Ready-to-deploy Air Pipe configurations. Preview the workflow, README and YAML — then deploy in one click.
A production-shaped CRUD API over Postgres with three resource types (users, posts, comments) and optional JWT validation. No external services required — just a Postgres database. Deploy and start making requests in under 10 minutes.
An API-layer network firewall — IP allow/deny lists (CIDR + IPv6), proxy-aware client resolution that defeats X-Forwarded-For spoofing, per-IP rate limiting, GeoIP/ASN blocking, monitor mode, and custom deny responses — declared per route. No database required.
Append-only audit log and compliance reporting API. Record every significant action in your system — logins, data access, mutations, exports, config changes — search them flexibly, generate compliance summaries, and manage retention. No extra services needed: it's all Postgres.
Query your database, format a summary email, and send it via [Resend](https://resend.com). Ships with a sample `app_events` table so you can try it immediately. Swap the query for any SQL that returns numbers your team cares about — signups, revenue, errors, API calls.
Lightweight product analytics backend. Track any named event with arbitrary properties, then query counts and user histories. No third-party analytics service required — your data stays in your database.
Postgres-backed feature flag API. Create, toggle, and check flags from any service.
Two endpoints to satisfy GDPR Article 15 (right of access) and Article 17 (right to erasure). Every request is logged to an audit table. Data is kept on your own infrastructure — nothing leaves your database.
Forwards GitHub events (push, pull request, issues) to a Discord channel as formatted embeds. No database required — it's a pure HTTP passthrough. Set up in under 5 minutes with two free accounts.
Capture leads from any form, landing page, or webhook. Every submission is validated, stored in Postgres, and fires an instant Slack notification. Your data stays on your infrastructure.
A production-shaped REST API over a **MongoDB Atlas** database — CRUD for users, posts, and categories, optional JWT validation, and a set of **aggregation-pipeline analytics** endpoints. No ORM, no Mongoose, no backend boilerplate: point AirPipe at your Atlas connection string and you have an API. > Already on the Next.js + MongoDB stack? This is the missing backend. Deploy it over your existing Atlas cluster and start making requests in under 10 minutes.
A production-shaped CRUD API over MySQL — users, posts, and comments, with optional JWT validation. Works with MySQL 8.x, MariaDB 10.5+, and PlanetScale. No ORM, no boilerplate: point Air Pipe at your MySQL connection string and you have an API.
Receives Stripe webhook events, verifies the signature, stores every event in Postgres with idempotency, and posts a Slack notification. One endpoint handles all event types.
A zero-dependency webhook capture tool. Point any webhook sender at `/webhooks/log` and the full request — body, headers, and query params — is stored in your Postgres database. Replay stored events to your local dev server without re-triggering the original source. Useful for debugging Stripe, GitHub, Shopify, or any other webhook-based integration. Captures headers like `X-Stripe-Signature`, `X-GitHub-Event`, and `X-Hub-Signature-256` alongside the body so you have everything needed to replay or verify the original request.
A reference config covering every core Air Pipe concept - the five input sources, interpolation forms, assertions, run conditions, transforms, and metrics - against public APIs (no database or managed variables needed). Not a production pack: use it as a learning reference and to seed a RAG chatbot with authoritative Air Pipe syntax.
Mirror an Airtable table into Postgres — every page of it. Airtable returns 100 records at a time behind an offset token, so a single fetch silently truncates; this follows every page and unpacks the nested {id, fields} record shape, upserting on the Airtable record id so re-running is safe.
Enrich each contact in a list via an upstream API. Demonstrates lookup fan-out (one call per item).
Accept a posted CSV body, parse it into rows, and bulk-insert them into a Postgres contacts table. Demonstrates parse_csv over the raw request body plus a lookup fan-out insert.
A verified Discord Interactions (slash-command) endpoint. Checks Discord's Ed25519 request signature with verify_signature before doing any work, answers the PING handshake, logs interactions to Postgres and replies in-channel. Discord signs asymmetrically, so its public key must never be used as an HMAC secret.
Poll an API on a schedule and process only new items, retrying only the items that fail — never the whole batch and never silently dropping a failure. Durable id-based dedupe via the state feature plus lookup_partition per-item retry. Includes a self-contained demo and a production poller template.
Ingest an event, flag it high-value (amount > 100) with the math transform, and insert only when it is. Demonstrates the math transform and a conditional insert.
Send Firebase Cloud Messaging (FCM) push notifications straight from your database — register device tokens, send to one device, or fan out to every device a user owns. No app server, no Firebase Admin SDK. A drop-in replacement for a Supabase + FCM setup.
Flow-control recipes for Air Pipe pipelines: throttle with the delay action, retry with exponential backoff, branch with run_on_assertion, try/catch/finally recovery, and at_least quorum. Every endpoint is self-contained — no external services, databases, or managed variables required.
Query Google's Gemini models over a simple HTTP API. Three routes: the full generateContent payload, just the answer text, or an instruction-prefixed answer. The API key and model are managed variables, so you can swap models without redeploying; the prompt is JSON-escaped before it hits the Gemini API.
Query a GraphQL API with variables and store the result, with the error handling GraphQL actually needs: a failed query returns HTTP 200 with an errors array, so a status check alone silently stores nulls. Asserts on body.errors before writing, and keeps values in variables rather than interpolating into the query text.
Verify JWTs three ways - against a provider's JWKS (Auth0, Clerk, Cognito, Firebase), a static PEM public key, or an HS256 shared secret - then protect a real per-user Postgres resource scoped to the token's sub claim. Reference endpoints for every is_valid_jwt mode plus a working, owner-scoped notes API and a one-call multi:true migration.
A configurable LLM completion and content-moderation endpoint. System prompt, model, and API key live in managed variables — swap providers or update prompts without touching the config or redeploying. Exposes POST /ai/complete (chat completion) and POST /ai/moderate (OpenAI moderation, free) with request validation and per-model metrics.
Turn your Postgres data into secure MCP tools any AI client (Claude Desktop, Claude Code, Cursor) can call. Two-tier auth: one shared token for yourself, or per-user tenant-scoped tokens for your customers - minted via an HS256 exchange or verified directly against your OIDC provider's JWKS (Auth0, Clerk, Cognito). Every tool reuses the same in-config token checks as a normal Air Pipe route. Tool discovery (tools/list) is gated behind the same per-user token via list_authorizer, so unauthenticated clients cannot enumerate your tools or their input schemas (engine >= 1.7.0).
Retrieval-Augmented Generation chatbot backed by MongoDB Atlas Vector Search. Ingest your own documents, embed them with OpenAI, and answer questions with $vectorSearch — your documents and their embeddings live in one database, no separate vector store. The Atlas-native companion to the pgvector AI RAG Chatbot.
A production-shaped multi-tenant backend over Postgres: API-key authentication (sha256-hashed, generated server-side, revocable), strict per-tenant data isolation, plan-based limits, and usage metering. Every request resolves its API key to exactly one tenant and every query is scoped to it — cross-tenant access is structurally impossible.
Full CRUD for a products table backed by MySQL (create, list, update, delete). Demonstrates the mysql driver with ? placeholders and input: a|params| pagination.
The OAuth2 authorization-code flow with refresh, per user - the flow behind every 'connect your Google account' button. Single-use CSRF state, tokens sealed with AES-256-GCM (encrypt_value) and never stored in the clear, transparent refresh driven by an absolute expires_at, and correct handling of providers that send refresh_token only on the FIRST consent.
Deploy this config and three things appear immediately with zero extra work; Prometheus Metrics, Open Telemetry Tracing, OpenAPI Spec documentation. Every request becomes a trace you can inspect end-to-end: method, path, status code, latency, and which actions ran inside it. No annotations beyond the config. No code. No separate instrumentation setup.
Retrieval-Augmented Generation chatbot backed by Postgres + pgvector. Ingest your own documents, store OpenAI embeddings alongside them, and answer questions using only your data — no third-party vector DB, no proprietary cloud, nothing leaves your infrastructure. Includes seed, ingest, chat, history, and delete endpoints.
A public endpoint rate-limited to 10 requests/min per IP. Demonstrates the native network rate_limit policy.
The EMQX/HiveMQ/AWS IoT alternative: a real MQTT broker (pub/sub, wildcards, retained, QoS 0/1/2, sessions) carried over WebSocket — PLUS your Air Pipe pipeline runs on every interface-shaped message (validate, enrich, store, republish). One vendor for transport, logic, auth and billing.
Open MQTT: clients connect with NO username or password and subscribe to a public topic for live data (sensors, transit, prices, status). EMQX/HiveMQ allow_anonymous model, but multi-tenant-safe — anonymous reaches only public interfaces, never private topics — and your pipeline runs on the public stream.
The simplest realtime: a PUBLIC WebSocket feed your website visitors subscribe to with NO auth — live scores, status, prices, announcements. Your backend publishes; every open browser gets it instantly. Ably/Pusher public channel, no keys in the browser, no broker to run.
The Ably/Pusher alternative: pub/sub channels, presence, history-rewind and retained state over WebSocket — with open, Air Pipe-issued, or bring-your-own-JWT auth, and your pipeline running on every message. No broker or Redis to run.
Define a database connection and an auth check once, reference them everywhere. A Postgres starter that showcases Air Pipe reusable modules.
Fetch an RSS feed and return its parsed items. Demonstrates parsing an XML response with http data_type: xml.
Private file storage on S3-compatible object storage where the file never transits Air Pipe. Postgres holds the metadata; clients upload straight to S3 via a presigned PUT and download via a short-lived presigned GET, so the bucket stays private and links expire. Works with AWS S3, Cloudflare R2, MinIO or Backblaze B2.
Nightly job that deletes rows older than 30 days and posts a Slack summary. Demonstrates a cron schedule on an interface.
Two ways to send transactional email from one Air Pipe route, with an identical { to, subject, html } body: the native email action over SMTP (STARTTLS, works with any mail server) or the Resend HTTP API. Pick the file for your provider; user values are JSON-escaped so quotes and newlines can't break the payload.
Receive Shopify order webhooks, verify the base64 X-Shopify-Hmac-Sha256 signature (is_valid_hmac with encoding: base64 — Shopify base64-encodes its digest where GitHub/Stripe/Slack use hex), and upsert orders into Postgres idempotently, with a recent-orders and paid-revenue reporting endpoint.
Approve/Reject buttons in Slack, end to end. Slack posts its interactivity payload as JSON inside a urlencoded `payload` FORM FIELD, so it must be parsed with yaml_to_json before anything can read it, and the signature is over the RAW body. Records the decision, then replaces the original message via response_url so the buttons disappear. Catches chat.postMessage failing as ok:false at HTTP 200, and a double-click is idempotent rather than an error.
Verified Slack slash-command endpoint: checks the X-Slack-Signature HMAC before logging the command to Postgres and replying with an ephemeral message.
A production-shaped CRUD API over SQLite — users, posts, and comments, with optional JWT validation. Zero setup: no database server to provision, just a portable single-file .db. The zero-config, file-based member of the REST API Starter family. Self-hosted only — the SQLite driver runs in-process, so this pack is for your own AirPipe instance (local-first, edge, prototypes).
Summarise subscriptions — monthly recurring revenue (sum of amounts) and count grouped by status — and compute days-since a signup date. Demonstrates the aggregate transform and the ->days_since date derive.
A Twilio SMS bot served straight from your database. Receives inbound SMS via a Twilio webhook, replies instantly with TwiML, routes keyword commands to canned replies, handles STOP/START opt-out, and logs every message. No app server.
User signup and login with bcrypt password hashing and a signed JWT. Demonstrates bcrypt, bcrypt_verify, add_jwt.