TL;DR
Convex is a reactive backend: TypeScript functions run next to its own database, and every client stays in sync over a WebSocket. If your agent is building a web app for a known group of people, in whatever stack it picks, floo is the alternative: it hosts the whole app with Postgres, storage, Redis, and schedules from one floo.app.toml, and signs people in at the gateway.
- Authorization: any client can call a Convex public function, so each one checks
ctx.authitself. floo's gateway admits only invited people before any request reaches your code. - Hosting: Convex deploys the backend; its docs send the web app to Vercel, Netlify, or a static host. floo runs the web app, API, workers, and cron jobs together.
- Stack: Convex functions are JavaScript or TypeScript on Convex's runtime. floo builds any service from a Dockerfile and gives it standard Postgres.
- Where Convex leads: reactive queries, transactions, transactional scheduling, search, and native realtime clients.
Facts about Convex come from its own documentation and website, read on November 3, 2026. Sources are listed at the end.
How do they compare?
| Convex | floo | |
|---|---|---|
| Web app hosting | Vercel, Netlify, or any static host; a Static Hosting component serves static builds | Any service with a Dockerfile, deployed from GitHub on every push |
| Backend code | Queries, mutations, and actions in JavaScript or TypeScript | Your own services and workers in any language |
| Database | Convex's document-relational database, through functions | Managed Postgres, DATABASE_URL injected |
| Authorization | Checked inside each public function with ctx.auth | Gateway sign-in for the whole app; your code handles record-level rules |
| Sign-in | Convex Auth (beta), Clerk, Auth0, WorkOS, or any OIDC provider | access_mode = "accounts": invite-only sign-in, no auth code |
| Agent credential for the app | Not described; HTTP calls carry a token from your auth provider | Key per named consumer, scoped to declared routes, rate-limited, with request history |
| Scheduled work | crons.ts and the scheduler, inside Convex | [cron.<name>] runs a command in your app's container |
| Previews | Preview deployments (beta) with their own data, created from your frontend host's build | Pull request previews with their own URL, managed resources, and Postgres branch |
Where does authorization live?
Convex keeps the database behind code, which is the right instinct. Clients never send queries; they call your functions over a WebSocket, and queries re-run and push new results when the data changes. But a public function can be called by any client, so Convex's docs say each public query, mutation, and action should check that the caller is signed in and allowed to do what it asks. The examples call ctx.auth.getUserIdentity() in every handler. Row-level security exists as a library pattern in convex-helpers, and its tables are open by default unless you set a deny policy.
So the safety of a Convex app is the sum of every function's check. When your agent adds a function and forgets the check, that function is open.
floo moves the first check out of your code. With access_mode = "accounts", the gateway redirects anyone who is not an invited member before the request reaches any route, and passes the signed-in person to your code in X-Floo-User-Email. Your code still decides which records each person may see, as in any server app, but a missing check exposes data to your team, not to the internet.
What can the app be written in?
Convex backend functions are JavaScript or TypeScript. Queries and mutations run on Convex's own runtime, must be deterministic, and have a one-second execution limit; actions can use Node.js. Python and Rust are client libraries for calling those functions. The data lives in Convex's database, and its docs do not describe SQL or Postgres client access.
floo builds every service from a Dockerfile in your repository, with guides for Next.js, Rails, Django, FastAPI, and Express. The database is Postgres, so your agent can use the ORM and migration tool it already knows, with a migrate_command that runs before traffic moves to a new deploy. See Postgres.
How does an agent get access?
Convex's agent tooling is strong. Its MCP server reads tables, runs functions, and reads logs, and keeps production access behind opt-in flags. Agent mode gives each agent its own dev deployment with a deploy key scoped to it, so an agent cannot touch prod. npx convex ai-files maintains guideline files for your agent.
Those credentials operate Convex. For an agent that uses the finished app, Convex's HTTP API calls public functions with an optional bearer token from your auth provider, and a Rate Limiter component lets you add limits in your own mutations. Its docs do not describe a per-consumer key for your app's routes.
On floo, an agent operates the platform through the CLI, the HTTP API, or the hosted MCP server, and an agent that uses the app gets its own key:
floo apps consumers create order-agent
floo apps keys create order-agent --consumer order-agent --scope orders.write --rate-limit-rpm 60
The key works only on routes declared with that scope. floo strips it before your code sees the request, passes the consumer's identity instead, and lists every request by key ID. See app API keys.
What does the config look like?
A Convex project's shape is code in the convex/ directory: schema.ts, crons.ts, http.ts, and the functions. The frontend's host and its settings live elsewhere.
A floo app's shape is one file:
[app]
name = "orders"
access_mode = "accounts"
[services.web]
type = "web"
path = "."
port = 3000
ingress = "public"
[managed.default]
type = "postgres"
[managed.files]
type = "storage"
[cron.daily-report]
schedule = "0 6 * * *"
command = "node scripts/report.js"
service = "web"
[github]
preview_environments = true
Each push deploys to dev. Each pull request gets a preview with its own Postgres branch, so an agent's migration never touches dev or prod. See preview environments.
Where is Convex stronger?
- Reactivity. Queries update every subscribed client automatically, with optimistic updates and one consistent view of the database. floo proxies WebSocket requests to your app, but has no sync engine.
- Transactions and scheduling. Mutations are serializable and retried on conflict, scheduling from a mutation is transactional, and scheduled mutations run exactly once.
- Search. Built-in text search and vector search.
- Native clients. Realtime clients for Swift, Kotlin, and React Native. floo has no mobile SDKs.
- Self-hosting. The backend is fair source under FSL Apache 2.0, converting to Apache 2.0 after two years, and you can run it yourself. floo is a hosted service only.
- Public sign-up. Clerk, Auth0, WorkOS, or any OIDC provider. floo's app sign-in is invite-only, and SAML or OIDC for app users is not available yet.
Which should you choose?
Choose Convex when the app is live and collaborative, your team writes TypeScript, and you are happy to host the frontend elsewhere. Choose floo when your agent is building a web app for a known group of people, and some agents, in whatever stack suits the job, and you want the app, Postgres, sign-in, schedules, storage, and previews from one file in the repository.
See the backend for apps your agent builds, start from a template, or read where to host an app built with Claude Code.
Sources
- Convex: homepage, overview, AI, MCP server, agent mode, self-hosting, database, schemas, OCC, functions, runtimes, limits, React client, auth, auth in functions, Convex Auth, row-level security, HTTP API, HTTP actions, deploy key types, Rate Limiter, scheduled functions, cron jobs, file storage, hosting, custom hosting, Static Hosting, preview deployments, multiple deployments, Python client, Swift, Android, React Native, text search, vector search
- floo: how floo works, app sign-in, app API keys, Postgres, config spec, Redis, storage, cron jobs, preview environments, Dockerfiles, networking, MCP
Frequently asked questions
Is Convex a Postgres database?
No. Convex is its own document-relational database, read and written through TypeScript functions rather than SQL. Its docs do not describe connecting with SQL or a Postgres client. floo provides managed Postgres with a standard DATABASE_URL.
How does Convex handle authorization?
In code. Convex's docs say each public query, mutation, and action should check that the caller is signed in and allowed to act, using ctx.auth. Row-level security is available as a pattern in the convex-helpers library, not as a platform feature. On floo, the gateway admits only invited people before a request reaches any route.
Does Convex host the frontend?
Convex's hosting docs recommend Vercel or Netlify for the web app, or any static host, and its deploy command deploys only the backend. A Static Hosting component can serve a built static frontend from Convex. floo hosts the whole app, including server-rendered frameworks, from a Dockerfile.
Can my agent use Convex safely?
Convex has strong agent tooling: an MCP server that gates production access behind opt-in flags, an agent mode that gives each agent its own dev deployment and scoped deploy key, and AI guideline files. Those keys operate Convex itself. Its docs do not describe a key for an agent that calls your app's own routes; floo provides one per named consumer, with a rate limit and request log.
When is Convex the better choice?
When the app is built around live data: reactive queries that update every client, serializable transactions, transactional scheduling, built-in text and vector search, and native realtime clients for Swift, Kotlin, and React Native, all in TypeScript. floo has no realtime sync product or mobile SDKs.