APIs and backends

Not everything the platform hosts has pages. A backend for a phone app, a small service another app calls, a webhook receiver: all of these are servers that speak JSON and never render HTML.

How the platform knows

Detection looks at the framework and at whether the code renders anything. An Express, Hono, Fastify, Flask or FastAPI project with no template folder and no render calls is treated as an API. If it does render pages, it is treated as a web app instead. You can see which it chose in deploy.json under kind, along with the evidence, and change it if the guess was wrong.

What a deploy gives you

A web app deploy prints a link to open. An API deploy prints a base URL and a key:

detected  Hono · API · Postgres
plan      runtime: lambda/arm64 · data: managed postgres
live      https://quiet-harbor-4471.uarpieapps.com
key       uarpie_k_prj_7f3a… (shown once)

The key is shown once and never again. If you lose it, make a new one; making a new one does not disturb the old ones until you remove them.

Calling it

Send the key in a header:

curl https://quiet-harbor-4471.uarpieapps.com/recipes \
  -H "Authorization: Bearer uarpie_k_prj_7f3a…"

Requests without a valid key are rejected before your code runs, so a scanner that finds the address costs you nothing at all. This is the same protection a web app gets from its sign-in, applied where there is no browser to sign in with.

Keys are a gate, not a login

A key answers "may this client talk to this API at all". It does not answer "who is this person". Anything shipped inside a phone app can be extracted from it, so treat a key in an app as public: it stops strangers, it does not identify users.

For "who is this person", an API identifies its own users: a key only says which app is calling, not who is holding it. A private website on the platform is different: it is told who is signed in, without any login code of yours (see Who is using your app).

Everything else is the same

An API project gets the same database, storage, scheduled jobs, secrets, versions, trace and way back to an earlier version (about half a minute) as a web app. It appears in the dashboard with the same canvas, minus the parts that only make sense for a browser.