Create app

Changed on

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Creates a new app. Pass initial_message.content to build it from a prompt, or send an empty body ({}) to create an empty app. Add initial_message.file_urls to build from a screenshot or a mockup alongside the prompt.

Building from a prompt runs in the background and consumes credits. Poll Get app and watch its status to see when the build finishes. By default the app is created in your default workspace, which for a personal access token is the token's workspace. Set organization_id to create it in another workspace you belong to. A personal access token can't create apps outside its own workspace, so with one you can omit the field. This endpoint is limited to 5 requests per minute.

Set name, user_description, public_settings, custom_instructions, secrets, and prevent_iframe_embedding in the same request to configure the app before its first build turn runs. Without a name, the app starts as untitled, and once a build turn changes it Base44 names and describes it, replacing any user_description you sent.

<Warning>secrets are applied after the app is saved. A request that fails on a secrets entry still leaves the new app in your workspace, and it counts toward your plan's app limit. Delete it before you retry.</Warning>

<Warning>The response includes fields beyond the ones documented here. Don't rely on undocumented response fields, as they can change at any time. Send only the fields documented here. Other request fields are not supported and their behavior can change.</Warning>

post/api/apps

Request

  • Base URL: https://app.base44.com
  • URL: https://app.base44.com/api/apps
  • Auth: HTTP bearer

Request body

namestring

Display name of the app. Omit it to have Base44 name the app once a build turn changes it. The app's URL slug is built from the name.

user_descriptionstring

Description of the app. When you omit name, Base44 replaces it with a generated description once a build turn changes the app.

public_settings'public_without_login' | 'public_with_login' | 'workspace_with_login' | 'private_with_login'

Who can open the published app. public_without_login lets anyone in, unless the workspace enforces SSO for apps, in which case visitors must log in. public_with_login lets anyone in who logs in, workspace_with_login admits only logged-in members of the workspace, and private_with_login admits only users who were granted access. Omit it to use the workspace default. workspace_with_login and private_with_login need a paid plan, and a workspace policy can restrict which values you can choose. Like other publish settings, it takes effect on the live app once you deploy the app.

custom_instructionsstring

Instructions the builder follows on every turn, starting with the first build. Only the first 10,000 characters reach the builder.

secretsobject

Secrets to set on the app before its first build turn, keyed by secret name. Each entry sets the secret to value. The name must not be empty or contain =.

prevent_iframe_embeddingboolean

Whether the published app refuses to load inside an iframe on another site. Defaults to true. Set it to false to embed the app, although a workspace embedding policy can still restrict where. Preview URLs are not affected. It takes effect on the live app once you deploy it.

organization_idstring

ID of the workspace to create the app in. Omit to use your default workspace, or the token's workspace when you call with a personal access token. You must have an editor-capable role (Editor or above) in the workspace. Viewers and guests cannot create apps. This is the same workspace ID that List apps accepts as workspace_id.

Example request

{
  "initial_message": {
    "content": "A CRM to track leads and deals",
    "file_urls": [
      "https://example.com/mockup.png"
    ]
  },
  "name": "My CRM",
  "user_description": "A CRM to track leads and deals",
  "public_settings": "public_with_login",
  "custom_instructions": "Use a dark theme and keep every page mobile friendly.",
  "secrets": {
    "STRIPE_API_KEY": {
      "type": "value",
      "value": "sk_test_example"
    }
  },
  "organization_id": "67e0b12c4d8a3f005b21c9e4"
}

Response

Successful Response

idstring

ID of the app.

created_datestring date-time

Time the app was created, as a UTC timestamp in ISO 8601 format.

updated_datestring date-time

Time the app document was last written, as a UTC timestamp in ISO 8601 format.

created_bystring nullable

Email of the user who created the app.

organization_idstring nullable

ID of the workspace the app belongs to.

app_typestring

Kind of app, set when it's created. One of user_app (a web app), user_agent (an AI agent), mobile_app (a native mobile app), user_game (a game), slide (a presentation), or imported_app (an app imported from an existing code repository). List apps returns it as stored, so an older agent app can report agent instead of user_agent, and some older apps don't include it. Get app always returns one of the values above.

namestring

Display name of the app.

user_descriptionstring nullable

Description of the app, or null if none was set. An app created without a name gets a generated description once a build turn changes it.

logo_urlstring nullable

URL of the app's logo, or null if it has none. Set it with Set app logo or Generate app logo.

social_image_urlstring nullable

URL of the image shown when the app is shared on social platforms, or null if none was set, in which case the logo is shown instead. Set it with Set social image.

public_settings'private_with_login' | 'public_with_login' | 'public_without_login' | 'workspace_with_login'

Who can open the published app. Each value is described under Update app, which also changes it.

hide_entity_created_byboolean

Whether the app's entity records leave out the email of the user who created each one (created_by). Newer apps always leave the email out, whatever this is set to.

is_remixableboolean

Whether others can remix the app. While it's true, the published app also shows the Base44 badge if public_settings is public_with_login or public_without_login.

main_branch_protectedboolean

Whether the app's main branch is protected, so changes to main must go through a branch that's merged back. Always true for imported apps. Change it with Set main branch protection.

slugstring nullable

URL slug for the app, auto generated from the name and app ID or set to a custom value, or null if the app has no slug yet. The published URL is built from it.

is_unpublishedboolean

Whether the app was taken offline with Unpublish app and hasn't been published again since. While it's true, the published URL is offline and last_deployed_at still shows the last publish.

last_deployed_atstring date-time nullable

Time the app was last published, as a UTC timestamp in ISO 8601 format, or null if it has never been published.

screenshot_urlstring nullable

URL of a screenshot of the published app. Captured shortly after each publish, so it can briefly lag or be null right after publishing.

preview_screenshot_urlstring nullable

URL of a preview screenshot taken before publishing, distinct from screenshot_url, or null if none has been captured.

owner_idstring nullable

ID of the user who owns the app. It starts as the creator and changes when ownership is transferred.

dev_environment_enabledboolean

Whether test data is on, which gives the app a test database next to its live one.

Example response

{
  "id": "6820f3a4e7b91d003c45a1f2",
  "created_date": "2026-08-01T09:15:00",
  "updated_date": "2026-08-02T14:30:00",
  "created_by": "developer@example.com",
  "organization_id": "67e0b12c4d8a3f005b21c9e4",
  "app_type": "user_app",
  "name": "My CRM",
  "user_description": "A CRM to track leads and deals",
  "logo_url": "https://storage.base44.com/6820f3a4e7b91d003c45a1f2/3f2504e0_logo.png",
  "social_image_url": "https://storage.base44.com/6820f3a4e7b91d003c45a1f2/7c9e6679_social.png",
  "public_settings": "public_with_login",
  "auth_config": {
    "enable_username_password": true,
    "enable_google_login": true
  },
  "hide_entity_created_by": true,
  "slug": "my-crm-3c45a1f2",
  "last_deployed_at": "2026-08-02T14:30:00",
  "screenshot_url": "https://storage.base44.com/screenshots/6820f3a4e7b91d003c45a1f2.png",
  "preview_screenshot_url": "https://storage.base44.com/previews/6820f3a4e7b91d003c45a1f2.png",
  "owner_id": "6706af53b9c1e2004a37d85f",
  "status": {
    "state": "ready",
    "details": "Publishing app",
    "request_id": "a1b2c3d4e5f67890abcdef12",
    "last_updated_date": "2026-08-02T14:30:00Z",
    "error_source": "build",
    "paywall_context": {
      "billing_organization_id": "67e0b12c4d8a3f005b21c9e4",
      "user_id": "6706af53b9c1e2004a37d85f",
      "evaluated_at": "2026-08-02T14:30:00Z"
    }
  }
}

Changes

  • 5e139db2e643Revision changes
    • info

      the endpoint scheme security PersonalAccessTokenAuth was added to the API

  • fc604cdcc3a2Revision changes
    • breaking

      the response's property type changed from no type to object for status

    • breaking

      the response's property type changed from no type to object for status

    • warning

      added the new private_with_login enum value to the response property for the response status

    • warning

      added the new public_with_login enum value to the response property for the response status

    • warning

      added the new public_without_login enum value to the response property for the response status

    • warning

      added the new workspace_with_login enum value to the response property for the response status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      removed subschema #2 from the response property anyOf list for the response status

    • info

      removed subschema #2 from the response property anyOf list for the response status

    • info

      the response's property default value user_app was added for the status

    • info

      the response's property default value false was added for the status

    • info

      the response's property default value false was added for the status

    • info

      the response's property default value false was added for the status

    • info

      the response's property default value false was added for the status

    • info

      the response's property default value false was added for the status

    • info

      the response's property default value untitled was added for the status

    • info

      the response's property default value public_with_login was added for the status

    • info

      response property app_type list-of-types was narrowed by removing types null from media type application/json of response 200

    • info

      response property created_date list-of-types was narrowed by removing types null from media type application/json of response 200

    • info

      response property dev_environment_enabled list-of-types was narrowed by removing types null from media type application/json of response 200

    • info

      response property hide_entity_created_by list-of-types was narrowed by removing types null from media type application/json of response 200

    • info

      response property id list-of-types was narrowed by removing types null from media type application/json of response 200

    • info

      response property is_remixable list-of-types was narrowed by removing types null from media type application/json of response 200

    • info

      response property is_unpublished list-of-types was narrowed by removing types null from media type application/json of response 200

    • info

      response property main_branch_protected list-of-types was narrowed by removing types null from media type application/json of response 200

    • info

      response property name list-of-types was narrowed by removing types null from media type application/json of response 200

    • info

      response property public_settings list-of-types was narrowed by removing types null from media type application/json of response 200

    • info

      response property updated_date list-of-types was narrowed by removing types null from media type application/json of response 200

    • info

      added the required property / to the response with the status