# Backend functions

> Run your own server code for secrets, privileged changes, third-party APIs and webhooks.


Some logic shouldn't run in the browser: calling an API with a secret key, changing records the visitor isn't allowed to touch, receiving webhooks. Backend functions run on your app's server.

## Ask for one

> "When a visitor submits the quote form, call the Pipedrive API with my API key to create a deal."

Draftship creates a function at `app/api/functions/<name>/route.ts` and calls it from the page with `ds.functions.invoke("<name>", data)`.

## What a function can do

- Read and write **every** record with the service client — security rules don't apply.
- Know **who called it** with `getUser(req)` (or `null` for signed-out visitors).
- Use AI, images and email through the same integrations as the browser.
- Read [secrets](/docs/logic/secrets) from `process.env`.
- Write to your app's [logs](/docs/logic/analytics-and-logs).

See [Backend functions reference](/docs/developers/backend/functions) for code.

## Security

Functions are public URLs on your app. Anything sensitive must check `getUser(req)` and the user's role before acting.