A secure, role-based articles API with a polished client
Buildly is a small end-to-end demo of token authentication done properly: a Django REST Framework backend with JWT access and refresh tokens, group-based permissions, and a Next.js single-page client that talks to it across origins.
JWT authentication
Email + password login issues short-lived access tokens and a refresh token, with silent refresh on the client.
Role-based access
Two roles — viewer (read-only) and editor (read + write) — enforced server-side on every request, not just hidden in the UI.
Deployed as code
Next.js on Vercel, Django on Render, Postgres on Neon, DNS on Cloudflare — the whole stack provisioned with Pulumi.
Try it with a demo account
Sign in at the login page with either seeded account (shared password demo-pass-12345):
- editor@example.com — read + write
- viewer@example.com — read only