Why Claude Code isn't built for apps with real users (and what actually works)

Type "build me a client portal" into Claude Code and it will absolutely try. It'll spin up a React frontend, maybe wire up Supabase, write some auth logic, and hand you a working-ish app in twenty minutes. It'll also, more often than not, leave a gap somewhere between "user logs in" and "user only sees their own data" — and that gap is exactly where client portals go wrong.

That's not a knock on Claude Code as a tool. It's genuinely excellent at what it's designed for. The problem is that a huge number of people are pointing it at a job it was never built to do: standing up full multi-user applications with roles, permissions, and a real database sitting underneath real customers.

Here's the difference that actually matters, why it trips people up, and what to use instead when the app you're building has more than one type of user in it.

What is Claude Code actually built for?

Claude Code is an agentic coding tool that reads your codebase, edits files, runs commands, and integrates with your development tools, available in your terminal, IDE, desktop app, and browser. You can check out the official Claude Code documentation to see the full picture of what it can do.

Critically, it's Anthropic's official CLI coding agent — it runs in the terminal, executes tasks autonomously, and integrates into real development workflows. It is not a chat product, an IDE extension, or a code completion tool. That distinction matters because Claude Code is designed to work inside an existing codebase, not to architect a production system from zero and then manage that system's users forever.

Look at what it's actually optimized for: editing files across your entire project with structural changes, writing and running tests, managing Git workflows, and automating repetitive tasks like linting, migrations, boilerplate generation, and dependency updates. That's a list of developer tasks. None of it says "manage row-level security for 500 client accounts."

Claude Code also runs entirely on your machine talking to model APIs — it runs locally in your terminal and talks directly to model APIs without requiring a backend server or remote code index, and it also asks for permission before making changes to your files or running commands. That's a great design for a coding assistant. It's a strange foundation for something meant to be a persistent, hosted, multi-tenant application with a database, uptime requirements, and dozens of logged-in users hitting it at once.

Where does Claude Code actually shine?

Anything that's fundamentally a single-developer task, aimed at code you already have or a script you need once. That includes cleaning up messy data, writing a scraper, running a one-off migration, building a command-line tool for yourself, refactoring an existing codebase, writing tests, or debugging something someone else wrote. If the "user" of the thing you're building is you, sitting at a terminal, Claude Code is close to perfect.

Why does this break down for multi-user apps?

The moment you introduce a second user type — say, "client" and "admin" — you're no longer writing code, you're designing a security model. Who can see what row in which table, enforced on the server, every single time, with no exceptions? That's not a feature you bolt onto an app after the fact. It has to be baked into the database layer from day one, and getting it wrong doesn't throw an error — it just quietly leaks one client's files to another client. That's the kind of bug you don't find in testing. You find it in a support ticket.

What should you actually use for multi-user apps?

This is exactly the gap that Softr's AI Co-Builder is built to close. Instead of generating a codebase you then have to secure yourself, you describe the app you need, and the AI Co-Builder creates the database, pages, user roles, and business logic — everything arrives connected, secure, and ready for real users.

The key architectural difference shows up in the build order. According to Softr's own documentation, the AI doesn't just generate screens — it constructs the entire underlying architecture step by step: creating the database tables and relationships, building the interface and navigation, setting up user groups based on the roles you described with secure, appropriate permissions per group, and picking a theme so the app is production-ready from day one.

That "permissions per group" step is the whole ballgame. The difference that matters most is that permissions are defined before a single page is generated — most tools treat access control as something you configure after the fact, but Softr makes it part of the spec from the start. A client role isn't a label on a dashboard somewhere. It's a rule attached to the data itself, enforced before anything ever gets returned to the browser.

How do you actually build a client portal with it?

Here's the practical workflow using Softr's AI Co-Builder, based on the platform's own getting-started documentation:

1. Start with a plain-language prompt describing your users and rules. Softr's docs specifically recommend this approach — mentioning who uses the app (e.g., "admins manage bookings, clients view their own appointments") helps the AI set up the right user roles and page visibility, and describing key actions like "clients can submit support requests" helps it add the right buttons and forms.
2. Don't over-specify the fields. You don't need to list every field — the AI will infer sensible defaults and you can always edit afterward.
3. Let the AI build the database first. This matters more than it sounds — success in Softr is largely about data structure, and the AI Co-Builder knows this, building your database first and then the interface and app logic on top of it.
4. Review and refine through the in-editor chat. Once your app is open in the Softr editor, you can use the AI assistant to make changes at any time — look for the AI chat input in the editor sidebar or toolbar, type what you want in plain language, and submit.
5. Adjust permissions and layout manually if needed. After the AI builds your app, you can use Softr's visual editor to tweak the interface, modify the database, adjust user permissions, and set up workflows, or invoke the Co-Builder again for bigger changes.
6. Drop into custom code only where you actually need it. Softr includes a vibe coding block you can add to any page, letting you describe custom features in plain text so the AI generates code within your app — an escape hatch for edge cases.

That last point is worth sitting with. You're not locked out of custom code entirely; you just don't need it to be the foundation of the whole app.

What does "secure by default" actually mean here?

It means the access rules run on the server, not in the interface. Softr's product page is explicit about this: you set up custom user groups and advanced permissions to control who sees what and which actions they can take, with SOC 2 Type II and GDPR compliance plus audit logging, and your data stays protected with robust, server-side rules enforced automatically. Server-side enforcement is the part that actually matters for a client portal — it means a client can't see another client's files even if they inspect network requests or mess with the URL, because the check happens before the data ever leaves the database.

Which tool should you pick for your project?

It comes down to one question: does this app have more than one type of user with different data access?

If no — you're writing a script, cleaning data, building a scraper, refactoring, debugging, or automating something for yourself — Claude Code is still the right call. It's fast, it's flexible, and it works directly against real code.

If yes — you're building a client portal, a CRM, an internal tool with staff vs. admin roles, or anything where two different people should see two different things — reach for a platform where permissions are structural, not something you patch on afterward. Softr's AI Co-Builder is worth trying here, especially since you can get 200 free AI credits to try it, no credit card required.

There's also a practical safety net if you're on the fence: the platform includes a built-in scalable database, advanced workflow automation, roles, permissions, and enterprise-grade security that works by default, so you're not stitching together five separate tools just to get a portal that behaves securely.

Before you open another terminal and start typing claude for your next client project, ask yourself who's actually going to log into this thing. If the answer is "more than one type of person," the tool you reach for should already know that — before you've written a single line of the interface.