Nibor / Docs / App Hub Book a demo

App Hub: APIs, agents and integrations for each app

Every app is also a backend. The App Hub is the per-app control room: REST API, API keys, MCP for AI agents, webhooks, schema and export.

REST API

Each app exposes its resources under /_api/apps/<app-id>/invoke/<resource>: list, read, create, update and delete, with the app's row-level security applied. The Hub shows a live index of resources and copy-ready examples.

API keys and scopes

Create keys per integration with explicit scopes (read, write, admin). Keys are shown once and stored hashed; revoke them anytime from the Hub.

Data isolation: one Postgres schema per app

Every current app gets its own Postgres schema — tables keep their natural names (tickets, companies) and cannot collide with any other app's, and row-level security applies inside the schema. Apps created before August 2026 used a shared schema with per-app table prefixes (e.g. bygg_employees); those were migrated to dedicated schemas. If you see both naming styles in older documents, that is the historical reason — isolation today is always per-schema + RLS.

MCP: connect Claude, Cursor or any agent

Nibor speaks Model Context Protocol on two levels. The platform server at POST /_mcp exposes the whole platform: generate complete apps from a prompt (nibor_create_app → poll nibor_generation_status → nibor_deploy_app), edit models and pages, query and modify app data, run read-only SQL, and manage webhooks — authenticated with a Platform API key (plat_…, from Portal → Developers) or a Bearer token, and gated to apps you own or belong to. With Claude Code it is one command:

claude mcp add --transport http nibor https://nibor.io/_mcp --header "X-API-Key: <your-plat-key>"

Portal → Developers → MCP also offers downloadable agent-workflow files (Claude skill, AGENTS.md for Codex/OpenCode, a Cursor rule) that teach your AI tool the build-poll-deploy loop and key hygiene.

The per-app server at POST /_api/apps/<app-id>/mcp (or /_mcp/app/<app-id>) scopes an agent to a single app's tables: one tool per operation on each resource, over a hundred for a typical app, gated by the API key's scopes. Example client config:

{
  "mcpServers": {
    "my-nibor-app": {
      "url": "https://nibor.io/_api/apps/<app-id>/mcp",
      "headers": { "Authorization": "Bearer <api-key>" }
    }
  }
}

Server functions and webhooks

Apps with business logic (validations, payments, custom flows) run compiled server functions; the Hub lists them with a test runner.

Outbound webhooks (your app notifies other systems)

App Hub → Connections → Webhooks: add a destination URL and the events to subscribe to (* for everything, or globs like contacts.*). On every confirmed record.created / record.updated / record.deleted, Nibor POSTs a JSON payload — signed with your secret as X-Nibor-Signature: sha256=<hex HMAC of the raw body> — and records the delivery status next to the hook. The Test button fires a signed test.delivery event so you can verify your receiver before going live.

Inbound webhooks (other systems notify your app)

Ask the chat: “handle Stripe checkout.session.completed webhooks” — it registers a receiver and compiles the handler. Point the provider at https://nibor.io/_api/apps/<appId>/webhook/<provider>. Signatures are verified (Stripe’s stripe-signature with a replay window; GitHub-style x-hub-signature-256 for others) against a named signing secret; if that secret is declared but not provisioned, the receiver answers 503 until it is — it never processes unverified silently.

Agent webhook (AI events into your app)

App Hub → Agents shows your app’s dedicated webhook URL and its auto-generated secret. External agents sign each POST with X-Agent-Signature: sha256=<hex HMAC>.

Export: take the whole stack

Download your app as a standalone project: compiled frontend, the full component runtime, PostgreSQL schema with row-level security, docker-compose, and the server functions. It runs on your own infrastructure with no connection back to Nibor. This is the same path enterprises use for on-prem deployments.

← Studio Workspace →