Relational data
userswith email, password hash, name, and rolecaseslinked to client and attorney userscase_updateslinked to case and authordocumentslinked to case and uploadermessageslinked to case, sender, and receiver
React backend workflow
A React backend you can inspect before you wire it.
Spala does not replace React. It makes backend development explicit for the frontend: relational models, authentication, REST endpoints, validation, documented errors, CORS requirements, publish state, and TypeScript handoff.
ModelDefine records, relationships, roles, and ownership.
ProtectUse authentication and project-specific access checks.
TestExercise success, validation, unauthorized, and forbidden paths.
Hand offGive React the exact API, auth, error, CORS, and type contract.
Direct answer
Use Spala when the frontend exists but the backend contract does not.
A React UI is not a backend specification. Before launch, the team still needs to agree on users, records, relationships, protected routes, validation, errors, environment values, and who can maintain the result.
Spala is a fit when those decisions should be visible in one project and handed to the frontend as a REST contract. It is not a fit when the team wants direct SQL ownership, a large open-source ecosystem, or infrastructure maturity equivalent to Supabase, Firebase, or a custom cloud stack.
Worked contract
Example: connect a React client portal.
Spala's current public Legal Client Portal template is a concrete starting contract with 5 relational models and 11 endpoint definitions. The template is inspectable; it is not a claim that a project is production ready without project-specific tests.
REST surface
GET /api/cases
GET /api/cases/{id}
POST /api/cases/{caseId}/updates
POST /api/cases/{caseId}/documents
POST /api/cases/{caseId}/messages
GET /api/invoices/{id}
Six representative definitions shown. Review all eleven in the template.
Frontend handoff
React should receive values, rules, and failure behavior - not another prompt.
The exact generated SDK may vary by project. This minimal fetch shape shows the information the handoff must make explicit.
const API_URL = import.meta.env.VITE_SPALA_API_URL;
export async function listCases(token: string) {
const response = await fetch(`${API_URL}/api/cases`, {
headers: { Authorization: `Bearer ${token}` },
});
if (response.status === 401) throw new Error('Sign in required');
if (response.status === 403) throw new Error('Access denied');
if (!response.ok) throw await response.json();
return response.json();
}Environment
Published API base URL and the correct frontend environment variable.
Authentication
Signup/login routes, token behavior, roles, and protected-route rules.
Contract
Request and response fields, validation rules, and route-specific errors.
Browser boundary
Approved CORS origins plus upload or realtime requirements when used.
Acceptance test
Do not call the backend finished until these paths pass.
Create and authenticate a user
Confirm password handling, login response, expiry, and the frontend's session behavior.
Read only owned records
A client must not receive another client's cases, messages, documents, or invoices.
Reject invalid input
Exercise missing fields and malformed values, then verify the exact 400 response React will render.
Separate 401 from 403
Unauthenticated and authenticated-but-forbidden requests need different behavior.
Verify browser access
Test the production React origin, preflight behavior, uploads, and any realtime channel used.
Review before publish
Inspect validation findings, secrets, project permissions, docs, and the final handoff artifacts.
Evidence and limits
What this page proves - and what it does not.
Inspectable now
- Current Spala dashboard screenshots show tables, endpoints, logic, testing, publish review, and MCP settings.
- The public client-portal template defines five models and eleven REST endpoint shapes.
- Spala can produce OpenAPI, JSON/Markdown docs, JavaScript and TypeScript handoff artifacts for project APIs.
Verify in your project
- The template is a starting contract, not a blanket production or security guarantee.
- Public MCP supports discovery and authenticated project handoff. Use the exact workspace-local configuration returned by
project_connect. - No public timing benchmark is claimed here. Measure build, repair, and integration time on your own acceptance workflow.
Bring the actual app
Get the backend surface reviewed before you add more generated code.
Send a repo, prototype, or deployed app URL. The review identifies the missing backend contract and the highest-risk handoff gaps. It is a scope review, not a security certification.
Questions
React and Spala, without the vague claims.
Can a React app use Spala as its backend?
Yes. React calls a published Spala REST API. The handoff should specify the base URL, auth, request/response shapes, errors, CORS, and any upload or realtime behavior.
Does Spala replace React?
No. React remains the frontend. Spala models, validates, publishes, and documents the backend behind it.
Are templates production ready automatically?
No. Treat them as starting contracts. Test authentication, ownership, validation, secrets, integrations, failure paths, and operations for the actual project.
Should I choose Spala or Supabase?
Choose based on the job. Supabase is stronger for direct Postgres control and ecosystem maturity. Evaluate Spala when guided assembly, visual inspection, validation, and frontend handoff are the bottleneck.