Can Bolt.new build a backend?

01What Bolt's backend includes

According to Bolt's Bolt Cloud documentation, a project can get:

• Hosting on a free bolt.host address, with custom domains on paid plans.
• A database, created automatically when your app needs one, with no limit on how many.
• Authentication: sign-up, login, email confirmation, password reset and Google sign-in.
• File storage, public and private, for images, documents and user uploads.
• Server functions for code that should not run in the browser, such as permission checks and payment processing.
• Stripe payments for one-time purchases and subscriptions.

02Bolt Database or Supabase?

Bolt offers two backend paths. Bolt Database is built in and is the default for projects created with Claude Agent after September 30, 2025. Supabase is an external backend you connect from your settings, giving you a database, auth and edge functions in your own Supabase account, per Bolt's Supabase integration docs.

Two constraints matter. Supabase connections work with Vite projects but not Next.js projects, and Bolt does not support moving an existing project from Supabase to Bolt Database. Choose at the start.

03What Bolt's backend handles well

For typical app shapes (users sign up, save things, see their own data, maybe pay), Bolt gets you a working backend in minutes rather than days. That is a big deal for prototypes and for validating whether people will pay before you invest in engineering.

Server functions are the piece people overlook. Anything involving secrets, such as API keys or payment logic, should live there rather than in browser code, and Bolt's docs describe storing secrets in a Secrets section and referencing them from functions.

04What to check before real users arrive

A backend that works for you can still be open to everyone. The best-known case is Lovable rather than Bolt: in 2025, Semafor reported that many Lovable apps exposed user data because Supabase row-level security rules were missing. The same class of mistake is possible in any AI-built backend.

1. 1Test with two accountsLog in as one user and try to see or edit the other's data. If you can, access rules are missing.
2. 2Find every secretAsk Bolt to list where API keys are used and confirm none are in browser code.
3. 3Test payments end to endUse Stripe's test mode for purchase, refund and cancellation before going live.
4. 4Check what the AI changedBefore launch, review recent changes to auth and payments; agents sometimes edit code you did not ask about.
5. 5Back up your dataKnow how to export your database before you depend on it.

05When to outgrow Bolt's backend

Bolt's backend is a good fit for prototypes, internal tools and early products. Signs you are outgrowing it: you need complex background jobs, strict compliance requirements, fine-grained control over database performance, or a team of developers working on the code at once. At that point, keeping the code in GitHub and the data in a portable database makes the move much easier.

If you are still deciding on a tool, is Bolt.new worth it? covers cost, and Lovable vs Bolt compares the two most similar options. If what you need is a website with a contact form rather than an app, you do not need a database at all; how to add a contact form to a static website shows simpler options.