# TeamOnly docs

> Canonical: https://teamonly.dev/docs

The CLI, the SDK your app uses, and the skill file that teaches your AI what to write. Technical, and short.

**Preview:** TeamOnly is not open yet. These docs describe the planned CLI and SDK so you can see what building on it looks like. Names and details may change before launch.

## Quick start

You need Node.js 20 or newer and a TeamOnly account. From your project folder:

```
$ npx teamonly init
✔ Added the TeamOnly skill, Cursor rules and SDK
> Build an expense approval tool
(your AI builds the app)
$ npx teamonly deploy
✔ Live at https://expenses.acme.teamonly.app
  Only @acme.com accounts can sign in
```

The first deploy signs you in, creates the app, its database and its file storage. Later deploys update the same app at the same address.

## CLI commands

| Command | What it does |
|---|---|
| `npx teamonly login` | Sign in to TeamOnly from this computer. Opens a browser. |
| `npx teamonly init` | Add the skill file (Claude Code), rules file (Cursor) and SDK to the current project. |
| `npx teamonly deploy` | Build the app and put it online. Creates the database and file storage on the first deploy. Prints the app's address. |
| `npx teamonly logs` | Stream the app's live logs, including errors. |
| `npx teamonly secrets set NAME` | Store a secret for this app. You are prompted for the value, so it never lands in your shell history. |

## SDK

Your API is a [Hono](https://hono.dev) app. The SDK gives each request a context with four things:

- `ctx.user`: the signed-in person, `email` and `name`. Verified by TeamOnly before your code runs. Never read identity from headers yourself.
- `ctx.db`: this app's own SQL database (SQLite, on Cloudflare D1). Created on first deploy.
- `ctx.files`: this app's file storage: `put`, `get`, `list`, `delete`.
- `ctx.secrets`: values set with `npx teamonly secrets set`. Read with `ctx.secrets.get(name)`.

```ts
// api/index.ts (example)
import { Hono } from 'hono'
import { teamonly } from 'teamonly/sdk'

const app = new Hono()

// Who is signed in. Verified before your code runs.
app.get('/api/me', (c) => {
  const ctx = teamonly(c)
  return c.json(ctx.user) // { email: 'dana@acme.com', name: 'Dana Okafor' }
})

// Save to this app's own database.
app.post('/api/expenses', async (c) => {
  const ctx = teamonly(c)
  const { amount, reason } = await c.req.json()
  await ctx.db
    .prepare('INSERT INTO expenses (amount, reason, submitted_by) VALUES (?, ?, ?)')
    .bind(amount, reason, ctx.user.email)
    .run()
  return c.json({ ok: true })
})

// Store an uploaded receipt in this app's file storage.
app.put('/api/receipts/:id', async (c) => {
  const ctx = teamonly(c)
  await ctx.files.put(`receipts/${c.req.param('id')}`, c.req.raw.body)
  return c.json({ ok: true })
})

// Read a secret set with: npx teamonly secrets set QUICKBOOKS_KEY
app.get('/api/sync', async (c) => {
  const key = teamonly(c).secrets.get('QUICKBOOKS_KEY')
  // ...
})

export default app
```

## The skill file

`init` adds a skill file for Claude Code and the same content as a rules file for Cursor. Your AI tool reads it before writing code. It teaches:

- The one supported app shape (below), and to stay inside it.
- To use `ctx.user` for identity and never write its own login, sign-up or password screens.
- To use `ctx.db` and `ctx.files` instead of adding a database service, Express, Supabase or Firebase.
- To keep API keys in `ctx.secrets`, never in code.
- How to run `deploy`, read `logs` and fix what they show.

The point is that the first deploy works. If your AI keeps reaching for something we don't run, tell us; that is a bug in the skill file.

## Supported app shape

- **Front end:** React, built with Vite, served as static files.
- **API:** a Hono app in TypeScript or JavaScript, under `/api`, on the same address.
- **Runtime:** Cloudflare Workers. Standard web APIs; most Node built-ins through compatibility, but no native modules or long-running processes.
- **Not supported yet:** Python, Ruby, PHP, Docker containers, background jobs, scheduled tasks, sending email, custom domains, public apps.

## Limits

Final limits will be published here before launch. Today's plan:

- Builder: 1 builder, 3 apps. Team: unlimited builders and apps.
- Each app's database and file storage follow Cloudflare D1 and R2 limits.
- Requests run under Cloudflare Workers limits for CPU time and memory.

More on how it all fits together: [How it works](https://teamonly.dev/how-it-works) and [Security](https://teamonly.dev/security).

Join the waitlist: https://teamonly.dev/waitlist