Quickstart

Install Keel, create a table with a security policy, and read and write it from JavaScript. You need a machine with Docker and about ten minutes. At the end you have a running server, Studio open in your browser, and an app talking to your own API.

What you need

• A computer that can run Docker: a Linux server or PC, a NAS, a Mac, or a Windows 10 or 11 PC. A 64-bit OS with 2 GB of free memory is enough to start; see Requirements.
• Free ports 8000 (API), 3000 (Studio) and 5432 (Postgres).
• Node.js on the computer where you try the example app in step 6.

1. Get Docker ready

Your machine	Docker to use	Check
Linux server or PC	Docker Engine with the Compose plugin (install guide)	docker compose version prints v2 or newer
macOS	OrbStack, Docker Desktop or Colima (which one)	docker compose version in Terminal
Windows 10 or 11	Docker Desktop with its default WSL 2 engine (before you start)	Docker Desktop says Engine running
ZimaOS, CasaOS, Unraid, TrueNAS SCALE, Synology	Already built in (on Synology, install Container Manager)	Open a terminal or SSH session on the NAS

2. Install Keel

Run the installer for your system. It sets Keel up in one folder, writes a .env file with random passwords, starts every service and prints your Studio login.

Linux and NAS

curl -fsSL https://www.keeldb.name/install.sh | sudo bash

macOS

# Run as yourself, without sudo.
curl -fsSL https://www.keeldb.name/install.sh | bash

Windows (PowerShell)

# No admin rights, WSL terminal or Git Bash needed.
irm https://www.keeldb.name/install.ps1 | iex

Download, check, then run

To see what you run first, download the installer and its SHA-256 checksum, check it, read it, then run it:

curl -fsSLO https://www.keeldb.name/install.sh
curl -fsSLO https://www.keeldb.name/install.sh.sha256
sha256sum -c install.sh.sha256      # macOS: shasum -a 256 -c install.sh.sha256
less install.sh
sudo bash install.sh

On Windows, see Check the installer first. Each release on GitHub has its own installer, which installs exactly that version, with the same checksum file and a build attestation (gh attestation verify install.sh --repo niklan1110/keel). Its address names the version: https://github.com/niklan1110/keel/releases/download/v<version>/install.sh.

The installer picks the right folder for your system: /opt/keel on Linux (~/keel without sudo), ~/keel on a Mac, %USERPROFILE%keel on Windows, and the app data folder on a NAS (see Choose a platform). On a NAS it opens Studio to your network; on a cloud server, a Mac or Windows it keeps Studio on the machine itself; elsewhere it asks. When it finishes, it prints something like:

Keel is running.

  Studio (dashboard):  http://192.168.1.20:3000
  Sign in:             admin / <generated password>
  API for your apps:   http://192.168.1.20:8000/my-app
  Settings:            /opt/keel/.env   (passwords; keep a copy somewhere safe)
  Data:                /opt/keel/{db,db-tls,storage,backups,functions,tunnel}

The first run downloads the images, which takes a few minutes. Keep a copy of .env in your password manager: it holds the passwords you need to restore a backup.

The installer uses this machine's IP address in the API URL, so phones and laptops on your network can reach Keel. That address is stored as KEEL_PUBLIC_URL and appears in emails and links (see Configuration). To use another address, such as a hostname, pass --host: curl -fsSL https://www.keeldb.name/install.sh | sudo bash -s -- --host myserver.local. Linux (Docker Compose) lists every option, and each platform guide covers its details: Windows, macOS, ZimaOS, Unraid, TrueNAS SCALE, Synology.

Check that all services are up, in the install folder:

Linux, macOS and NAS

cd /opt/keel          # or ~/keel, or your NAS folder
sudo ./keel ps        # without sudo if you installed without it

Windows

cd $HOMEkeel
.keel ps

After a minute or two, every service should be running or healthy. If one keeps restarting, see Troubleshooting.

3. Open Studio

Open the Studio address the installer printed (on the server itself, http://localhost:3000 always works; from other devices only if Studio is open to your network) and sign in as admin with the password it printed. The password is also in the install folder's .env file as KEEL_DASHBOARD_PASSWORD.

A first project called my-app already exists. Studio shows the project's tables on a canvas, with the stack's services and backups in the side panel and the tools (SQL, Users, Storage, Functions, Jobs, Logs) in the dock at the bottom.

4. Create a table

Open the SQL editor in the dock at the bottom and run:

create table todos (
  id bigint generated always as identity primary key,
  task text not null,
  done boolean not null default false,
  user_id uuid references auth.users default auth.uid(),
  created_at timestamptz not null default now()
);

-- Signed-in users see and change only their own todos.
create policy "own todos" on todos for all to authenticated
  using (user_id = auth.uid())
  with check (user_id = auth.uid());

Keel turns on row level security for every new table, so the table is private until a policy allows access. The policy above lets each signed-in user work with their own rows.

5. Get your API URL and key

Click Connect in Studio's header. Copy:

• API URL: your server's address plus the project name, such as http://192.168.1.20:8000/my-app
• anon key: a long token starting with eyJ. It's safe to put in browser and mobile apps.

6. Use it from your app

Install the Supabase JavaScript client (Keel speaks the same APIs):

npm install @supabase/supabase-js

import { createClient } from '@supabase/supabase-js'

const keel = createClient('http://localhost:8000/my-app', 'YOUR_ANON_KEY')

// Create an account. Without an email server, new accounts are confirmed right away.
await keel.auth.signUp({ email: 'ada@example.com', password: 'a-long-password' })

// Add and read todos. Row level security limits this to the signed-in user.
await keel.from('todos').insert({ task: 'Try Keel' })
const { data, error } = await keel.from('todos').select('*').order('created_at')
console.log(data)

Replace the URL with your API URL (localhost works only when the code runs on the Keel server) and YOUR_ANON_KEY with the anon key. Run it with node (save it as app.mjs) or put it in your web app. Back in Studio, the new user shows up under Users, and clicking the todos table on the canvas shows the new row.

You can do the same without a client library, from any language:

curl 'http://localhost:8000/my-app/rest/v1/todos?select=*' \
  -H "apikey: YOUR_ANON_KEY" \
  -H "Authorization: Bearer USER_ACCESS_TOKEN"

7. Before you rely on it

A few minutes now saves a bad day later:

1. Secure Studio. In Studio, open Account and security from the project switcher, change the generated password and turn on two-factor authentication. See Accounts and sign-in.
2. Turn on full backups. Set KEEL_BACKUP_PASSPHRASE in .env, run ./keel up (.\keel up on Windows), and add an S3-compatible bucket in Studio's Backups. Keel then keeps an encrypted copy of everything off the machine. See Backups and restore.
3. Read the security checklist before you open Keel to the internet: Security.

Next steps

Core conceptsProjects, the two API keys, user tokens and row level security.Connect your appClient libraries for JavaScript, Flutter, Swift, Kotlin and Python.QueryingFilters, joins, pagination, inserts and upserts.AuthEvery way your users can sign in.Internet access and HTTPSUse Keel away from home and from HTTPS sites.Coming from SupabaseMove an existing project and its users over.