Managed backend for product teams

The log is your database.
We're the backend.

Auth, durable storage, realtime, and webhooks in one managed backend. Your app POSTs events; IoTMan keeps every one forever and instantly turns them into live views, REST snapshots, or signed webhooks. No database to operate, no auth service to wire, no message bus to run.

See what's new in v0.8 →

Free tier available. No credit card required.

producer → log → view
# A producer appends an event
POST /events/:stream
  Authorization: Bearer <producer_token>
  '{"type":"flag.toggled","flag":"checkout","on":false}'

# A consumer reads a materialized view over SSE
GET /views/:workspace/flags/events
→ live per-entity state, streamed as changes
What's included

One backend, not five services.

The pieces a small team would otherwise assemble from a database, an auth provider, a message bus, and a webhook worker. We run them; you use them.

Event views (materialized, no SQL)

Define a live per-entity table over your event log with a JSONata key and reducer. Point-lookup reads, prefix scans, and SSE change streams. No materialized views to maintain, no cache to invalidate.

AI agent access via MCPNew

Every workspace exposes an MCP endpoint. Claude Code, ChatGPT, and other spec-compliant agents register dynamically via OAuth2 and call workspace tools — with the exact scopes you grant. No custom integration code.

Atomic functions

Compose admin API calls in one database transaction using JSONata. Issue a credit, provision a device, close a session — all-or-nothing, with a worker identity you control. No saga pattern, no compensating transactions.

Three integration modes, one auth model

REST snapshots, Server-Sent Events streams, and signed webhooks. Same OAuth 2.1 Bearer token across all three. No separate push service to run.

Producer authentication

OAuth 2.1 for devices, partner backends, and user-facing apps. Scoped, revocable, no shared secrets to manage.

Durable event storage

Every event you send is kept and replayable. Backed by managed PostgreSQL. No database to provision, no retention surprises.

How it works

Producers, log, views, functions, consumers.

Five primitives, one auth model.

01

Producers append

A device, webhook handler, or backend service authenticates with an OAuth 2.1 token and POSTs an event.

02

The log holds the truth

Events go into durable storage on PostgreSQL. The log is the system of record.

03

Views materialize state

A JSONata key and reducer turn events into a live per-entity table — updated as new events arrive. Point-lookup reads, prefix scans, and SSE change streams. No SQL to write.

04

Functions compose operations

Register a JSONata body at a URL. Every $iotman_call inside runs in one Postgres transaction as a worker identity. Triggers fire functions automatically when matching events arrive.

05

Consumers read in whatever shape fits

REST for snapshot reads, SSE for live subscriptions, signed webhooks for push delivery on matches. Same OAuth 2.1 Bearer token across all three.

Design choices

Why it's shaped this way.

Events, not state

Most backends overwrite — so you lose answers to questions you haven't thought of yet. IoTMan keeps every event. When a new question comes, build a new projection over the same log. No migrations, no new tables.

Declarative reads and writes

You describe the view you want; IoTMan maintains it. New events arrive, the view updates — no refresh jobs, no cache warming, no cron. JSONPath for reshaping, JSONata for views and functions.

Authentication at the edge

Every producer — device, webhook source, partner backend — authenticates before its first byte hits the log. OAuth 2.1: scoped, revocable, and a shape developers already know. No API keys to rotate.

A scarce toolset, by design

Six things to learn: HTTP, SSE, OAuth 2.1, signed webhooks, JSONPath, JSONata. No ORM, no query builder, no message broker protocol. That's the surface.

Where it fits

Apps that are events in, views out.

Six common shapes; the primitives are the same.

A customer event timeline

POST /events/customers — every sign-up, login, feature use, support ticket, cancellation. The lifecycle view, the segmentation, the cohort analysis: all projections over the same log.

A live status surface

An order tracker, a delivery progress page, a race leaderboard, a build pipeline UI. Anywhere a user wants to watch state change in real time. Producers append events; consumers subscribe to a view over SSE; the page updates because the view does.

Sensor telemetry

The original use case, served by the same primitives. Devices POST JSON to /events/:device; the log keeps it; views shape it for whoever reads. That's it.

A webhook inbox

POST /events/inbox — one endpoint catches every Stripe, GitHub, and Shopify webhook. Keeps the raw payload, lets you build the dashboard each tool should ship with.

A public-data canvas

Wrap a public API (earthquakes, marine traffic, flights, weather) in a small fetcher. The fetcher becomes a producer; the log becomes yours; the projections are anyone's to write.

An audit-first internal tool

Feature flags, config changes, admin actions — every mutation is an event. The log is the audit trail. Replay gives time-travel. POST /events/admin and the trail writes itself.

First event in 2 minutes.

Free tier, no credit card.