guide

How to host a full-stack app built by an AI coding agent

An agent-built app is usually a web server, a database it created itself, and a handful of environment variables. Hosting it means keeping those three together on a machine that stays up. A reachpad workspace does that by default, because the agent built the app there and nothing has to be extracted.

The short version

Keep the app where the agent built it. The reason agent-built apps are awkward to host is that the agent made decisions a deploy pipeline does not know about: a SQLite file in the project directory, a background worker started from a shell, a secret pasted into .env. A workspace that persists carries all of that as is. A deploy target needs each one rewritten into its own vocabulary first.

The trade is that a workspace is one machine, not a fleet. It is the right host while the app is small and still changing. When it stops changing and starts needing a domain and uptime someone is paid for, move it.

The database

If the agent used SQLite, the file is on the workspace disk and survives a pause with everything else. If it started Postgres or Redis locally, the data directory survives but the server process does not: every start is a cold boot, so start it again before the app. A line in a start script is enough.

For a database that should outlive the workspace, or be shared between forks, point the app at a hosted one and put the connection string in as a secret. Forks copy the disk, not the external database, so two forks against one hosted database are two apps writing to one place.

Keeping the process alive

While the workspace is active, a process you started stays up when you detach. The agent can keep working in it too; that is what multiple agents is about.

A pause seals the disk and stops the machine. On resume nothing is running, so the exposed link errors until the app is started again on the same port. Put the start command in a script at the project root and run it on resume, or ask the agent to. The full rules are on what persists.

Secrets

Two kinds. A secret written into the workspace lands in its environment and anything in the workspace can read it, including a collaborator you have shared with. A brokered secret stays with reachpad, the workspace never sees the value, and spend through it is capped by a ceiling you set. Anthropic and OpenAI keys are brokered by default; everything else is written in. Details on secrets and spend.

An agent will happily write a secret into a file and commit it. Add secrets through the dashboard, not by pasting them into the chat, and check git log -p before you push.

Who can open it

Expose the port and anyone signed in to reachpad with the link can view the app; see sharing a port. To let a named person see the code and terminal too, share the workspace. Neither is a public deployment: a visitor with no reachpad account sees a sign-in page.

When it outgrows the workspace

The workspace holds a normal git repository with its own remotes, so moving out is a push. What you will have to rebuild on the other side is the part the workspace was carrying for free: the local database, the start script, the environment. That is a fair afternoon, and worth spending only once the app has earned it.

When reachpad is the wrong answer

It needs a custom domain, a CDN or more than one machine. That is a deployment; reachpad vs Vercel is the honest comparison.
Anonymous visitors must be able to open it. A reachpad link requires a reachpad sign-in.
You want the model, the editor and the hosting sold as one thing. Lovable and Replit are built that way; reachpad vs Replit covers where each wins.

166 hours 40 minutes of agent work is shared across up to 10 workspaces, with no card required.

Written on 23 August 2026. Something out of date or unfair? The other guides, or this page as raw markdown: /guides/host-ai-built-app.md