# Replica Backend

Builds the backend of an app clone: auth, database migrations and access rules...

- Repository: https://github.com/Jakeschincariol/replica-skill (6967 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-03
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Jakeschincariol/replica-skill --skill replica-backend -g -a claude-code -y`
Codex: `npx skills add Jakeschincariol/replica-skill --skill replica-backend -g -a codex -y`
Cursor: `npx skills add Jakeschincariol/replica-skill --skill replica-backend -g -a cursor -y`
Gemini CLI: `npx skills add Jakeschincariol/replica-skill --skill replica-backend -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add Jakeschincariol/replica-skill`

## Description

Builds the backend of an app clone: auth, database migrations and access rules, payments with Stripe, email, background jobs and third-party integrations through official APIs only, plus a security checklist. Use when the user says "add login", "set up auth", "wire up the database", "add payments", "connect Stripe", "add Google Calendar", "send emails", "backend for my clone", or when /replica-build is running on fake data.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# replica-backend

Reads `replica/architecture.md`. Writes migrations and server code, and keeps
`replica/backend.md` (checklist below) up to date.

## The rules

- **Official, public APIs only, with the user's own keys.** Never call the
  original app's private endpoints, never reuse its OAuth client, never proxy
  through it.
- **The user creates accounts and keys.** Claude never signs up for services,
  never types a password, card or live key. The user creates the Stripe,
  Supabase, Resend or Google Cloud project and puts keys in `.env.local`.
  Claude writes `.env.example` with every variable name and no values.
- **Test mode first.** Stripe test keys and test cards until replica-deploy.

## Auth

- Email sign up with verification, password reset, magic link if the original
  has it. OAuth (Google, Apple) with the user's own developer apps.
- Sessions: http-only secure cookies. Sign out everywhere.
- Roles and teams if the recon map has them: owner, admin, member, with one
  function that answers "can this user do this to this record".
- Account deletion that actually deletes. Apple requires it for apps with
  sign up.

## Database

- Migrations from `architecture.md`, checked in, run by a script.
- Access rules on every table: row level security policies on Supabase, or
  the authorisation function called in every query. Test it: a second user
  must get nothing back.
- Seed script with realistic fake data (no real people).
- Backups on (the host's daily backups count, check they are enabled).

## Payments

The rest: https://github.com/Jakeschincariol/replica-skill/blob/HEAD/replica-backend/SKILL.md