Your AI-built app works on localhost. Here is everything that has to happen before anyone else can use it.

The eight steps

1. The code lives in a repo. Hosts deploy from a repository, not from the folder on your computer. Put .env in .gitignore before the first commit.
2. Something runs the app all the time. Your laptop sleeps, a server does not. The app has to listen on the port the host gives it (usually a PORT variable) and on 0.0.0.0, not only on localhost.
3. A real database. Data saved in a local file or in the browser's localStorage does not follow the app to a server. You need a hosted database, and the tables have to be created there too, so run your migrations against it.
4. Secrets set on the host. API keys go into the host's environment variables, not into the code. The production values are usually different from the ones on your laptop.
5. A domain and HTTPS. Without HTTPS browsers show warnings and sign-in often breaks.
6. Sign-in knows the new address. Google sign-in only works for the redirect URLs you listed. The localhost one does not count. Add the production one.
7. Logs. When it breaks at 2am you want to read what the server said, not guess.
8. A way back. Keep the previous deploy so you can roll back when a change breaks things.

An agent can do most of this if you tell it the target. The part it cannot do alone is creating accounts and approving access, which is why the process stalls so often.

Quick check before you share the link

• Open the live URL in a private window. If it asks you to sign in with a localhost address, step 6 is missing.
• Create a record, reload the page, then deploy again. If the record is gone, the data is not in a real database.
• Search the repo for your API keys. If you find them, rotate them and move them to environment variables.

More guides

• Add Google sign-in to an AI-built app: the 6 setup steps
• Manage API keys across several AI-built projects