Verify JWTs three ways - against a provider's JWKS (Auth0, Clerk, Cognito, Firebase), a static PEM public key, or an HS256 shared secret - then protect a real per-user Postgres resource scoped to the token's sub claim. Reference endpoints for every is_valid_jwt mode plus a working, owner-scoped notes API and a one-call multi:true migration.
Turn your Postgres data into secure MCP tools any AI client (Claude Desktop, Claude Code, Cursor) can call. Two-tier auth: one shared token for yourself, or per-user tenant-scoped tokens for your customers - minted via an HS256 exchange or verified directly against your OIDC provider's JWKS (Auth0, Clerk, Cognito). Every tool reuses the same in-config token checks as a normal Air Pipe route. Tool discovery (tools/list) is gated behind the same per-user token via list_authorizer, so unauthenticated clients cannot enumerate your tools or their input schemas (engine >= 1.7.0).
The smallest useful MCP server: two tools over one Postgres table, guarded by a single shared token, in one config file. Point Claude Desktop, Claude Code, Cursor or any MCP client at your database with no SDK, no Node project and nothing to host. An Air Pipe interface is an HTTP route; add an mcp block and the same interface is also an MCP tool, secured by the same in-config token check. Tool discovery (tools/list) is gated by that same token via list_authorizer, so an unauthenticated client cannot even enumerate your tools or their input schemas. Includes a seed endpoint that creates the table and sample data in one curl.
A production-shaped REST API over a **MongoDB Atlas** database — CRUD for users, posts, and categories, optional JWT validation, and a set of **aggregation-pipeline analytics** endpoints. No ORM, no Mongoose, no backend boilerplate: point AirPipe at your Atlas connection string and you have an API. > Already on the Next.js + MongoDB stack? This is the missing backend. Deploy it over your existing Atlas cluster and start making requests in under 10 minutes.
A production-shaped multi-tenant backend over Postgres: API-key authentication (sha256-hashed, generated server-side, revocable), strict per-tenant data isolation, plan-based limits, and usage metering. Every request resolves its API key to exactly one tenant and every query is scoped to it — cross-tenant access is structurally impossible.
A production-shaped CRUD API over MySQL — users, posts, and comments, with optional JWT validation. Works with MySQL 8.x, MariaDB 10.5+, and PlanetScale. No ORM, no boilerplate: point Air Pipe at your MySQL connection string and you have an API.
The OAuth2 authorization-code flow with refresh, per user - the flow behind every 'connect your Google account' button. Single-use CSRF state, tokens sealed with AES-256-GCM (encrypt_value) and never stored in the clear, transparent refresh driven by an absolute expires_at, and correct handling of providers that send refresh_token only on the FIRST consent.
A production-shaped CRUD API over Postgres with three resource types (users, posts, comments) and optional JWT validation. No external services required — just a Postgres database. Deploy and start making requests in under 10 minutes.
Define a database connection and an auth check once, reference them everywhere. A Postgres starter that showcases Air Pipe reusable modules.
A production-shaped CRUD API over SQLite — users, posts, and comments, with optional JWT validation. Zero setup: no database server to provision, just a portable single-file .db. The zero-config, file-based member of the REST API Starter family. Self-hosted only — the SQLite driver runs in-process, so this pack is for your own AirPipe instance (local-first, edge, prototypes).
User signup and login with bcrypt password hashing and a signed JWT. Demonstrates bcrypt, bcrypt_verify, add_jwt.