A working backend in a few deliberate steps.

1. Install and sign in

npm install oneclient
npx oneclient login --email you@company.com

The CLI sends a short-lived email OTP and stores the resulting session in your operating system’s credential store when available. It does not ask you to paste a password or permanent API token.

2. Create your first project

npx oneclient init
# or non-interactively
npx oneclient project:create --name "Northline" --slug northline

An organization receives one tightly capped development project before subscription. The CLI reports provisioning state and only presents project URLs as ready when the backend confirms that they are live.

3. Add the TypeScript client

import { createClient } from "oneclient";

const one = createClient({
  baseUrl: process.env.ONECLIENT_API_URL!,
  publishableKey: process.env.NEXT_PUBLIC_ONECLIENT_PUBLISHABLE_KEY,
});

const session = await one.auth.getSession();

Use a publishable key in browser or mobile code. Use a server key only in a trusted runtime and keep it out of client bundles, logs, repositories, and build artifacts.

4. Define data policy before client access

{
  "tables": {
    "profiles": {
      "select": {
        "where": ["eq", ["field", "user_id"], ["claim", "auth.user.id"]],
        "maxRows": 50
      },
      "insert": {
        "fields": ["display_name", "avatar_url"]
      }
    }
  }
}

Client policy is deny-by-default. The backend validates the JSON query AST, turns allowed operations into parameterized SQL, and pushes row predicates into the query. Clients never submit raw SQL.

5. Inspect and deploy

npx oneclient status
npx oneclient doctor
npx oneclient deploy --project prj_... --environment development
npx oneclient deployments --project prj_...

Next steps

• Set trusted auth origins and callback URLs.
• Create narrowly scoped server keys and deploy tokens.
• Configure usage alert thresholds and hard project limits.
• Connect a custom app/API domain after production is ready.
• Read AI & MCP before giving an agent platform access.