheduled job executions, including failures and execution times. Review these logs regularly in production to catch slow or failing background processes before they affect users.

Xano vs Supabase: When to Choose Each

Xano and Supabase serve similar purposes — both are managed backends with PostgreSQL databases — but their abstractions and strengths differ significantly. Xano is optimised for complex business logic: its visual function stack makes it easy to build multi-step workflows, conditional branches, and integrations with third-party services. Supabase is optimised for data access: its auto-generated REST and GraphQL APIs, Row-Level Security, and Realtime subscriptions make it the best choice for data-intensive apps that need fine-grained access control. Choose Xano when your backend has significant business logic that belongs server-side: pricing calculations, approval workflows, data transformations, or complex validations that would be unsafe or awkward in the frontend. Xano's function stack makes this kind of logic straightforward to build and easy for non-engineers to read and maintain. Choose Supabase when your backend is primarily a database with access control needs: multi-tenant data isolation, real-time updates, file storage, and auth with social login. Supabase's RLS system is more powerful and more flexible than Xano's permission model. Many production apps use both: Supabase as the primary database and auth layer, with Xano handling specific complex workflows via REST API calls. Xano can connect to Supabase as an external database, allowing you to leverage Supabase's PostgreSQL features while orchestrating business logic in Xano's visual environment. This hybrid approach is more complex to maintain but gives you the best of both platforms. For teams starting from scratch, pick one and use it fully before considering a hybrid architecture — the operational overhead of managing two backends should not be underestimated.

Xano Pricing Tiers and Scaling Costs

Xano's pricing is based on workspace tiers that determine the number of API requests per month, the number of records in the database, file storage limits, and access to advanced features like background tasks and multiple workspaces. The free tier is functional for prototyping but limited in API requests and records — suitable for exploration and internal tooling with a small team, not for a production SaaS with real users. The Launch plan covers most early-stage SaaS products and includes enough capacity for several thousand monthly active users. The Scale plan adds significantly more API request capacity, larger database limits, priority support, and custom domains for the API. Enterprise plans offer dedicated infrastructure, SLA guarantees, and volume discounts. The most common upgrade trigger is hitting the monthly API request ceiling — monitor your request volume in the Xano dashboard and upgrade proactively before you hit the cap and start seeing throttled responses. The practical advice for managing Xano costs is to design your API calls efficiently. Every frontend action that triggers multiple Xano endpoints in sequence (a page load that makes five separate API calls) uses five times the request budget of a single endpoint that returns all the needed data. Invest time in designing composite endpoints that return everything a screen needs in one call — this is good API design practice regardless of cost, and it also reduces Xano's bill and improves frontend performance. Similarly, avoid polling patterns where the frontend repeatedly calls an endpoint to check for updates — use Xano's webhook or Supabase's Realtime instead.

Hire

Need a dedicated Xano specialist for your project? Fixed price, fixed timeline.

Migrate

Already on another platform and want to move to Xano? We handle the full migration.