# Pylon > The realtime backend framework. Schema, policies, functions, live queries, auth — one binary. ## Docs - [Account deletion](https://docs.pylonsync.com/auth/account.md): GDPR-style hard account deletion — revoke every session, API key, OAuth link, trusted device, and delete the User row in one call. - [API keys](https://docs.pylonsync.com/auth/api-keys.md): Long-lived keys for server-to-server calls — create, scope, rotate, revoke. - [Stripe billing](https://docs.pylonsync.com/auth/billing.md): Hosted Checkout sessions + signed webhook verification — wire up subscription billing without spinning up your own billing service. - [CAPTCHA](https://docs.pylonsync.com/auth/captcha.md): Gate magic-code send, password register, phone send-code, and magic-link send with hCaptcha, Cloudflare Turnstile, or reCAPTCHA. - [Email verification](https://docs.pylonsync.com/auth/email-verification.md): 6-digit code flow to verify an authenticated user's email — same primitive as magic-code sign-in. - [JWT sessions](https://docs.pylonsync.com/auth/jwt.md): Optional stateless `Authorization: Bearer ` mode — exchange an opaque session for a short-lived signed JWT. - [Magic codes](https://docs.pylonsync.com/auth/magic-codes.md): Email a 6-digit code, exchange it for a session. Pylon's recommended sign-in flow. - [OAuth — 25+ providers + OIDC](https://docs.pylonsync.com/auth/oauth.md): Built-in OAuth for Google, GitHub, Apple, Microsoft, Discord, Slack, plus 19 more — and any OpenID Connect provider via discovery. - [OIDC provider](https://docs.pylonsync.com/auth/oidc-provider.md): Pylon as an OIDC IdP for other systems — discovery doc + JWKS endpoints, optional RSA key publication. - [Organizations](https://docs.pylonsync.com/auth/organizations.md): Multi-tenant orgs with owner/admin/member roles, email invites, and active-tenant session state — declared as manifest entities so apps customize the schema freely. - [Auth overview](https://docs.pylonsync.com/auth/overview.md): Sessions, magic codes, password, OAuth, RBAC, API keys — what Pylon ships out of the box. - [Passkeys / WebAuthn](https://docs.pylonsync.com/auth/passkeys.md): FIDO2 / WebAuthn passkeys with ES256 + Ed25519 signature verification, counter-regression detection, and built-in challenge persistence. - [Email + password](https://docs.pylonsync.com/auth/password.md): Argon2id-hashed credentials with built-in registration, login, and timing-attack defenses. - [Phone / SMS sign-in](https://docs.pylonsync.com/auth/phone.md): E.164-normalized phone sign-in with 6-digit SMS codes — Twilio transport built in, custom SmsSender for any provider. - [Roles & multi-tenancy (RBAC)](https://docs.pylonsync.com/auth/rbac.md): Roles, the active tenant, and writing row-scoped policies that compose with both. - [SCIM 2.0](https://docs.pylonsync.com/auth/scim.md): RFC 7644 user provisioning — Okta, Azure AD, and other IdPs can create / read / deactivate users in Pylon. - [Sessions](https://docs.pylonsync.com/auth/sessions.md): Opaque tokens, refresh, revoke, persistent storage, cookies — how Pylon manages auth state. - [SIWE (Sign-In With Ethereum)](https://docs.pylonsync.com/auth/siwe.md): EIP-4361 sign-in keyed on wallet addresses — secp256k1 ECDSA + Keccak-256 recovery, no third-party wallet service. - [SSO (per-org)](https://docs.pylonsync.com/auth/sso.md): Per-organization OIDC + SAML 2.0 — each org owner configures their own IdP, members sign in through it. - [TOTP / 2FA](https://docs.pylonsync.com/auth/totp.md): RFC 6238 time-based one-time passwords — enroll, verify, backup codes, encryption at rest. - [Trusted devices](https://docs.pylonsync.com/auth/trusted-devices.md): Remember-this-browser cookie that lets a user skip the TOTP prompt for 30 days from the same device. - [Loro CRDTs](https://docs.pylonsync.com/clients/loro.md): @pylonsync/loro — collaborative text, lists, maps, trees that converge across clients. - [Next.js SDK](https://docs.pylonsync.com/clients/next.md): @pylonsync/next — Server Actions, RSC data fetching, middleware-friendly auth for Next.js App Router. - [Clients overview](https://docs.pylonsync.com/clients/overview.md): Pick the right SDK for your platform — TS, React, React Native, Next, Swift, sync engine, Loro. - [React SDK](https://docs.pylonsync.com/clients/react.md): @pylonsync/react — hooks for queries, mutations, sessions, search, infinite scroll, multiplayer shards. - [React Native SDK](https://docs.pylonsync.com/clients/react-native.md): @pylonsync/react-native — Expo SQLite-backed offline replica + AsyncStorage adapter. - [Swift SDK](https://docs.pylonsync.com/clients/swift.md): Native Swift for iOS, macOS, tvOS, watchOS, and Linux. PylonClient, PylonSync, PylonRealtime, PylonSwiftUI. - [Sync engine](https://docs.pylonsync.com/clients/sync.md): @pylonsync/sync — local replica, optimistic mutations, WebSocket/SSE/poll transports, offline write queue. - [TypeScript SDK](https://docs.pylonsync.com/clients/typescript.md): @pylonsync/sdk — schema DSL, manifest builder, codegen target. - [Pylon Cloud](https://docs.pylonsync.com/cloud.md): Hosted Pylon at cloud.pylonsync.com. Same binary, same APIs, no infrastructure to run. - [Pylon vs. Colyseus](https://docs.pylonsync.com/compare/colyseus.md): Colyseus is the canonical Node game server. Pylon ships game shards alongside app data. - [Pylon vs. Convex](https://docs.pylonsync.com/compare/convex.md): Pylon and Convex are the two TypeScript-first reactive backends. Here's how they actually differ. - [Pylon vs. Firebase](https://docs.pylonsync.com/compare/firebase.md): Firebase is the OG mobile-first BaaS. Pylon is what you'd build if you started from scratch in 2026. - [Pylon vs. Nakama](https://docs.pylonsync.com/compare/nakama.md): Nakama is a feature-rich Go game backend with social systems. Pylon is leaner with a tighter app/game integration. - [How Pylon compares](https://docs.pylonsync.com/compare/overview.md): Honest comparisons against Convex, Supabase, Firebase, Colyseus, Playroom Kit, and Nakama. - [Pylon vs. Playroom Kit](https://docs.pylonsync.com/compare/playroom.md): Playroom Kit is the easiest way to ship a web multiplayer game today. Pylon is for when 'easiest' isn't enough. - [Pylon vs. Supabase](https://docs.pylonsync.com/compare/supabase.md): Supabase is Postgres-as-a-platform. Pylon is one binary. Here's when each wins. - [Entities](https://docs.pylonsync.com/concepts/entities.md): Declare typed tables with fields, indexes, and relationships. - [Functions](https://docs.pylonsync.com/concepts/functions.md): Queries, mutations, and actions — your server-side RPC. - [Live queries](https://docs.pylonsync.com/concepts/live-queries.md): Subscriptions that stay in sync with zero extra code. - [Optimistic updates](https://docs.pylonsync.com/concepts/optimistic-updates.md): Local-first UI without the flash. - [Policies](https://docs.pylonsync.com/concepts/policies.md): Row-level access rules that live next to your schema. - [Search](https://docs.pylonsync.com/concepts/search.md): Native faceted full-text search — declarative, in-process, no separate index server. - [Installation](https://docs.pylonsync.com/installation.md): Install the Pylon CLI and runtime. - [Introduction](https://docs.pylonsync.com/introduction.md): Pylon is a realtime backend framework. One binary, typed end-to-end, built for apps that need to sync. - [Deploy](https://docs.pylonsync.com/operations/deploy.md): Production deployment shapes — single VPS, AWS ECS, Cloudflare Workers, or Pylon Cloud. - [Incident response](https://docs.pylonsync.com/operations/incident.md): Reporting security issues, the first five minutes, common incidents, post-mortem template. - [Sizing](https://docs.pylonsync.com/operations/sizing.md): Measured throughput numbers, capacity planning, and when to switch from SQLite to Postgres. - [Deploy with SST](https://docs.pylonsync.com/operations/sst.md): Ship Pylon to AWS as a stateless Fargate container with managed Aurora Postgres, S3 file storage, ALB, and a CDN — defined in one TypeScript file. - [Admin token rotation](https://docs.pylonsync.com/operations/token-rotation.md): Rotate PYLON_ADMIN_TOKEN without downtime, or in an emergency after suspected compromise. - [Cloudflare Workers costs](https://docs.pylonsync.com/operations/workers-costs.md): When Workers' scale-to-zero bites: pricing model, runaway patterns, kill switches. - [Data hygiene plugins](https://docs.pylonsync.com/plugins/data.md): Validation, computed fields, timestamps, slugs, soft delete, cascade, versioning, multi-tenancy. - [@pylonsync/feature-flags](https://docs.pylonsync.com/plugins/feature-flags.md): Local-eval feature flags — boolean + multivariate, percentage rollouts, targeting rules, JSON payloads per variant. - [Integration plugins](https://docs.pylonsync.com/plugins/integrations.md): File storage, cache, email, webhooks, Stripe, feature flags, audit log. - [Plugins overview](https://docs.pylonsync.com/plugins/overview.md): Declarative TS packages + runtime Rust hooks for security, data hygiene, search/AI, and integrations. - [Search & AI plugins](https://docs.pylonsync.com/plugins/search-ai.md): Full-text search (FTS5), vector similarity, AI provider proxy, MCP server. - [Security plugins](https://docs.pylonsync.com/plugins/security.md): Rate limiting, CSRF, CORS, SSRF defense, JWT validation, TOTP, API keys, session expiry. - [@pylonsync/stripe](https://docs.pylonsync.com/plugins/stripe.md): Declarative billing for Pylon apps — customer creation, checkout, billing portal, webhooks, and subscription state in one config block. - [@pylonsync/webhooks](https://docs.pylonsync.com/plugins/webhooks.md): Outbound webhook delivery — Svix-compatible HMAC signatures, exponential-backoff retries, secret rotation overlap. - [Writing your own plugin](https://docs.pylonsync.com/plugins/writing-your-own.md): Build a Pylon plugin in Rust — the trait, the registry, and the lifecycle. - [Quickstart](https://docs.pylonsync.com/quickstart.md): See Pylon running in five minutes — schema, policy, server, live sync. ## Optional - [Examples](https://github.com/pylonsync/pylon/tree/main/examples) - [GitHub](https://github.com/pylonsync/pylon) - [Changelog](https://github.com/pylonsync/pylon/releases)