Lovable expects a backend it can reach, and an on-prem SQL Server is not one. Instead of exposing the database or handing Lovable its credentials, DreamFactory generates a REST API in front of it with a read-only role and a scoped API key, and Lovable's server-side code calls that API to build a live delivery operations dashboard.
What you’ll learn
- Giving Lovable a reachable backend without exposing the database
- Generating the REST API and scoping it to a read-only role
- Calling the API from Lovable's server-side code, not the client
- Keeping the database credential out of the generated application
Frequently asked questions
Can Lovable use an existing on-premise database?
Yes, but not by connecting to it directly — Lovable cannot reach into your network. The approach in this video gives Lovable a governed REST API in front of the existing SQL Server, so you keep the database you already have rather than migrating it.
Can Lovable connect to something other than its default backend?
Yes. Lovable's server-side code can call any HTTPS API, which is how it consumes the DreamFactory endpoint here. That is what lets a Lovable app read from an existing enterprise database rather than a new one.
Where does the API key live in a Lovable app?
Server-side, which is why the call is made from server-side code rather than the browser. The key is also scoped to a read-only role, so even if it were exposed it could not be used to write or to reach tables outside that role.
