Skip to content

A tour of Dox features

This post is a short tour of the parts that come with Dox, from routing and validation to the ORM, login, queues, mail and the CLI.

Each item has one to three lines and a link to its docs page. Some parts are in the core package dox_core. Other parts are separate packages. You add only the ones you need.

Core

  • Routing: Routes for each HTTP method, route params, groups, resource routes and named routes. Signed routes and route model binding are included.
  • Middleware: Class or function middleware for one route, a group, a router or all routes. Request id, ETag and request timeout middleware come with it.
  • Request and response: Read input, headers, files and the client IP. Return a model, a map or a list, and Dox sends JSON. Files and big responses are streamed.
  • DTO validation: Write a @Dto class with rules on its fields. Dox checks the input and gives your controller a typed object. Bad input gets a 422 answer.
  • OpenAPI: dox_openapi makes OpenAPI 3.1 docs from your routes and DTOs. It also serves a docs page at /docs.
  • Sessions and CSRF: Sessions with a cookie or cache driver, and flash data. CSRF protection for forms.
  • Cookies: Set cookies on a response and read them from a request. Dox encrypts cookies with your APP_KEY.
  • Encryption and hashing: Crypt encrypts and decrypts text with the app key. Hash hashes and checks passwords. Hash.makeAsync and Hash.verifyAsync do not block the server.
  • Rate limiting: The RateLimit middleware stops a client that sends too many requests. With a Redis cache, all servers share the counts.
  • Security headers: The SecurityHeaders middleware sets safe default headers. You can change or turn off each header.
  • CORS: Allow one or more origins, and answer preflight requests.
  • Static files: Serve a folder or a storage disk with one line. You can also serve a single page app.
  • Health checks: A health route for a load balancer, Docker or Kubernetes. It can check the database and the cache.
  • IoC container: Add @Inject() to a class, and Dox makes it and its parameters for you. The container is generated code. It does not use reflection.
  • Providers: A provider sets up a package or a service when the app starts, and cleans up when it stops.
  • Exception handler: Every error goes to one handler. It logs the error and decides what the client gets.
  • Logging: The Logger prints colored text in development, or one JSON object per line for a log service.

Data

  • ORM models: A model is a class for one table. Save, find, delete, hide fields and mass assignment rules are included.
  • Relations: Has one, has many, belongs to, many to many and polymorphic relations. You can query and count relations too.
  • Scopes and casts: A scope is a query part you use again and again. A cast changes a column value between the database and Dart, like JSON or an enum.
  • Factories and seeders: A factory makes models with sample data for tests. A seeder puts data in your database.
  • Migrations: Write the schema in Dart, then run, roll back or check migrations with the CLI.
  • Query builder and transactions: Build SQL from chained methods with bound values. Run many queries in one transaction.
  • Databases: Postgres, MySQL, MariaDB and SQLite. Postgres and MySQL use native drivers.

Auth

  • Guards: Use more than one guard in one app, or write your own, like an API key guard.
  • JWT: dox_auth logs users in with JWT tokens. Tokens can be revoked.
  • Session login: Log users in with a session cookie for web pages.
  • Access tokens: Tokens saved in the database, with abilities. You can revoke them one by one.
  • Gates and policies: A gate checks one action. A policy groups the checks for one model. Use them in a controller or on a route.

Packages

  • Cache: dox_cache comes with dox_core, so there is nothing to add. It has memory, file and Redis stores, with tags and locks.
  • Queue: dox_queue runs slow work in the background. It has Redis, database and sync drivers, retries, delays and a worker.
  • Scheduler: dox_scheduler runs tasks on a schedule, like cron. You write the schedule in Dart.
  • Mail and notifications: dox_mailer sends email with SMTP, Amazon SES, Resend, Mailgun, Postmark and more. A notification can go out on more than one channel.
  • Storage: dox_storage gives one API for local disk, AWS S3 and S3-compatible services, with signed URLs.
  • Socket.IO: dox_socketio is a Socket.IO v4 server. The official clients connect with no changes.
  • Views: dox_view is an HTML template engine. Templates are .dox.html files.
  • Inertia: dox_inertia lets you build a single page app with React, Vue or Svelte, with routes and controllers in Dox.
  • MCP: dox_mcp serves tools to MCP clients from a normal Dox route. Tool arguments are checked before your code runs.
  • Redis: Redis is not a separate package to install. It is a driver in the cache, the queue and the Socket.IO adapter. These packages bring their own Redis client. Use Redis when you run more than one server.

Tooling

  • CLI generators: dox make:controller, make:model, make:dto, make:middleware, make:migration, make:factory, make:seeder, make:job and more.
  • Testing helpers: DoxTestClient runs the app inside a test. It can keep a session and log in as a user.
  • dox build: Builds the app into one native binary. It does not need the Dart SDK.
  • Docker: The project has a Dockerfile and a compose file. The image holds only the binary and the files it needs.
  • App template: dox create starts from this template. It has an AGENTS.md file and a skill with step-by-step recipes for AI coding tools.

Get started

Install the CLI and make your first project: Installation.