Build your own infrastructure.
LyEve is a self-hosted headless CMS in Go that runs on the database you already run: PostgreSQL, MySQL or SQL Server. Model your content once and it becomes real SQL tables and an API every app can read.
A free install, and an install with a signed license token, make no call to us, and the license check runs on your machine. A license key is exchanged with our license server for that token once, and again to renew it. The engine sends us nothing else.
- 83 MB
- image, measured
- 500 req/s
- reads by ID kept up on 1 vCPU, 1 GB
- 42 MB
- at rest on 1 vCPU, 1 GB
- 31
- plugins free of 51
collection posts
Name the fields. Pick a type. Save.
- title Text required
- slug Text required, indexed
- body Rich text
- published_on Date indexed
- author Relation belongs to authors
Saved. The engine writes the tables.
Pause it, or build your own collection below.
How it works
From an empty database to a live API.
Change the model and watch the table, the editor and the API follow it. This is what the console does, with nothing to install in between.
The model
collection posts
Rename a field, change its type, or add one. Everything on the right follows.
The table, on the database you run.
| Column | Type | Rules |
|---|---|---|
| title | TEXT | NOT NULL |
| slug | TEXT | NOT NULL, indexed |
| body | TEXT | - |
| cover | TEXT | - |
| published_on | DATE | indexed |
| author_id | UUID | NOT NULL, references authors, indexed |
| A join table links posts and tags. | ||
Plus an id, the timestamps and the other columns the engine manages. These are ordinary tables, so your own queries, reports and backups read them directly.
All of it is free, and it is the console you install.
Migrations
Change the model. The engine writes the migration.
Pick changes to a live collection and save. What touches no stored value applies at once. What would delete data asks first, then waits for an administrator.
collection posts · 1,284 entries
Database synced
Save preview
- 1 Add column subtitle TEXT On save
- 2 Drop column legacy_id Asks first
Nothing runs until you save.
- Applies on save
- Runs when you save. No stored value is touched.
- Asks first
- The console names the column and how many entries the collection holds, and waits for you. Then the column and its values stay until an administrator applies the drop.
Bring your model
From the CMS you use today
Import content types from Strapi, Contentful, WordPress (an ACF export), JSON Schema or OpenAPI. A dry run lists every collection it would create or change, and the statements, before anything is applied.
Bring your content
CSV, JSON, YAML or XLSX, row by row
Map columns to fields, run it dry, then import with progress, cancel and rollback, or update entries by a key you choose. Every row's result is kept with its error, so you can see which rows it refused and why.
Both are free.
Flows
Wire up the work around your content.
A flow runs inside your instance when content changes, on a schedule, on a button or on a REST call. Draw it on the canvas, test it step by step, then switch it on. Twenty flows per tenant are free.
One GET endpoint that joins orders, customers and shipments. A shipped template, built only from nodes that stay inside your instance.
Test run
Press Test run to watch each step pass its output to the next.
The engine
One engine between your apps and your data.
Pull it, point it at your database, and it serves. Trace a request to see what it passes on the way.
1
Your apps
A site, a mobile app, a service. Anything that speaks HTTP.
TypeScript
@lyeve-labs/client and client-rest
React, Vue, Svelte
hooks, composables and stores
GraphQL, gRPC, realtime
with their plugins
2
LyEve
One engine image, 83 MB, for amd64 and arm64, running as non-root. The console runs beside it as its own image.
Every request, before it reaches your data
- Headers and limits Security headers on every response, a cap on body size, and only the hosts you allow.
- Who is asking A signed session token or an API key. Keys are stored hashed, never in plaintext.
- Which tenant The request belongs to one tenant, and it reads and writes only that tenant's content.
- Rate limits The engine limits every route it serves, in process or on Redis.
- Roles and fields Rules per collection for each role, and fields masked for roles that may not read them.
Plugins add their own steps when you turn them on, such as a web application firewall or data residency rules.
51 plugins compiled in, 31 start free. A license key turns on the rest, checked on the machine.
Browse the plugins3
Your database
Ordinary tables you can query, report on and back up yourself.
- PostgreSQL
- MySQL
- SQL Server
Alongside it, when you want them
Redis
Optional. Shared cache, limits, realtime and flows across replicas.
S3 or local disk
Where media lives. A deployment choice, both free.
NATS, Kafka, RabbitMQ
Event streams, with the licensed message broker plugin.
Free tier
The free tier is the product.
This is what runs with no license key, with three admin accounts and the limits named below.
- GET /api/v1/content/posts/cursor?limit=2
200 { "data": [ { "id": "3f9a…", "data": { "title": "Hello, world" } }, { "id": "8c21…", "data": { "title": "Shipping on Friday" } }, ], "next_cursor": "8c21…" }
Content API and editor
Full CRUD, filtering and cursor pagination, generated from your schema.
-
posts
- titletext
- slugslug
- bodyrich text
- published_ondate
- authorbelongs_to
authors
- nametext
- emailemail
Schema Builder
Every field type, belongs_to / has_many / many_to_many, a list editor and the built-in presets. Schema Pro adds the visual canvas of your content types and presets of your own, $2 a month, in beta.
-
trigger.event
Entry published
content.query
Load subscribers
control.switch
Any to tell?
content.upsert
Queue the digest
3 of 20 flows on this tenant
Flow canvas
Twenty flows per tenant on the nodes that stay inside the instance, started by an event, a schedule, a button or a REST call. Flow Pro lifts the cap and reaches outside the instance, $8 a month.
-
Shipping on Friday
- draft
- pending_review
- in_review
- approved
- published live
Editorial review
One workflow per tenant with ordered stages, assignments, role-gated transitions and an approval that publishes. Review Pro adds more workflows, escalation and approvals from several reviewers, $3 a month, in beta.
- published
- revision 3 just now
- revision 2 4 min ago
- revision 1 8 min ago
Drafts and revisions
Drafts, a publish step and revision history, which you turn on for the content types that need it. You set how long versions are kept, and the last 30 days read and restore. Content Releases reads all of it, publishes many entries together and adds comment threads, $3 a month, in beta.
-
cover.jpg
Stored with its thumbnail. Same API on either driver.
Media, local or S3
Both drivers, thumbnails and tenant-prefixed keys. Which one you run is a deployment choice. Image transforms serve any size and format from a signed URL, free up to 1,000 stored variants per tenant. Image Transforms lifts that ceiling for $3 a month, in beta.
- de
?locale=en
- title
- Shipping on Friday
- summary
- What changes for you this week.
Languages
Two per tenant, with per-field translations and fallback to the default. Localization Pro removes the limit, $5 a month.
- Strapi posts authors
Import
Your model from Strapi, Contentful, WordPress, JSON Schema or OpenAPI, and your content as CSV, JSON, NDJSON, YAML or XLSX. The way in is free on purpose. Saved mapping templates and the date, split and lookup transforms come with Content Releases, $3 a month, in beta.
- 0 3 * * *
cron.job.failed, a flow picks it up
Scheduled jobs
Cron schedules that call your endpoint, 30 days of run history, a failure event a flow can react to, and an email when a job keeps failing. Alerts Pro sends to Slack, Discord, PagerDuty or a signed webhook, for errors, logs and uptime checks too, $3 a month, in beta.
- A fourth role is Roles ProtitleShipping on Friday author_email ••••••••readeditdelete
Role-based access
Roles you name, per-schema rules, field-level masks and the permissions UI. Three roles free. Roles Pro makes them unlimited, $2 a month.
- Key for the storefront
ly_••••••••••••3a7f
Only a hash is stored.
1,284 requests today
API keys and usage
Keys with scopes and an expiry, a log of every request, and usage metered per key and per tenant. Five keys per tenant and thirty days of log are free. Unlimited keys, the whole log and a monthly ceiling per key are API Keys Pro at $2 a month, and tenant quotas are Usage Quotas at $3, both in beta.
- RateLimit-Remaining: 6
Per IP, on every route the engine serves
Rate limiting
The engine's own limits, in process or on Redis, on every route it serves. Rate Limits Pro adds rules per route, tenant or role, address allow and deny lists, a limit per tenant and a history of refused requests, $3 a month.
-
482 193
Authenticator code, 30s
Sign in on another device
8 recovery codes
One provider, your pick
Sign-in
Two-factor codes from an authenticator app, recovery codes, sign-in on another device by QR code, a super admin reset for a lost second factor, and one social provider such as Google, GitHub or Apple. Passkey enrollment is MFA Pro at $13 a month, and more providers are OAuth Pro at $13.
- POST hooks.example.com/orders 3 of 25 endpoints
X-Webhook-Signature: sha256=9b1e4c07a2f3d8e6b5c1a9f0e7d2c4b8a6f3e1d0c9b7a5f2e8d6c4b1a3f5e7d9
- 503 attempt 1, retry in 30s
- 200 attempt 2, delivered
Webhooks
Signed deliveries to 25 endpoints per tenant, with retries and a log of every attempt. Webhooks Pro lifts the limit and adds replay, templates and filters, $2 a month.
-
Email
One SMTP provider and five templates per tenant, every word and the design yours to change. Password reset and sign-in link mails are two of the five. Email Pro adds providers with failover, unlimited templates and delivery analytics, $3 a month.
Security
Hardened before you configure it.
Try something against a running install and watch where it stops. Every answer comes from the engine or a free plugin, and only the host check needs a setting, your list of hosts.
>
- bcrypt password hashing by default, argon2id through PASSWORD_HASH_ALGO
- API keys stored only as a hash, SHA-256 or HMAC-SHA256 with a pepper, never in plaintext
- Ed25519-signed license tokens, verified on the machine, with no call out. A license key is exchanged for one with our license server
- EdDSA-signed session tokens with a public JWKS endpoint
- Per-IP rate limiting and host allowlisting on every inbound request
- HTTP-only secure session cookies and security headers on every response
- Each tenant keeps its own content, users and keys, and no other tenant can read them
- Two-factor sign-in with authenticator-app codes, the secret encrypted and recovery codes hashed
- WebAuthn passkeys (MFA Pro, $13 a month)
Compared
How LyEve compares
LyEve beside Strapi, Directus and Payload, each alone on the same AWS t2.micro: 1 virtual CPU and 1 GB of memory, with its own PostgreSQL.
Boots in
From docker compose up, with an empty database, to its first successful answer
- LyEve 12.3s Measured
- Strapi 16.1s Measured
- Directus 28.8s Measured
- Payload 14.3s Measured
| LyEve | Strapi | Directus | Payload | |
|---|---|---|---|---|
| Runtime | Go | Node.js | Node.js | Node.js |
| Engine license | MIT | MIT | MSCL 1.0 | MIT |
| Image size | 83 MB | 1.9 GB | 970 MB | 2.0 GB |
| Boots on 1 vCPU, 1 GB | 12.3 s | 16.1 s | 28.8 s | 14.3 s |
| At rest on 1 vCPU, 1 GB | 42 MB | 138 MB | 249 MB | 156 MB |
| Reads by ID kept up on 1 vCPU, 1 GB | 500 req/s | 100 req/s | 200 req/s | 300 req/s |
Measured, not estimated. Boot, memory at rest and reads by ID: each product alone on the same AWS t2.micro, each figure the median of the runs that measured it, from 2026-10-26. The load stepped up to 500 requests a second, so that is the most any product could reach. Image size: the uncompressed image for amd64, the sum of its layers, measured on 2026-10-20. See how each number was taken.
Pricing
Free until you need something paid.
Self-hosted
$0
no account, no license key
The MIT engine, the console, content, schemas, flows, editorial review, RBAC, media and 31 of the 51 plugins. No license key, no expiry and no row limit. Three admin accounts are free.
One license key
$2.00 /mo and up
per capability, cancel any time
Switch on any of 46 paid capabilities with one environment variable: GraphQL, gRPC, AI, full-text search, SAML SSO, audit, WAF. Every one of them is already in the images you pulled. All of them together is $199.50 a month, 25% off. A free install runs one tenant. More tenants take the Tenant Provisioning add-on, in beta at $18 a month, or the Enterprise plan at $119 a month, which includes it.
Your content, in your database, on your host.
Start free. When you need GraphQL, SSO or anything else in the catalog, you buy it, update your license key, and it is on. There is nothing to install, because it already shipped in the images you pulled.