---
title: Site backend
description: Isolated user, key-value, SQLite, and realtime APIs for every site.
order: 4
---

# Site backend

```js
import { scrapheap } from '/__page/lib.js'

const heap = scrapheap()
const user = await heap.user()
```

`scrapheap()` returns a `SiteBackend` with `user()`, `kv`, `db`, and `channel()`.

## Key-value

```js
await heap.kv.put('theme', { dark: true })
const theme = await heap.kv.get('theme')
const keys = await heap.kv.list({ prefix: 'theme' })
```

## SQLite

```js
await heap.db.exec('create table if not exists notes (body text)')
await heap.db.exec('insert into notes (body) values (?)', ['hello'])
const { rows } = await heap.db.exec('select body from notes')
```

## Realtime

```js
const channel = heap.channel('comments')
channel.subscribe((data, meta) => console.log(meta.from, data))
channel.presence((count) => console.log(count))
channel.publish({ body: 'hello' })
```

Public visitors may read key-value/SQLite data and subscribe. Writes and channel publishing are denied unless the owner explicitly enables public raw writes. Owners and invited authenticated users may write on private sites.

Every site's data lives in a site-specific SQLite Durable Object. Channel objects are keyed by site and channel name. RPC and WebSocket endpoints validate the exact site origin.