How it works
With a BaaS the app talks to the platform directly: the SDK signs the user in, reads and writes data and uploads files, and the platform enforces who may do what through security rules or database policies. Logic that must stay secret, such as charging a card with a private key, runs in the platform's serverless functions.
Firebase popularised the idea for mobile apps; Supabase, Appwrite and PocketBase are open-source alternatives. The appeal is speed and no servers to maintain. The costs are lock-in to the platform's APIs, bills that follow usage, and security that depends entirely on writing the rules correctly, because every client holds a public key.