English | 简体中文 | 日本語

AppAI — Publishing for AI-Built Pages and Applications

AI Agents: Start with the short overview.

curl -s https://appai.info/spec

---

AppAI (appai.info) is a publishing platform for AI-built software. It covers four use-cases: Hosted Page for a product, business or person; Wrapped tool for an existing deployment; Connected tool for a backend, login or quota through an owner-maintained connector; Universal App for persistent data and business rules in a reviewed, isolated runtime.

Why AppAI?

Built an app with AI but don't have a website? AppAI gives you:

• Instant landing page — professional, mobile-responsive, hosted at appai.info/p/your-app
• Privacy policy + Terms of service — auto-generated, required for App Store / Play Store
• App discovery — your app appears in the AppAI directory alongside other AI-built apps
• Zero setup — no domain, no hosting, no deployment. Just an API call.
• Multi-language — platform UI in 9 languages, hosted pages support 30+ locales with auto-detection
• Visual design system — dark mode, custom Google Fonts, color palettes, hero variants (centered/split/minimal)
• Universal Apps — app-owned UI, API, business rules, schema, migrations, and tests; AppAI-managed identity, Organization context, database, private assets, quota, and monitoring

How It Works

You: "Publish my app on AppAI — start at appai.info/spec"

Your AI Agent:
  1. Show the user verification_uri_complete: open it in the user's own browser if you can, and always print it. Also print the returned `user_code` so the user can compare it with the approval page. The user signs in with Google if asked, checks that the code matches, and clicks Approve. Never approve it yourself. The agent receives the key — nothing to copy or paste.
  2. Asks you about your app (name, features, screenshots, etc.)
  3. Calls the AppAI API to create your page
  4. Done — your page is live at appai.info/p/your-app

The entire flow is automated. Your AI agent reads the Agent Spec and knows exactly what to do.

For AI Agents

Quick Start

1. Authenticate using the Device Authorization Flow (RFC 8628):

   curl -s -X POST https://appai.info/api/v1/auth/device

2. Discover available sections and presets:

   curl -s https://appai.info/api/v1/sections
   curl -s https://appai.info/api/v1/presets

3. Create a page:

   curl -X POST https://appai.info/api/v1/pages \
     -H "Authorization: Bearer appai_sk_YOUR_KEY" \
     -H "Content-Type: application/json" \
     -d '{ "slug": "my-app", "title": "My App", "isPublished": true, ... }'

4. Live at: appai.info/p/my-app, appai.info/p/my-app/privacy, appai.info/p/my-app/terms

The Agent Spec overview links to topic pages; llms-full.txt is the complete single file.

API Reference

Method	Endpoint	Auth	Description
POST	/api/v1/auth/device	None	Initiate device auth (RFC 8628)
POST	/api/v1/auth/token	None	Poll for auth completion
GET	/api/v1/sections	None	List all section types
GET	/api/v1/presets	None	List preset templates
POST	/api/v1/pages	Bearer	Create a page
GET	/api/v1/pages	Bearer	List your pages
GET	/api/v1/pages/:slug	Bearer	Get a page
PUT	/api/v1/pages/:slug	Bearer	Full update a page
PATCH	/api/v1/pages/:slug	Bearer	Partial update a page
DELETE	/api/v1/pages/:slug	Bearer	Delete a page
POST	/api/v1/pages/:slug/publish	Bearer	Publish a page
POST	/api/v1/pages/:slug/unpublish	Bearer	Unpublish a page
POST	/api/v1/pages/:slug/set-default	Bearer	Set default locale (?locale=ja)
POST	/api/v1/pages?dryRun=true	Bearer	Preview without saving (identical to POST /api/v1/pages/preview)
POST	/api/v1/upload	Bearer	Upload an image (returns public URL)
POST	/api/v1/apps	Bearer	Submit an app
GET	/api/v1/apps	Bearer	List apps
GET	/api/v1/apps/:id	Bearer	Get an app
PUT	/api/v1/apps/:id	Bearer	Update an app
DELETE	/api/v1/apps/:id	Bearer	Delete an app
POST	/api/v1/keys	Session	Create an API key
GET	/api/v1/keys	Session	List API keys
DELETE	/api/v1/keys	Session	Revoke an API key

Universal Apps

Use a Universal App when the software has its own UI/API/business rules or persistent data. Each app keeps its UI, API, business rules, database schema, migrations, tests, and appai.app.json release manifest in its own repository. AppAI validates the manifest, reviews and deploys the artifact to an isolated runtime, and supplies reusable identity, app-scoped database, private image/PDF, quota, and monitoring capabilities.

Natural Universal App publishing flow

1. Authorize with the AppAI device flow: the agent shows a link; also print the returned user_code so the user can compare it with the approval page; open the link, sign in with Google if asked, check the code matches, and click Approve; the agent receives the key — nothing to copy or paste. Reuse a securely stored key when available.
2. Add appai.app.json to the app repository, including a lockfile-strict installCommand: npm ci, pnpm install --frozen-lockfile, or yarn install --immutable. The repository's package.json must define test and typecheck scripts.
3. Submit POST /api/v1/apps/{appId}/releases with a credential-free public GitHub repository URL (https://github.com/{owner}/{repo}) and exact 40-character Git commit SHA; AppAI returns PENDING.
4. The PENDING release awaits AppAI platform review. An AppAI administrator approves it and starts the managed pipeline.
5. After approval, AppAI validates the pinned source/manifest and requires the repository's test, typecheck, and declared build command to pass in an isolated sandbox. It then provisions requested database schema/roles, runs an optional migration command, deploys, health-checks, and activates verified evidence.
6. Poll GET /api/v1/apps/{appId}/releases/{releaseId} while it awaits review and then until APPROVED with an ACTIVE healthy production deployment; users then launch /app/{appId}.

External agents never submit organizationId, runtime URLs, database secrets, provider/OIDC/CLI credentials, raw SQL, artifact digests, or platform infrastructure settings. AppAI derives Organization context and provides only approved, scoped capabilities to the isolated runtime. Simpleshop is the first example, not a special API.

For a copyable appai.app.json and release request for a generic database-backed Inventory Manager app, see the Agent Instructions. A PENDING receipt awaits platform review; after an AppAI administrator starts it, AppAI performs the managed validation/build/provision/deploy/health flow. Source stays in the app repository.

When an app requests database, AppAI provisions app-scoped PostgreSQL and injects server-only DATABASE_URL, APPAI_PLATFORM_URL, and APPAI_APP_ID into its approved runtime. Schema and migrations remain in the app repository; AppAI runs an optional migration command with a separate migration role and gives the runtime only target-schema DML/sequence access. User and Organization context is obtained only through runtime-session exchange/introspection, never from a request body or public environment variable.

Required Universal App auth chrome

/app/{appId} is the AppAI SSO login gate. After login, AppAI redirects with a single-use identity handoff to the platform-managed https://{appId}.appai.info runtime. The runtime exchanges the one-time launch code and introspects its trusted session; every protected screen then provides a responsive top-right header with safe user/Organization display (or a neutral AppAI sign-in fallback), Return to AppAI, and a POST logout action. App logout revokes the runtime session with a strict appId, clears the local HttpOnly cookie, and routes to AppAI /logout?callbackUrl=/. Tokens, raw user/Organization IDs, credentials, and database URLs never appear in the browser UI.

Apps open through /app/{appId} and then run at the AppAI-managed https://{appId}.appai.info subdomain. AppAI creates a single-use launch code and an opaque, short-lived runtime session; the independent runtime receives userId, organizationId, instance identity, and only its granted capabilities. An app cannot supply or select its own runtime domain, and app server code is never imported into the AppAI Next.js process.

Simpleshop is an example of this contract. Its app code lives in the Simpleshop repository and launches through the same Universal App runtime as every other database application. See docs/apps/simpleshop.md.

Method	Endpoint	Auth	Description
POST	/api/v1/apps/:appId/releases	Bearer	Submit a versioned app manifest for platform review
GET	/app/:appId	Browser session	Launch the active isolated deployment
POST	/api/runtime/sessions/exchange	One-time code	Exchange a launch code for an opaque runtime session
POST	/api/runtime/sessions/introspect	Runtime bearer	Resolve Organization identity and capability grants
POST	/api/runtime/assets	Runtime bearer	Upload a private image or PDF with app/Organization quota
GET/DELETE	/api/runtime/assets/:id	Runtime bearer	Stream or delete an app-owned private asset

Available Page Sections

Build any page by combining these 29 section types:

Section	Description
profile-header	Personal introduction with avatar, Markdown and navigation
project-cards	Project grid with icons, screenshots and links
entries	Focus, experience or contact entries
hero	Headline with logo, background image/video, CTA. Three variants: centered, split (text+image), minimal. Configurable height.
video	Embedded video (YouTube, Vimeo, mp4, webm, gif)
features	Feature cards with icons in a grid
screenshots	Horizontal image carousel
download	App Store / Google Play buttons
pricing	Plan comparison cards
testimonials	User review cards
faq	Expandable Q&A list
gallery	Image/video grid
team	Team member cards
schedule	Event timeline
sponsors	Logo wall
stats	Key metrics (e.g. "10K+ Users")
contact	Contact info
cta	Call-to-action banner
links	Link button list (Linktree-style)
about	Text content section
action	API action buttons (POST/GET with confirmation)
form	Contact/account-management form with email or webhook submission
media-downloader	Interactive media download tool (YouTube, IG, TikTok, 1000+ platforms)
video-subtitle	Login-gated YouTube subtitle generator backed by the approved connector
tool	Universal interactive tool (file upload, processing, download — connect any API)
pdf-viewer	PDF viewer with password unlock and save-as-unlocked (client-side, no backend)
embed	TikTok / Loom / YouTube / Vimeo / Spotify / CodePen / Figma. Auto-detects provider
iframe-tool	Embed a vibe-coded tool deployed to Vercel / Cloudflare Pages / Netlify / GitHub Pages. AppAI provides multi-language SEO landing page wrapper, locale + theme passthrough, auto-resize, fullscreen URL
simple-order	Native order request form with line-item totals, payment/LINE handoff, and owner email notification

Page-Level Design Options

Every hosted page supports these visual customization fields:

Field	Description
themeColor	Primary brand color (hex). Drives CTA buttons, accents, links.
themeColorSecondary	Accent color for secondary buttons. Auto-generated if omitted.
darkMode	Dark backgrounds + light text. All sections adapt automatically.
fontFamily	Google Fonts name (e.g. "Inter", "Noto Sans JP"). Loaded automatically.
headerLogo	Separate logo for the light sticky header (when hero logo is light-colored).
backgroundColor	Per-section background color for visual rhythm.

Preset Templates

Click any preview to see the live demo:

App Landing Page For iOS/Android apps	SaaS Landing Page For web tools & APIs
Personal Profile Personal branding	Link in Bio Social media links
Portfolio Creative work showcase	Event Page Conferences & meetups

Self-Hosting

git clone https://github.com/KYCgrayson/APPAI.git
cd APPAI
npm install
cp .env.example .env.local   # Fill in your credentials
npx prisma db push
npm run dev

Tech Stack

• Next.js 16 + React 19
• Tailwind CSS 4
• Prisma + Neon (Serverless PostgreSQL)
• NextAuth.js (Google OAuth)
• next-intl — platform i18n (9 languages)
• RFC 8628 Device Authorization for AI agents

License

MIT