A: 1. Can native Android/iOS apps communicate directly with NoCodeBackend using authenticated user tokens + RLS without embedding any master/private API key in the app?

Yes, absolutely.
Native iOS (Swift), Android (Kotlin), React Native, and Flutter apps communicate directly with NoCodeBackend via standard REST endpoints.
When a user logs in, the app receives an authenticated session token / JWT. The mobile app passes this token in the standard Authorization: Bearer <token> header.
NoCodeBackend validates the session and enforces Row-Level Security (RLS) automatically, ensuring users can only access their own data without embedding any master/secret key in the mobile binary.

2. Is a master/secret key ever required in client-side web or mobile code?

No, never.
Master/secret API keys are strictly intended for secure backend / server-to-server environments (e.g., backend servers, Next.js server actions, cron jobs).
Client-side web and mobile apps authenticate exclusively via end-user session tokens and RLS.

3. Can RLS enforce record.user_id = authenticated user so manually changing an API request cannot expose another user's records?

Yes, 100%.
Under default RLS mode (Private tables), NoCodeBackend automatically enforces ownership filtering on the backend (WHERE user_id = authenticated_session_user).
Even if an end-user inspects network traffic and manually alters IDs, query parameters, or payload bodies, the server-side security policy strictly rejects unauthorized access to other users' records.

4. Can RLS also securely isolate organizations/teams for multi-tenant SaaS?

Yes, in two ways:
Team / Org Column Scoping: You can model org_id / team_id relationships and enforce team boundaries using Pre-Hooks or custom policies.
Dedicated Database per Tenant (Physical Isolation): Since your NoCodeBackend plan includes multiple databases (up to 250 databases on Tier 5), you can provision completely separate databases for individual enterprise clients/tenants for physical data isolation.

5. Is Sign in with Apple supported?

No, Sign in with Apple is currently not supported.
The platform currently supports:
Email & Password
Email OTP (passwordless)
Google OAuth

6. Can MCP access be restricted by database/permissions or made read-only for production?

Clarification on MCP: The MCP (Model Context Protocol) server is specifically a developer tool designed for the account owner to connect their NoCodeBackend project to AI coding tools (such as Cursor, VS Code, or Claude) using a personal Developer Token. It enables developers to prompt AI in natural language to build, inspect, and manage databases during development.

7. Can NoCodeBackend safely handle thousands or tens of thousands of simultaneously active/authenticated users? Are there concurrency limits?

Yes, built for production scale.
Architecture: The REST API layer runs on asynchronous, non-blocking microservices backed by Oracle cloud infrastructure and intelligent connection pooling on high-performance relational database engines.
No Concurrency Penalties: There are no artificial caps on how many active users can be logged in or making requests simultaneously. It is designed to handle high-concurrency production workloads smoothly.