Individual skill

pocketbase-best-practices

PocketBase development best practices covering collection design, API rules, authentication, SDK usage, query optimization, realtime subscriptions, file handling, deployment, and server-side extending (Go + JSVM). Current as of PocketBase v0.40 and JS SDK v0.28. Use when building PocketBase backends, designing schemas, implementing access control, setting up auth flows, or optimizing performance.

skills/pocketbase-best-practices/SKILL.md

Read pinned source

Source commit 6565fa03a8356bfc3127b1e7d086787a19e71813

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: Yes
Skill scan complete: Yes
Observed behavior: Network or broad shell
Last checked: Nov 11, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 14
Repository last updated: Aug 23, 2026
License: MIT

Observed agent integration: codex

agent-skills Repository topic
ai-agents Repository topic
best-practices Repository topic
claude-code Repository topic
pocketbase Repository topic
design Derived category
devops Derived category
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

AGENTS.mddoc · 6,547 bytes
SKILL.mdcore · 10,967 bytes
metadata.jsonasset · 1,539 bytes
references/api-rules-security.mddoc · 17,320 bytes
references/authentication.mddoc · 21,850 bytes
references/collection-design.mddoc · 15,111 bytes
references/file-handling.mddoc · 15,197 bytes
references/production-deployment.mddoc · 31,621 bytes
references/query-performance.mddoc · 28,514 bytes
references/realtime.mddoc · 19,876 bytes
references/sdk-usage.mddoc · 29,182 bytes
references/server-side-extending.mddoc · 77,020 bytes
rules/_sections.mddoc · 1,894 bytes
rules/_template.mddoc · 855 bytes
rules/auth-impersonation.mddoc · 3,779 bytes
rules/auth-mfa.mddoc · 3,635 bytes
rules/auth-oauth2.mddoc · 4,999 bytes
rules/auth-otp.mddoc · 3,601 bytes
rules/auth-password.mddoc · 2,841 bytes
rules/auth-token-management.mddoc · 3,558 bytes
rules/coll-auth-vs-base.mddoc · 2,153 bytes
rules/coll-field-types.mddoc · 2,703 bytes
rules/coll-geopoint.mddoc · 3,380 bytes
rules/coll-indexes.mddoc · 2,351 bytes
rules/coll-relations.mddoc · 2,950 bytes
rules/coll-view-collections.mddoc · 2,115 bytes
rules/deploy-backup.mddoc · 4,276 bytes
rules/deploy-configuration.mddoc · 4,917 bytes
rules/deploy-rate-limiting.mddoc · 5,160 bytes
rules/deploy-reverse-proxy.mddoc · 5,740 bytes
rules/deploy-scaling.mddoc · 3,845 bytes
rules/deploy-sqlite-considerations.mddoc · 6,464 bytes
rules/deploy-superuser-ips.mddoc · 1,869 bytes
rules/ext-compose-request-flow.mddoc · 9,919 bytes
rules/ext-cron-jobs.mddoc · 4,464 bytes
rules/ext-filesystem.mddoc · 4,327 bytes
rules/ext-filter-binding-server.mddoc · 3,219 bytes
rules/ext-go-custom-sqlite.mddoc · 4,601 bytes
rules/ext-go-migrations.mddoc · 4,326 bytes
rules/ext-go-setup.mddoc · 3,659 bytes
rules/ext-hooks-chain.mddoc · 3,441 bytes
rules/ext-hooks-record-vs-request.mddoc · 3,088 bytes
rules/ext-js-migrations.mddoc · 4,803 bytes
rules/ext-js-setup.mddoc · 2,581 bytes
rules/ext-jsvm-modules.mddoc · 4,057 bytes
rules/ext-jsvm-scope.mddoc · 2,810 bytes
rules/ext-mailer.mddoc · 5,226 bytes
rules/ext-routing-custom.mddoc · 3,912 bytes
rules/ext-settings.mddoc · 4,398 bytes
rules/ext-testing.mddoc · 7,251 bytes
rules/ext-transactions.mddoc · 3,287 bytes
rules/file-serving.mddoc · 5,886 bytes
rules/file-upload.mddoc · 4,313 bytes
rules/file-validation.mddoc · 5,149 bytes
rules/query-back-relations.mddoc · 4,761 bytes
rules/query-batch-operations.mddoc · 5,030 bytes
rules/query-expand.mddoc · 3,977 bytes
rules/query-field-selection.mddoc · 3,585 bytes
rules/query-first-item.mddoc · 4,287 bytes
rules/query-n-plus-one.mddoc · 4,057 bytes
rules/query-pagination.mddoc · 3,419 bytes
rules/realtime-auth.mddoc · 4,679 bytes
rules/realtime-events.mddoc · 4,683 bytes
rules/realtime-reconnection.mddoc · 5,446 bytes
rules/realtime-subscribe.mddoc · 5,374 bytes
rules/rules-basics.mddoc · 2,708 bytes
rules/rules-cross-collection.mddoc · 2,682 bytes
rules/rules-filter-syntax.mddoc · 3,264 bytes
rules/rules-locked-vs-open.mddoc · 3,160 bytes
rules/rules-request-context.mddoc · 3,187 bytes
rules/rules-strftime.mddoc · 2,837 bytes
rules/sdk-auth-store.mddoc · 3,851 bytes
rules/sdk-auto-cancellation.mddoc · 4,361 bytes
rules/sdk-error-handling.mddoc · 4,721 bytes
rules/sdk-field-modifiers.mddoc · 3,836 bytes
rules/sdk-filter-binding.mddoc · 4,551 bytes
rules/sdk-initialization.mddoc · 4,111 bytes
rules/sdk-send-hooks.mddoc · 4,372 bytes

Read excerpt


# PocketBase Best Practices

PocketBase is a single-binary backend (SQLite + REST + realtime + auth) that is easy to start with and easy to misuse at scale. This skill gives AI agents the guardrails: **64 rules across 9 categories**, each with an incorrect vs. correct code example, covering the mistakes agents actually make — insecure API rules, unindexed queries, broken auth flows, N+1 expands, leaked server-side handles.

**Updated for PocketBase v0.40 and JS SDK v0.28 (August 2026).** Works with v0.36+.

## How rules are prioritized

Every rule carries an impact level: **Critical** = security holes or broken data models, **High** = performance and correctness problems, **Medium/Low** = operational polish. When rules conflict, higher impact wins.

## What's covered

| Category | Impact | What it protects you from |
|----------|--------|---------------------------|