Publish an app

An app is a Page with a small server behind it. Visitors see its page as usual, and the page can call the app's own server, for example to fetch a forecast with an API key that never reaches the browser.

What SecondPage can run

SecondPage runs small apps written for its web-standard server: one bundled JavaScript file that exports fetch(request, env). Large framework apps, such as Rails, Django or a Next.js server, and anything that needs its own container, are not supported.

Your agent can build a supported app for you. Ask it to "build this as a SecondPage app" and to publish it, or to build the folder so you can upload it.

Publish from Upload

1. Build the app so its build folder exists (your agent can do this).
2. Select Upload → Upload Folder and choose the app folder, the one that holds secondpage.json. You can also drag the folder onto Home or Pages.
3. Check the App card. It shows the app's name, what visitors will see, and any API keys the app uses.
4. Select Publish app.

When it finishes, the app is live at its Page link. If the app uses API keys, select Add API keys to turn on its server. You can also do this later.

To update an app, upload the new build onto the same Page (Upload suggests it, or use Upload new version on the Page's activity screen). If only the server code changed, Upload updates just the server.

What goes on the Page

The folder named output_dir in secondpage.json is the app as built. Its web files (HTML, CSS, images, scripts) become the Page visitors see; it must contain an index.html. The server file (entry_file) runs on SecondPage and is never published as part of the Page. Nothing outside output_dir, such as your source code, is published.

A typical folder:

weather-app/
  secondpage.json
  build.mjs          # your build script (SecondPage never runs it)
  src/server.mjs     # your source
  dist/index.html    # the page visitors see
  dist/server.mjs    # the server SecondPage runs

If Upload can't publish it

Upload explains what to fix before anything is created, for example:

• the app hasn't been built yet (the server file is missing),
• output_dir has no index.html,
• the build folder contains private files such as .env or keys,
• secondpage.json describes something SecondPage doesn't support.

Add or change API keys

Open the app's Page menu and select API connections, or go to Settings → App API keys. Only the app's owner and organization admins see it.

• Production keys are the ones visitors' requests use. The first time, select Set up production keys.
• Type each key, or select Import .env file to fill them from a file on your computer. Only the keys this app uses are read; the file itself is not uploaded.
• Approve this version of the app, then select Save changes. The app starts using the keys once they're checked, and its code and data don't change.
• Saved keys are never shown again. To change one, enter a new key; to stop using one, select Remove. The app is paused until all its keys are added again.

If you don't own the app, approving a new version asks you to enter every key yourself. Keys someone else saved are never used for code you approve.

Every change appears in your organization's Audit log, with key names but never values.

Usage and spending

The services your app calls bill you for those calls. Apart from a safety brake for runaway apps, SecondPage only limits how often apps call them when you set a limit, so set a spending budget with each provider too, such as an OpenAI project budget.

• One app: in its API connections, enter a Daily call limit under Usage and spending and select Save limit.
• All of your organization's apps: an organization admin can enter a Daily call limit under Settings → Organization → Apps. It counts the calls of every app in the organization together.
• When either limit is reached, the app's calls to other services are refused until midnight UTC. Leave a limit blank for no limit.
• SecondPage also stops an app's calls for the rest of any minute in which it makes about 600, so a stuck app can't flood other sites.

Limit changes appear in the Audit log.

Who can use an app

An app follows its Page's sharing. Visitors must be signed in to SecondPage and able to open the Page for the app's server to answer them.