We're Open-Sourcing All of 23blocks

Starting today, every 23blocks backend block — auth, CRM, files, forms, products, search, and the rest, 20+ of them — is open source.

Not a "community edition." Not a stripped-down version with the good parts held back. The same code that runs our shared platform, the same code a graduating customer forks and deploys on their own infrastructure. All of it, public, today.

Why

We built 23blocks because backend work is repetitive. Every product needs auth, needs file storage, needs some kind of CRM, needs forms. We got tired of building it from scratch, so we built it once, well, and reused it — first for ourselves, then for customers.

Somewhere in that process we had to decide what we were actually selling. For a while the honest answer was "the code," and that's a bad business to be in if you're small. Code copies for free. A well-funded competitor, or frankly a good engineering team with three weeks to spare, can replicate a backend module. What they can't replicate overnight is the part we've actually spent years on: keeping 20+ services patched, monitored, backed up, and running at 2am when something breaks that isn't your problem to fix.

So we stopped pretending the code was the moat. It isn't. Running it well is.

Once we admitted that, open-sourcing the blocks stopped being a risk and started being obvious. It's a better trust signal than any sales page: you can read the auth block's token-issuance logic before you decide whether to trust it with your users' sessions. You can see exactly what a webhook payload looks like before you build against it. You can fork it and never talk to us again if that's what you need. We'd rather earn the business that follows from that than protect a moat that was never as solid as it looked.

There's a practical reason too. We're a small team. We cannot out-market or out-hire the platforms with venture-scale marketing budgets. What we can do is be the most honest, most inspectable option in the category, and let the code speak for itself.

What's actually released

All 20+ blocks, under the Apache License 2.0, in public repositories:

• Auth — sessions, tokens, SSO, permissions
• CRM — contacts, pipelines, activity tracking
• Files — storage, access control, delegated uploads
• Forms — schemas, surveys, appointments, public forms, subscriptions
• Content — posts, categories, comments, series
• Products — catalog, search, visual/object-detection search
• Search, Companies, Onboarding, Rewards, Sales, Wallets, Geolocation, University, Real-time/conversations, Jarvis (AI/agents), and the rest of the catalog.

Every block follows the same environment-variable contract we've always built to: no hardcoded hosts, no baked-in secrets, health-check endpoints, the works. That's not new — it's what already lets customers graduate off our shared platform onto their own infrastructure without a rewrite (more on that in our companion post on graduating to your own infrastructure). Open-sourcing the code is really just extending a portability guarantee we already honored in practice to something you can now git clone and verify yourself, before you've ever signed up for anything.

We're publishing real READMEs, not placeholder ones — how to run each block locally, what its environment variables mean, what its API surface looks like. We know from experience that an open-source repo nobody can actually run is worse than no repo at all.

What stays paid — and why that's the honest model

Open source doesn't mean we've decided to work for free, and it doesn't mean we think you should have to run this yourself if you don't want to. Three ways to use 23blocks, and only two of them cost money:

1. Shared Platform (SaaS). Free tier to start, pay-as-you-grow after. We run the infrastructure, patch it, monitor it, back it up, and answer the pager. You get an API key and you're building in minutes. This is where most people should start.

2. 23blocks in a Box. We deploy and maintain the same blocks on your cloud account — your AWS, your GCP, your Azure. You get dedicated infrastructure, your own compliance boundary, your own data residency, and we still carry the operational weight. This is what "graduating" looks like for a lot of customers: same platform, your infra, us still on call.

3. Deployment recipes. If you want to run it entirely yourself — no relationship with us at all — the recipes and docs are there. Docker Compose, Kubernetes/Helm, Terraform, whatever your stack looks like. This is the true "just take the code" path, and now it's fully available, not gated behind a sales call.

The through-line: you never pay for the software. You pay for running it — either because we run it for you (options 1 and 2), or you don't pay us at all and run it yourself (option 3). That's the whole business model, said plainly, because we'd rather you understand it than have to trust a euphemism.

We call this open-core, and we know the term gets used to describe a lot of bait-and-switch. Ours works differently: there is no artificial feature gate in the open-source code. Nothing is crippled to force you onto a paid tier. What you pay for is genuinely operational — infrastructure, monitoring, on-call, upgrades — the stuff that's real work regardless of who's doing it.

What this means if you're already a customer

Nothing breaks. Nothing changes about your bill, your API keys, your uptime, or your support channel. If you're on the shared platform today, you're still on the shared platform today, still talking to the same team, still getting the same SLA.

What does change: you now have the option to look at exactly what's running under you, and — if you ever want to — to graduate to your own infrastructure with the code already public and forkable, rather than waiting on us to hand you an export. We've done this migration for real customers already; one reference case moved 11 blocks across 4 consumer surfaces in a single reversible maintenance window with zero code changes. We wrote up what that actually involved, sequences and JWT issuers and all, because we think the honest version of that story is more convincing than a marketing page would be.

If you're on 23blocks in a Box already, this doesn't change your contract either — you're already running dedicated infrastructure we maintain. The code you're running was always yours to fork; now the rest of the world can see it too.

How to start

• Just want to build? Sign up for the Shared Platform — free tier, API key in minutes.
• Want dedicated infrastructure, still maintained by us? Ask about 23blocks in a Box.
• Want to run it yourself, no relationship required? The repos and deployment recipes are public, starting today.
• Curious what's actually in the box? Browse the block documentation — it's the same docs our own team uses.

We think this is a better business than the one we'd have if we kept the code closed. We also think it's a more honest one. If you build something with these blocks, or find something worth fixing, we'd like to hear about it — join the Slack community or open an issue on any repo.

— Juan Peláez, Founder & CTO