Xata Workers: client-side database access without client-side secrets

In the last few years, there's been a rise of Jamstack and serverless/edge computing architectures. Instead of managing servers, apps are split into smaller, globally distributed services or functions—improving both developer and user experiences: no server maintenance, and lower latency even at scale.

Databases remain challenging: replication, failover, horizontal scale—all require infrastructure and expertise. At Xata, our modern data platform abstracts that, letting developers focus on logic instead of data plumbing.

Making databases accessible to everyone

Xata’s mission: let developers build without managing infra. We built an intuitive web dashboard so anyone—frontend dev or designer—can work with data: schema design, record viewing, boosters for search, and ready-to-used SDK snippets.

The challenge: frontend devs often want to directly call databases from client-side. That means exposing credentials, risking broader access and leaks. Two options:

1. Row-level access rules—adds complexity and vendor lock-in.
2. Serverless functions as a middle layer.

We chose serverless for flexibility and security. Thus, Xata Workers was born.

Xata Workers

A Xata Worker is a serverless function defined in JS/TS but run on Cloudflare's edge. Think Next.js getServerSideProps or Remix loader, framework-agnostic and portable to platforms like GitHub Pages or S3. The CLI handles build and deployment:

import { useQuery } from '@tanstack/react-query'
import { xataWorker } from '~/xata'

const listProducts = xataWorker('listProducts', async ({ xata }) => {
  return await xata.db.products.sort('popularity', 'desc').getMany()
})

export const Home = () => {
  const { data = [] } = useQuery(['products'], listProducts)
  return (
    <Grid>
      {data.map((product) => (
        <ProductCard key={product.id} product={product} />
      ))}
    </Grid>
  )
}

These run securely on Cloudflare’s global network—no client secrets leaked. TypeScript types are auto-generated for schemas at build time, enhancing DX and IDE support.

Workers can handle context, headers, full custom responses, and even unit-tested easily—without opinionated row-level rules.

How we use Cloudflare

We're part of the “Supercloud” movement: Xata Workers rely on Cloudflare Workers for Platforms. Each Xata workspace maps to a Worker Namespace, then deployment creates versioned Worker scripts with injected DB credentials—isolating scopes and hiding secrets.

An edge-level dispatcher handles routing, CORS headers, and logs. We also leverage Cloudflare caching: read-only queries can be cached globally, reducing DB loads. For local dev, miniflare emulates the runtime with hot reload.

Conclusion

Xata is out of beta and offers a generous free tier. You can spin up databases in seconds, with features like branching, search, analytics, transactions, and more. Xata Workers are currently in private beta—join the waitlist if interested.

We're proud of this partnership with Cloudflare. Edge-first DB compute—processing data close to users—is the future. We can’t wait to see what you build with Xata Workers.