2026-10-10 · 5 min read

How to add a database and login to an app made with AI

Apps made with Lovable, Bolt, v0 or a quick session with Claude often look finished and are not: everything you save disappears in another browser, the login is decorative and any visitor could read everyone's data. What is missing has a name, a backend, and you do not need to know how to build one to add it.

Signs your app has no backend

• You open it on your phone and your data is not there.
• The login accepts any password, or there is no login.
• The code mentions localStorage or a local .db file.
• There is an API key written directly in the code.

The three pieces, in plain words

A database

Tables on a server, like a spreadsheet each user writes into through your app. Rapibase gives each project its own Postgres, the most widely used open source database.

User login

Sign-up, login, password reset and, if you want, magic links or Google. The backend decides who is who; your app only shows the form.

Security rules

The piece people forget. Row level security tells the database "each user can only read and change their own rows". Without it, a user who knows a bit of JavaScript can read everything. With it, even if the frontend has a bug, the database refuses.

The prompt

Create a free Rapibase project, connect your agent (the console gives you the command) and open your app's code with it. Then ask:

This app saves its data in the browser. Use my Rapibase
project as the backend:
- create a table for each kind of data the app stores
- add sign-up and login with email
- turn on row level security so each user only sees their rows
- replace the localStorage code with calls to the Rapibase API
- keep the secret key out of the frontend
Explain what you created when you finish.

The agent reads the Rapibase guide before touching anything, so it knows how the API, the login and the rules work. You can watch the tables appear in the console as it goes.

How to know it worked

• Create two accounts. What one saves, the other must not see.
• Close the browser and open the app on another device: the data is still there.
• Ask the agent to list the security rules of each table: none should be left open.

Photos and files

If the app uploads images or documents, ask for a storage bucket: public for things anyone can see (product photos), private for things only the owner can download (invoices). The same idea applies: each user reaches only their own files.

And then, publish it

With the backend in place, the app can go online on the same project, with your own domain. The step by step is in the guide How to deploy an app built with Claude Code.