APIs and backends

A server with no web pages: hosted the same way, with keys instead of a sign-in screen.

Not everything the platform hosts has pages. A backend for a phone app, a small service another app calls, a webhook receiver: all of these are servers that speak JSON and never render HTML.

How the platform knows

Detection looks at the framework and at whether the code renders anything. An Express, Hono, Fastify, Flask or FastAPI project with no template folder and no render calls is treated as an API. If it does render pages, it is treated as a web app instead. You can see which it chose in deploy.json under kind, along with the evidence, and change it if the guess was wrong.

What a deploy gives you

A web app deploy prints a link to open. An API deploy prints a base URL and a key:

detected  Hono · API · Postgres
plan      runtime: lambda/arm64 · data: managed postgres
live      https://quiet-harbor-4471.uarpie.app
key       uarpie_k_prj_7f3a… (shown once)

The key is shown once and never again. If you lose it, make a new one; making a new one does not disturb the old ones until you remove them.

Calling it

Send the key in a header:

curl https://quiet-harbor-4471.uarpie.app/recipes \
  -H "Authorization: Bearer uarpie_k_prj_7f3a…"

Requests without a valid key are rejected before your code runs, so a scanner that finds the address costs you nothing at all. This is the same protection a web app gets from its sign-in, applied where there is no browser to sign in with.

Keys are a gate, not a login

A key answers "may this client talk to this API at all". It does not answer "who is this person". Anything shipped inside a phone app can be extracted from it, so treat a key in an app as public: it stops strangers, it does not identify users.

For "who is this person", use the platform's own sign-in. Your users get a link by email, and your app receives a verified identity it can trust, without you writing any login code. That is the same mechanism described in Keeping your app private.

Everything else is the same

An API project gets the same database, storage, scheduled jobs, secrets, versions, instant rollback, spending limit and trace as a web app. It appears in the dashboard with the same canvas, minus the parts that only make sense for a browser.