Overview & Concepts

ZodBack is a modular backend platform that lets you compose your application from independent feature modules. Each project can enable the modules it needs, and every module exposes both internal (dashboard) and public (external) APIs.

Core Architecture

• Multi-tenant by design — Every resource is scoped to a project_id. Row-Level Security (RLS) ensures strict data isolation.
• Module system — Blog, E-Commerce, Course, Portfolio, Documentation, Notes, Chats, Salary Anonymous. Enable only what you need.
• Scope governance — Resources can be system scope (managed by super-admins) or project scope (managed by project admins).
• API Token authentication — External consumers authenticate via API tokens with configurable allowed origins for CORS.

Key Concepts

Projects

A project is the top-level container. It has its own set of enabled modules, users, and configuration. All data belongs to a project.

Modules

Each module is self-contained with its own:

• Database tables (with project_id foreign key)
• NestJS controllers and services
• Frontend dashboard pages
• Public API endpoints (for external consumption)

Scopes

• System scope: Managed by super-admins only. Shared across the platform.
• Project scope: Managed by project admins. Specific to one project.

API Tokens

Tokens grant external access to public endpoints. Each token:

• Belongs to a specific project
• Can have allowed origins for CORS validation
• Is passed via Authorization: Bearer <token> or x-api-key: <token> header
• Project context is typically derived from the token (project-scoped tokens)

Module List