# Next.js admin panel: Add a content and admin layer to your Next.js app.

Runs inside your own Next.js app, on your own PostgreSQL or MySQL database, or SQLite for local work.

Read content straight from your database in your page code (the Direct API), or over REST.

Sign-in for your team: email and password, sessions and API keys, stored in your own database.

[Start building](https://nextlyhq.com/docs/getting-started/quick-start.md) · [Read the docs](https://nextlyhq.com/docs/getting-started.md)

```bash
npx create-nextly-app@alpha my-app
```

## The short answer: Can I use Nextly as the admin panel for my Next.js app?

Yes. MIT licensed, self-hosted. Runs inside your own Next.js app, on your own PostgreSQL or MySQL database, or SQLite for local work. Role-based permissions for each collection and action, plus field-level read and write rules in code, on a collection’s or single’s own fields.

## How it fits together: What you write, what Nextly runs, and who it is for

Each numbered part is explained under the drawing, with its limit where it has one.

| # | In your code | Nextly, inside your Next.js app | Who it is for |
| --- | --- | --- | --- |
| 1 | `nextly.config.ts`: Collections, singles, rules | **The admin**: At /admin | Your team: entries, media, users |
| 2 | `app/**/page.tsx`: Your routes and server code | **The Direct API**: Trusted server code | Your pages and routes |
| 3 |  | **REST**: Under /admin/api, with API keys | Other apps and services |
| 4 | `collections/*.ts`: Hooks in your collection config | **Hooks**: Run when content changes | Your code |
| 5 | Set in the admin | **Webhooks**: Signed, with retries | Your services |

Your own PostgreSQL or MySQL database, or SQLite for local work

### 1. The admin

Model content in TypeScript or in the Visual Schema Builder. Both feed the same Nextly runtime, admin and APIs.

Role-based permissions for each collection and action, plus field-level read and write rules in code, on a collection’s or single’s own fields.

[CMS for Next.js](https://nextlyhq.com/nextjs-cms)

### 2. The Direct API

Read content straight from your database in your page code (the Direct API), or over REST.

Limit: The Direct API runs as trusted server code and skips access rules unless you pass `overrideAccess: false`.

[CMS for Next.js](https://nextlyhq.com/nextjs-cms)

### 3. REST

Access rules you write in code apply over REST and in the admin, including read rules on a collection’s or single’s own fields.

Limit: With the rate limit on (the default), every REST request, the admin API included, counts against a budget for whoever is asking: a signed-in session, an API key, or an address.

[CMS for Next.js](https://nextlyhq.com/nextjs-cms)

### 4. Hooks

Hooks in code run before and after a change, a read or a delete.

[CMS for Next.js](https://nextlyhq.com/nextjs-cms)

### 5. Webhooks

Signed webhooks for content, media, user and form events, with retries, a delivery log, redelivery and secret rotation.

[CMS for Next.js](https://nextlyhq.com/nextjs-cms)

## Who does what

### Your code

1. **Create the project.** One command creates a project with the admin and a database: `npx create-nextly-app@alpha my-app`.
2. **Define the content.** Typed, code-defined schemas and APIs: `nextly generate:types` writes types for the collections, singles and field groups in your config.
3. **Read it in your routes.** Read content straight from your database in your page code (the Direct API), or over REST.

**Handover:** Sign-in for your team: email and password, sessions and API keys, stored in your own database.

### The admin

4. **Create the first admin.** In production, the web setup asks for a one-time setup token, printed in the server log, before it creates the first admin.

   ![The Nextly admin dashboard: what needs attention, buttons to create a post or a page, and the Content card counting the entries in each collection and listing the singles.](https://nextlyhq.com/captures/dashboard-light.png)
   The dashboard, with its collection counts and create buttons. (Nextly admin · 0.0.2-alpha.69)

5. **Manage the content.** A media library, stored on local disk by default, or on S3 (and R2 or MinIO), Vercel Blob or UploadThing.

   ![The Posts list in the admin: a search box, Filter and Columns buttons, the API and New Post buttons, and one post with its slug, dates, languages and excerpt.](https://nextlyhq.com/captures/posts-list-light.png)
   The Posts list, with search, filters and its API button. (Nextly admin · 0.0.2-alpha.69)

6. **See who changed what.** An activity feed of who created, changed or deleted entries, and a security audit trail.

   ![The dashboard's Recent activity card: who created or updated which post or page, how long ago, and how many times.](https://nextlyhq.com/captures/dashboard-activity-light.png)
   The recent activity feed on the dashboard. (Nextly admin · 0.0.2-alpha.69)


## The parts: What you use, and where it comes from

| Part | What it does | Package |
| --- | --- | --- |
| [Content model](https://nextlyhq.com/nextjs-cms) | Model content in TypeScript or in the Visual Schema Builder. Both feed the same Nextly runtime, admin and APIs. | `nextly` |
| [Roles and field rules](https://nextlyhq.com/nextjs-cms) | Role-based permissions for each collection and action, plus field-level read and write rules in code, on a collection’s or single’s own fields. | `nextly` |
| [Team sign-in](https://nextlyhq.com/nextjs-cms) | Sign-in for your team: email and password, sessions and API keys, stored in your own database. | `nextly` |
| [Media](https://nextlyhq.com/nextjs-cms) | A media library, stored on local disk by default, or on S3 (and R2 or MinIO), Vercel Blob or UploadThing. | `nextly` |
| [Email](https://nextlyhq.com/nextjs-cms) | Send email through Resend, SMTP or SendLayer, with templates you edit in the admin. | `nextly` |
| [Webhooks](https://nextlyhq.com/nextjs-cms) | Signed webhooks for content, media, user and form events, with retries, a delivery log, redelivery and secret rotation. | `nextly` |
| [Background jobs](https://nextlyhq.com/nextjs-cms) | Background jobs, run by calling one endpoint from your scheduler. | `nextly` |
| [Dashboard](https://nextlyhq.com/nextjs-cms) | Add, remove, drag to reorder and choose the width of each dashboard card. | `nextly` |

## In your code: The code you write

`nextly.config.ts`

```ts
import { defineCollection, defineConfig, richText, text } from "nextly/config";

const Posts = defineCollection({
  slug: "posts",
  admin: { useAsTitle: "title" },
  fields: [
    text({ name: "title", required: true }),
    text({ name: "slug", required: true, unique: true }),
    richText({ name: "content" }),
  ],
  status: true,
});

export default defineConfig({ collections: [Posts] });
```

written for nextly 0.0.2-alpha.70.

`app/blog/page.tsx`

```tsx
import { getNextly } from "nextly";
import config from "@/nextly.config";

export default async function BlogPage() {
  const nextly = await getNextly({ config });
  const { items: posts } = await nextly.find({
    collection: "posts",
    where: { status: { equals: "published" } },
    sort: "-createdAt",
    limit: 10,
  });
  return <ul>{posts.map((p) => <li key={p.id}>{p.title}</li>)}</ul>;
}
```

written for nextly 0.0.2-alpha.70.

[Try the tour](https://nextlyhq.com/use-cases/nextjs-apps#tour)

A short tour, in your browser, and nothing is saved. Every control it draws is one Nextly 0.0.2-alpha.70 has; a dashed button is a tour shortcut.

## What ships today: in 0.0.2-alpha.70

- **Package:** `nextly`
- **Release:** `0.0.2-alpha.70` · 25 Oct 2026
- **Licence:** MIT
- **Runs in:** Your own Next.js app, self-hosted
- **Databases:** PostgreSQL 15+, MySQL 8+, SQLite 3.38+ for local work
- **APIs:** The Direct API and REST
- **Requires:** Node.js 22.12+ or 24+; Next.js 16 with the App Router; React 19

## Before you start

Nextly fits if you want:

- An admin for your team inside the app you already run.
- Access rules in code that apply over REST and in the admin.
- Your data in your own PostgreSQL or MySQL database.

Look elsewhere if you need:

- Sign-in for your site’s visitors or customers.
- A GraphQL API. Nextly offers REST and the Direct API.
- A hosted service. Nextly is self-hosted.

- **Access rules and the Direct API:** The Direct API runs as trusted server code and skips access rules unless you pass `overrideAccess: false`. Called that way with no `user`, it is judged as a signed-out visitor: it can read where no rule names the read, and a create, update or delete needs a rule that allows it. [Docs](https://nextlyhq.com/docs/permissions.md)
- **Sign-in:** Sign-in is for your team. It is not sign-in for site visitors or customers. [Docs](https://nextlyhq.com/docs/guides/authentication.md)
- **Behind a proxy:** Behind a proxy, set `security.trustProxy` so anonymous callers are told apart. [Docs](https://nextlyhq.com/docs/api-reference/rest-api.md)
- **Database versions:** PostgreSQL 15 or later, MySQL 8 or later, SQLite 3.38 or later for local work. [Docs](https://nextlyhq.com/docs/database.md)

Nextly is in alpha. APIs may change before 1.0. Pin exact versions in production.

## Short answers

### Does Nextly run inside my Next.js app?

MIT licensed, self-hosted. Runs inside your own Next.js app, on your own PostgreSQL or MySQL database, or SQLite for local work.

### Can my app’s customers sign in with Nextly?

No. Sign-in is for your team. It is not sign-in for site visitors or customers.

### Do access rules apply to the Direct API?

The Direct API runs as trusted server code and skips access rules unless you pass `overrideAccess: false`. Called that way with no `user`, it is judged as a signed-out visitor: it can read where no rule names the read, and a create, update or delete needs a rule that allows it.

### Does Nextly have a GraphQL API?

No. Nextly offers REST and the Direct API.

### Is Nextly free?

Nextly is MIT licensed and self-hosted. MIT today, and no decision yet about paid offerings.

### Can a coding agent set it up?

Every new Nextly project ships with an AGENTS.md and CLAUDE.md written for coding agents.

## The parts of Nextly this uses

- [CMS for Next.js](https://nextlyhq.com/nextjs-cms): Runs inside your own Next.js app, on your own PostgreSQL or MySQL database.
- [Publishing](https://nextlyhq.com/publishing): Working drafts, version history and Content Releases.
- [Plugins](https://nextlyhq.com/plugins): The established official plugins: Visual Page Builder, SEO and Form Builder.

- [Marketing websites](https://nextlyhq.com/use-cases/marketing-site.md): After a developer sets up and deploys Nextly, editors manage content and pages in the admin.
- [Headless CMS](https://nextlyhq.com/use-cases/headless-cms.md): Read content straight from your database in your page code (the Direct API), or over REST.