Next.js admin panelAdd a content and admin layer to your Next.js app.

Runs inside your own Next.js app, on your own PostgreSQL or MySQL database, or SQLite for local work.

Read content straight from your database in your page code (the Direct API), or over REST.

Sign-in for your team: email and password, sessions and API keys, stored in your own database.

npx create-nextly-app@alpha my-app

01How it fits together

What you write, what Nextly runs, and who it is for

Each numbered part is explained under the drawing, with its limit where it has one.

Your Next.js app

  1. In your codenextly.config.tsCollections, singles, rules
    Nextly, inside your Next.js appThe adminAt /admin
    Who it is forYour team: entries, media, users
  2. In your codeapp/**/page.tsxYour routes and server code
    Nextly, inside your Next.js appThe Direct APITrusted server code
    Who it is forYour pages and routes
  3. Nextly, inside your Next.js appRESTUnder /admin/api, with API keys
    Who it is forOther apps and services
  4. In your codecollections/*.tsHooks in your collection config
    Nextly, inside your Next.js appHooksRun when content changes
    Who it is forYour code
  5. In your codeSet in the admin
    Nextly, inside your Next.js appWebhooksSigned, with retries
    Who it is forYour services

Your own PostgreSQL or MySQL database, or SQLite for local work

  1. The admin

    Model content in TypeScript or in the Visual Schema Builder. Both feed the same Nextly runtime, admin and APIs.

    Role-based permissions for each collection and action, plus field-level read and write rules in code, on a collection’s or single’s own fields.

    CMS for Next.js
  2. The Direct API

    Read content straight from your database in your page code (the Direct API), or over REST.

    LimitThe Direct API runs as trusted server code and skips access rules unless you pass overrideAccess: false.

    CMS for Next.js
  3. REST

    Access rules you write in code apply over REST and in the admin, including read rules on a collection’s or single’s own fields.

    LimitWith the rate limit on (the default), every REST request, the admin API included, counts against a budget for whoever is asking: a signed-in session, an API key, or an address.

    CMS for Next.js
  4. Hooks

    Hooks in code run before and after a change, a read or a delete.

    CMS for Next.js
  5. Webhooks

    Signed webhooks for content, media, user and form events, with retries, a delivery log, redelivery and secret rotation.

    CMS for Next.js

02Who does what

Who does what

Your code

  1. 01

    Create the project

    One command creates a project with the admin and a database: npx create-nextly-app@alpha my-app.

  2. 02

    Define the content

    Typed, code-defined schemas and APIs: nextly generate:types writes types for the collections, singles and field groups in your config.

  3. 03

    Read it in your routes

    Read content straight from your database in your page code (the Direct API), or over REST.

HandoverSign-in for your team: email and password, sessions and API keys, stored in your own database.

The admin

  1. 04

    Create the first admin

    In production, the web setup asks for a one-time setup token, printed in the server log, before it creates the first admin.

    The Nextly admin dashboard: what needs attention, buttons to create a post or a page, and the Content card counting the entries in each collection and listing the singles.
    The dashboard, with its collection counts and create buttons.

    Nextly admin · 0.0.2-alpha.69

  2. 05

    Manage the content

    A media library, stored on local disk by default, or on S3 (and R2 or MinIO), Vercel Blob or UploadThing.

    The Posts list in the admin: a search box, Filter and Columns buttons, the API and New Post buttons, and one post with its slug, dates, languages and excerpt.
    The Posts list, with search, filters and its API button.

    Nextly admin · 0.0.2-alpha.69

  3. 06

    See who changed what

    An activity feed of who created, changed or deleted entries, and a security audit trail.

    The dashboard's Recent activity card: who created or updated which post or page, how long ago, and how many times.
    The recent activity feed on the dashboard.

    Nextly admin · 0.0.2-alpha.69

03The parts

What you use, and where it comes from

In 0.0.2-alpha.70

PartWhat it doesPackageThe parts of Nextly this uses
Content modelModel content in TypeScript or in the Visual Schema Builder. Both feed the same Nextly runtime, admin and APIs.nextlyCMS for Next.js
Roles and field rulesRole-based permissions for each collection and action, plus field-level read and write rules in code, on a collection’s or single’s own fields.nextlyCMS for Next.js
Team sign-inSign-in for your team: email and password, sessions and API keys, stored in your own database.nextlyCMS for Next.js
MediaA media library, stored on local disk by default, or on S3 (and R2 or MinIO), Vercel Blob or UploadThing.nextlyCMS for Next.js
EmailSend email through Resend, SMTP or SendLayer, with templates you edit in the admin.nextlyCMS for Next.js
WebhooksSigned webhooks for content, media, user and form events, with retries, a delivery log, redelivery and secret rotation.nextlyCMS for Next.js
Background jobsBackground jobs, run by calling one endpoint from your scheduler.nextlyCMS for Next.js
DashboardAdd, remove, drag to reorder and choose the width of each dashboard card.nextlyCMS for Next.js

04In your code

The code you write

import { defineCollection, defineConfig, richText, text } from "nextly/config";

const Posts = defineCollection({
  slug: "posts",
  admin: { useAsTitle: "title" },
  fields: [
    text({ name: "title", required: true }),
    text({ name: "slug", required: true, unique: true }),
    richText({ name: "content" }),
  ],
  status: true,
});

export default defineConfig({ collections: [Posts] });

written for nextly 0.0.2-alpha.70

Try Nextly here, before you install it.

Pick a tour. Each one is a short, hands-on illustration of the product, and nothing here is saved.

A short tour, in your browser, and nothing is saved. Every control it draws is one Nextly 0.0.2-alpha.70 has; a dashed button is a tour shortcut.

An illustration of the Nextly admin and APIs nothing is saved

Step 1 of 3

1 · Define the field

1 · Define the field

In your code

export const Posts = defineCollection({
  slug: 'posts',
  fields: [
    { name: 'title', type: 'text' },
    { name: 'excerpt', type: 'textarea' },
  ],
})
Add one field. Watch the two panels on the right.Add one field. Watch the two panels below.

2 · The admin · Entry editor

Release notes: November

Excerpt

Content releases and version history.

3 · Your API

3 · Your API
const { items } = await nextly.find({
  collection: 'posts',
})

// response
{ "items": [{
    "title": "Release notes: November",
    "excerpt": "Content releases and…",
  }], "meta": { … } }

The Direct API reads straight from your database in your page code.

Code and the Visual Schema Builder both feed the same Nextly runtime, admin and APIs. The Visual Schema Builder runs on your development instance.

Add a field once, in TypeScript or in the Visual Schema Builder, and it reaches the editor and the API.

npx create-nextly-app@alpha my-app
Read the quick start

In 0.0.2-alpha.70

What ships today

Next.js appsAt a glance
Package
nextly
Release
0.0.2-alpha.70 · 25 Oct 2026
Licence
MIT
Runs in
Your own Next.js app, self-hosted
Databases
PostgreSQL 15+, MySQL 8+, SQLite 3.38+ for local work
APIs
The Direct API and REST
Requires
Node.js 22.12+ or 24+; Next.js 16 with the App Router; React 19

Where Nextly is today

Before you start

Nextly fits if you want

  • An admin for your team inside the app you already run.
  • Access rules in code that apply over REST and in the admin.
  • Your data in your own PostgreSQL or MySQL database.

Look elsewhere if you need

  • Sign-in for your site’s visitors or customers.
  • A GraphQL API. Nextly offers REST and the Direct API.
  • A hosted service. Nextly is self-hosted.
Access rules and the Direct API
The Direct API runs as trusted server code and skips access rules unless you pass overrideAccess: false. Called that way with no user, it is judged as a signed-out visitor: it can read where no rule names the read, and a create, update or delete needs a rule that allows it. Docs
Sign-in
Sign-in is for your team. It is not sign-in for site visitors or customers. Docs
Behind a proxy
Behind a proxy, set security.trustProxy so anonymous callers are told apart. Docs
Database versions
PostgreSQL 15 or later, MySQL 8 or later, SQLite 3.38 or later for local work. Docs

Nextly is in alpha. APIs may change before 1.0. Pin exact versions in production.

Questions

Short answers

Does Nextly run inside my Next.js app?

MIT licensed, self-hosted. Runs inside your own Next.js app, on your own PostgreSQL or MySQL database, or SQLite for local work.

Can my app’s customers sign in with Nextly?

No. Sign-in is for your team. It is not sign-in for site visitors or customers.

Do access rules apply to the Direct API?

The Direct API runs as trusted server code and skips access rules unless you pass overrideAccess: false. Called that way with no user, it is judged as a signed-out visitor: it can read where no rule names the read, and a create, update or delete needs a rule that allows it.

Does Nextly have a GraphQL API?

No. Nextly offers REST and the Direct API.

Is Nextly free?

Nextly is MIT licensed and self-hosted.

MIT today, and no decision yet about paid offerings.

Can a coding agent set it up?

Every new Nextly project ships with an AGENTS.md and CLAUDE.md written for coding agents.