pre-release · v0.4: organisations are in →

Prepared stock
for Go APIs.

The app a careful senior Go engineer would have set up. Postgres, sign-in with 2FA and passkeys, organisations, jobs and ops endpoints, written into your repo. You own every file.

$git clone https://github.com/apistockhq/apistock.git && cd apistock/cli && go install ./cmd/aps
Read the quickstart → See a generated API
~/codeaps
$ aps new acme-api --preset full --tenancy multi
creating acme-api in ./acme-api
preset full · tenancy multi · library ../apistock

✓ ran go mod tidy
✓ initialised git

created acme-api

  api docs     http://localhost:8080/docs
  emails       http://127.0.0.1:8025

  next: cd acme-api
        aps dev
$
1Database. Postgres
0ORMs, DI containers
11Library modules
50Decision records
01 / Decisions

It makes the calls, and says what each one costs.

You're not picking a router, a migration tool and an auth library on day one. Each choice below has a written record you can read before you commit.

DecidedCost

Postgres only. No ORM.

No MySQL, no SQLite. If that rules you out, it rules you out.

ADR-0005

One SQL file per query.

More files than a query builder. Each one is a query you can read in review and explain in production.

ADR-0032

Auth is a library. The flows are yours.

Security fixes reach you with go get. Sign-up, sign-in and 2FA flows live in your repo, so you maintain what you change.

ADR-0038

Tenancy is chosen at creation.

Moving from single to multi-tenant with a command waits for aps add orgs in v0.5.

ADR-0048

Settings live in Postgres.

Change them without a deploy through /ops/settings. Secrets stay in the environment, never in the table.

ADR-0031
02 / Workflow

From an empty folder to a running API.

Four commands. Each one ends by naming the next, and generators add one line at a named anchor instead of rewriting your files.

01aps new acme-api

Cut the stock

Pick a preset and tenancy. You get a repository, not a dependency to wrap.

02aps dev

Start it locally

Postgres and Mailpit in Docker, migrations and seed data, the admin's password printed once.

03aps gen resource Invoice

Add what you sell

Four layers, one SQL file per query, and tests proving another organisation gets a 404.

04go build ./cmd/api

Ship one binary

Migrations run under an advisory lock. Release tracking shows which build every instance runs.

03 / What you get

Your code on top. Seasoned libraries underneath.

The generated app owns its flows, tables and SQL. The modules hold the parts that need security fixes and careful maintenance.

acme-api/
├── cmd/api              main and commands
├── db/migrations        forward-only SQL
├── internal/app         wiring, permissions
├── internal/modules/
│   ├── auth             yours: flows, SQL
│   ├── orgs             yours: members, invites
│   └── projects         yours: example resource
├── api/openapi.json     checked in, diffed
└── apistock.lock        recipe and version
apistock.dev/modulesOFFICIAL
authargon2id, sessions, TOTP, passkeys, Google and Apple
orgsOrganisation IDs, the membership check, invitation email
jobsRiver workers with schedules you change at runtime
settingsTyped runtime settings, live on every instance
auditpgAppend-only audit log with redaction
openapiHuma, problem errors and the /docs reference
postgresPool, transactions and goose migrations
releasesWhich build every instance is running

Your app keeps working if apistock disappears.

04 / Documentation

Two kinds of docs, one system.

The framework has its own site. Every app you generate serves its own API reference, in its own name.

docs.apistock.dev

Framework docs →

Guides, the CLI and every decision record, with search and a Markdown copy of each page.
your-app.com/docs

API reference →

Rendered from the checked-in openapi.json, with requests in curl, Go and TypeScript.

Start from stock, not from scratch.

One command gives you the parts a production Go API needs. What you build on it is yours.

Read the quickstart → Read the decisions