Introduction

Saaslivery is a multi-tenant ecosystem of small, interconnected productivity apps. Every app in a workspace runs under one address, {workspace}.saaslivery.com, inside a shell that keeps each app open in its own tab. Apps stay small on purpose, and they cooperate through an event bus instead of sharing databases.

This documentation is for developers building on the platform: core contributors adding first-party apps, and third-party developers publishing to the marketplace.

What building here looks like

A Saaslivery app is a Heaven plugin: async Python handlers, Jinja2 templates, HTMX for interactivity, and Alpine.js for client-side state. There is no build step, no bundler, and no frontend framework. You write server-rendered HTML and small JSON APIs; the platform provides authentication, sessions, workspace isolation, permissions, billing, and distribution.

from heaven import App

app = App(debug=False)
app.TEMPLATES("templates", relative_to=__file__, prefix="bookmarks")

# UI runs on the workspace subdomain, under your /app/ prefix
ws = app.subdomain("*")
ws.GET("/app/bookmarks/", "plugins.bookmarks.pages.index")

# JSON runs on the shared API subdomain
api = app.subdomain("api")
api.GET("/bookmarks", "plugins.bookmarks.apis.api_list")

Where to start

The rules that shape everything

Five constraints define the platform. Every other rule in these docs is a consequence of one of them.

1. Workspace isolation is absolute. Every table has a workspace_id, every query is scoped to it, and the platform enforces it in middleware, events, files, and WebSockets. See Multi-tenancy.
2. Apps never touch each other's data. Cross-app integration happens over the event bus, with local read models when an app needs to render another app's data.
3. Ten tables per app, maximum. An app that needs more is two apps. See What is an app?
4. The server renders the HTML. HTMX loads fragments, Alpine.js handles client-only state, and all data mutations go through the JSON API. See HTMX patterns.
5. The platform owns the chrome. Sessions, auth, CORS, asset serving, the app shell, and the security layers are platform concerns. Apps declare; the platform enforces.

Tech stack