Apps: Adding logic to your app

Backend functions

Run your own server code for secrets, privileged changes, third-party APIs and webhooks.

Some logic shouldn't run in the browser: calling an API with a secret key, changing records the visitor isn't allowed to touch, receiving webhooks. Backend functions run on your app's server.

Ask for one

"When a visitor submits the quote form, call the Pipedrive API with my API key to create a deal."

Draftship creates a function at app/api/functions/<name>/route.ts and calls it from the page with ds.functions.invoke("<name>", data).

What a function can do

Read and write every record with the service client — security rules don't apply.
Know who called it with getUser(req) (or null for signed-out visitors).
Use AI, images and email through the same integrations as the browser.
Read secrets from process.env.
Write to your app's logs.

See Backend functions reference for code.

Security

Functions are public URLs on your app. Anything sensitive must check getUser(req) and the user's role before acting.