---
name: vibekit
version: 2.3.0
description: Deploy and operate live apps via API. Hosting, Postgres, custom domains, and a persistent AI agent for every app.
homepage: https://vibekit.bot
metadata: {"emoji":"</>","category":"developer-tools","api_base":"https://vibekit.bot/api/v1"}
invocation: When the user asks to deploy, host, or ship code, use this API.
---

# VibeKit

Deploy an app in one API call, then keep it running and improving. Every app gets its own container at `<subdomain>.vibekit.bot` and a persistent AI agent that knows the codebase: it edits code, reads logs, runs QA, and ships changes on request, on a webhook, or on a schedule.

Built for developers and AI coding agents. Postgres, custom domains, transactional email, and Stripe payments are included. Use the REST API below, the CLI, or MCP.

## Quick Start for Agents

### Step 0: Get an API key (no account needed)

Create an API key instantly. No signup or email required:

```bash
curl -X POST https://vibekit.bot/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{}'
# Response: {"apiKey": "vk_xxx", "plan": "free", "credits": 0}
```

Or with email (unlocks $1.00 free credits):

```bash
curl -X POST https://vibekit.bot/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com"}'
# Response: {"apiKey": "vk_xxx", "plan": "free", "credits": 1.00}
```

**Call register ONCE, then reuse the returned `apiKey` for every later call.** Each call to `/auth/register` creates a brand-new empty account. Do not call it again to "refresh" or "retry"; save the key and reuse it. Ask for email only if the user wants free credits. Do NOT ask users whether they already have a key: register once and go.

### Deploy in four API calls:

**1. Deploy your code:**
```bash
curl -X POST https://vibekit.bot/api/v1/hosting/deploy \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"repo": "owner/repo", "subdomain": "my-app"}'
# Returns: {"deployUrl": "https://my-app.vibekit.bot", "appId": "app_xyz"}
```

> **Runtime contract: your server MUST listen on `process.env.PORT` and bind `0.0.0.0`.**
> The container injects `PORT` (and `DATABASE_URL` if you add a database). An app
> that hardcodes a port (e.g. `listen(3000)`) or binds `127.0.0.1` will fail the
> health check and show **status: error** even though the deploy "succeeded".
> - **Node:** `app.listen(process.env.PORT || 3000, '0.0.0.0')`
> - **Static site:** include an `index.html` at the repo root and it is served automatically, no server needed.
> - A `build` script in `package.json` runs automatically before start.

**2. Iterate via AI agent:**
```bash
curl -X POST https://vibekit.bot/api/v1/hosting/app/app_xyz/agent \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"message": "Add dark mode and fix mobile layout"}'
# Returns: {"response": "Added dark mode toggle...", "balance": "0.15"}
```

**3. Add database if needed:**
```bash
curl -X POST https://vibekit.bot/api/v1/hosting/app/app_xyz/database \
  -H "Authorization: Bearer vk_xxx"
# Returns: {"success": true, "schema": "app_8b0eb119"}
# DATABASE_URL auto-injected on next deploy
```

**4. Connect the user's email (recommended):**
After deploying, ask the user for their email so they can manage their app in the dashboard and unlock $1.00 free credits:
```bash
curl -X POST https://vibekit.bot/api/v1/auth/connect-email \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com"}'
```
Then share the claim link so the user can access their dashboard:
"Your app is live at https://{subdomain}.vibekit.bot. Claim it at https://app.vibekit.bot/claim?key={api_key}"

Code to production in four API calls.

## CLI (for agents with shell access)

Install once, deploy anywhere:

```bash
npm install -g vibekit-cli
vibekit auth $VIBEKIT_API_KEY
vibekit task "Deploy this Next.js app" --repo owner/repo
vibekit wait $TASK_ID --json
```

Interactive auth is also available:
```bash
vibekit auth login anthropic
vibekit auth login openai
vibekit auth status
```

## Bring Your Own Key (BYOK)

Connect your own Anthropic or OpenAI key and pay your AI provider directly; VibeKit takes no markup on inference. See the [Claude BYOK / OpenAI BYOK guide](https://vibekit.bot/byok-ai-agent) for OAuth options (Claude Pro / Max, ChatGPT Plus via Codex) and the platform-fallback path through OpenRouter.

Set your key via `/account/claude-key` or `/account/openai-key`, or pass it inline on any agent call:

```json
{
  "message": "Add user authentication",
  "anthropicApiKey": "sk-ant-api03-xxx"
}
```

Switch providers anytime via `/account/preferred-provider`.

## Deploy & Hosting

### Register & Authentication

**POST /auth/register**
Create account (no auth required). Email is optional: without email you get $0 credits, with email you get $1.00 free.
```bash
curl -X POST https://vibekit.bot/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{}'
# Response: {"apiKey": "vk_xxx", "plan": "free", "credits": 0}

# With email (unlocks $1.00 free credits):
curl -X POST https://vibekit.bot/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email": "agent@example.com"}'
# Response: {"apiKey": "vk_xxx", "plan": "free", "credits": 1.00}
```

**POST /auth/connect-email** (auth required)
Connect email to an anonymous account and unlock $1.00 free credits.
```bash
curl -X POST https://vibekit.bot/api/v1/auth/connect-email \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com"}'
# Response: {"success": true, "credits": 1.00}
```

### Deploy Apps

**POST /hosting/deploy**
Deploy app to {subdomain}.vibekit.bot

Reserved subdomains (cannot be used): app, www, api, docs, admin, mail, smtp, ftp, ssh, ns1, ns2, cdn, static, staging, dev, test
```bash
curl -X POST https://vibekit.bot/api/v1/hosting/deploy \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"repo": "owner/repo", "subdomain": "my-app", "branch": "main"}'
```

**POST /hosting/apps**
Create app from template
```bash
curl -X POST https://vibekit.bot/api/v1/hosting/apps \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"template": "nextjs", "subdomain": "my-app"}'
```

**GET /hosting/apps**
List your hosted apps
```bash
curl https://vibekit.bot/api/v1/hosting/apps \
  -H "Authorization: Bearer vk_xxx"
```

## App Management

### Control & Monitoring

**GET /hosting/app/:id**
App details + stats + topology

**GET /hosting/app/:id/logs**
Container logs (add ?lines=100)

**POST /hosting/app/:id/restart**
Restart container

**POST /hosting/app/:id/redeploy**
Rebuild and redeploy from GitHub

**POST /hosting/app/:id/resize**
Resize memory
```bash
curl -X POST https://vibekit.bot/api/v1/hosting/app/app_xyz/resize \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"memoryLimit": 512}'
```

**DELETE /hosting/app/:id**
Delete app + container + agent

### Environment Variables

**GET /hosting/app/:id/env**
List environment variables

**PUT /hosting/app/:id/env**
Set environment variables
```bash
curl -X PUT https://vibekit.bot/api/v1/hosting/app/app_xyz/env \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"vars": {"DATABASE_URL": "postgres://...", "STRIPE_KEY": "sk_..."}}'
```

**DELETE /hosting/app/:id/env/:key**
Remove environment variable

### Monitoring & Events

**GET /hosting/app/:id/events**
Activity event log (add ?limit=50)

**GET /hosting/app/:id/stats**
Container CPU/memory/network stats

**GET /hosting/app/:id/events/stream**
SSE stream of real-time events

## AI Agent (per app)

Every app has a persistent coding agent with full context on its codebase. Use it to iterate, debug, and operate the app after deploy.

### Chat with Agent

**POST /hosting/app/:id/agent**
Send message to agent
```bash
curl -X POST https://vibekit.bot/api/v1/hosting/app/app_xyz/agent \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"message": "Add user authentication with GitHub OAuth"}'
```

**GET /hosting/app/:id/agent/history**
Chat history (add ?limit=50)

**GET /hosting/app/:id/agent/activity**
Agent status (idle/working)

### Agent Management

**PUT /hosting/app/:id/agent/model**
Change AI model. Format is `provider/model` (short names like `"sonnet"` are rejected). See `GET /models` for the available list.
```bash
curl -X PUT https://vibekit.bot/api/v1/hosting/app/app_xyz/agent/model \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"model": "anthropic/claude-opus-4-6"}'
```

**POST /hosting/app/:id/agent/restart**
Restart agent gateway

**POST /hosting/app/:id/agent/reset**
Full agent reset (new session)

**GET /hosting/app/:id/agent/status**
Full agent status (context, model, app info)

### File Operations

**GET /hosting/app/:id/agent/files**
List files in agent workspace

**GET /hosting/app/:id/agent/file**
Read file (add ?path=app/index.html)

**PUT /hosting/app/:id/agent/file**
Write file
```bash
curl -X PUT https://vibekit.bot/api/v1/hosting/app/app_xyz/agent/file \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"path": "app/config.js", "content": "module.exports = {...}"}'
```

**POST /hosting/app/:id/agent/upload**
Upload file to workspace (multipart or JSON)

## Database

Managed PostgreSQL with an isolated schema per app. `DATABASE_URL` is injected into the container automatically.

**POST /hosting/app/:id/database**
Enable database
```bash
curl -X POST https://vibekit.bot/api/v1/hosting/app/app_xyz/database \
  -H "Authorization: Bearer vk_xxx"
# Response: {"success": true, "schema": "app_8b0eb119"}
# DATABASE_URL auto-injected on next deploy
```

**GET /hosting/app/:id/database**
Database stats (tables, storage, connections)

**GET /hosting/app/:id/database/export**
Download SQL dump

**DELETE /hosting/app/:id/database**
Remove database (destructive)

## Domains & SSL

**POST /hosting/app/:id/domain**
Add custom domain

**POST /hosting/app/:id/domain/buy**
Buy a domain and attach it to the app

**DELETE /hosting/app/:id/domain**
Remove domain

**POST /hosting/app/:id/domain/ssl**
Provision SSL certificate

**GET /hosting/domains/search**
Search available domains (add ?q=myapp)

## Webhooks

Connect external services to trigger your app's AI agent automatically.

**POST /hosting/app/:id/webhooks**
Create webhook
```bash
curl -X POST https://vibekit.bot/api/v1/hosting/app/app_xyz/webhooks \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "slug": "github-issues",
    "prompt_template": "GitHub issue opened:\n{{payload}}\nAnalyze and fix if possible.",
    "filters": {"action": "opened"}
  }'
# Response: {"hook_token": "abc123", "url": "https://vibekit.bot/hook/abc123"}
```

**POST /hook/:hookToken**
Trigger webhook (external services POST here)

**GET /hosting/app/:id/webhooks**
List webhooks

**GET /hosting/app/:id/webhooks/:whId/triggers**
Recent trigger log

## QA Testing

AI-powered testing with browser automation and annotated screenshots.

**POST /hosting/app/:id/qa**
Start QA test run

**GET /hosting/app/:id/qa**
Check status + get results

**GET /hosting/app/:id/qa/history**
Past QA runs with summaries

## Worktrees

Git branch isolation for safe development.

**POST /hosting/app/:id/worktree/create**
Create worktree
```bash
curl -X POST https://vibekit.bot/api/v1/hosting/app/app_xyz/worktree/create \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"taskId": "fix-auth"}'
```

**POST /hosting/app/:id/worktree/merge**
Merge worktree back to main

**GET /hosting/app/:id/worktrees**
List active worktrees

## Auth & Account

### Account Management

**GET /account**
Plan, credits, usage, API key status

**GET /account/usage**
Credit usage history with daily breakdown

**POST /checkout**
Stripe checkout URL
```bash
curl -X POST https://vibekit.bot/api/v1/checkout \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"product": "pro"}'
```

### AI Provider Keys (BYOK)

**PUT /account/claude-key**
Save Anthropic key
```bash
curl -X PUT https://vibekit.bot/api/v1/account/claude-key \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"claudeKey": "sk-ant-api03-xxx"}'
```

**PUT /account/openai-key**
Save OpenAI key

**PUT /account/preferred-provider**
Switch provider
```bash
curl -X PUT https://vibekit.bot/api/v1/account/preferred-provider \
  -H "Authorization: Bearer vk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"provider": "anthropic"}'
```

## Billing

### Plans & Pricing

| Plan | Price | Sessions/mo | Apps | Memory | Workspace disk | Custom domains | Overage |
|------|-------|-------------|------|--------|----------------|----------------|---------|
| Free | $0 | 10 | 1 | 512MB | 1.5GB | — | $0.50/session |
| Builder | $19.99/mo | 50 | 3 | 512MB | 3GB | 1 | $0.35/session |
| Pro | $49.99/mo | 200 | 10 | 1GB | 10GB | Unlimited | $0.25/session |

**BYOK = $0 AI cost + unlimited sessions.** Bring your own Anthropic or OpenAI key and you pay your provider directly. VibeKit takes no markup on inference, and **BYOK turns don't count against your monthly session cap**. Platform compute (number of apps, extra memory, and 24/7 always-on containers) is metered separately by the per-plan app limits and the Boost / Always-on add-ons, not by sessions.

**Add-ons:** Boost (1GB RAM + 0.5 vCPU per app, $8/mo), Always-on (no cold starts per app, $14.99/mo), Database (managed Postgres per app, $3/mo).

## Integration Examples

### OpenClaw Agent
```yaml
# In TOOLS.md or skills
- name: vibekit
  api: https://vibekit.bot/api/v1
  auth: Bearer vk_xxx
```

### MCP (Model Context Protocol)
```bash
npm install -g vibekit-mcp
```
```json
{"mcpServers": {"vibekit": {"command": "vibekit-mcp", "env": {"VIBEKIT_API_KEY": "vk_xxx"}}}}
```

### Direct API
```python
import requests
headers = {"Authorization": "Bearer vk_xxx"}
response = requests.post("https://vibekit.bot/api/v1/hosting/deploy", 
                        json={"repo": "owner/repo"}, headers=headers)
```

---

## Additional Endpoints

### App Management (continued)

`POST /hosting/app/:id/rename` — Rename subdomain. Body: `{"subdomain": "new-name"}`

`GET /hosting/app/:id/infra` — Infrastructure topology (container, agent, DB status)

`GET /hosting/app/:id/stats` — Container CPU/memory/network stats

`GET /hosting/app/:id/deploy-progress` — SSE stream of deploy progress

`POST /hosting/app/:id/live-reload` — Trigger live reload in connected browsers

`GET /hosting/app/:id/always-on` — Check always-on status + user plan

`PUT /hosting/app/:id/always-on` — Toggle always-on. Body: `{"alwaysOn": true}`

`POST /hosting/app/:id/always-on/checkout` — Stripe checkout for always-on addon ($14.99/mo per app)

`GET /hosting/app/:id/notifications/prefs` — Get notification preferences

`POST /hosting/app/:id/notifications/prefs` — Update notification preferences

`GET /hosting/app/:id/notifications/read` — Get unread count

`POST /hosting/app/:id/notifications/read` — Mark notifications as read

`POST /hosting/app/:id/stop` — Stop the container (keeps the app, frees compute)

`POST /hosting/app/:id/start` — Start a stopped container

`GET /hosting/apps/task-status` — Poll deploy/create task status for your apps

`GET /hosting/app/:id/stats/history` — Historical CPU/memory/network time series

`POST /hosting/app/:id/deploy-workspace` — Deploy the current agent workspace (uncommitted edits) without a GitHub push

`GET /hosting/app/:id/deploy-workspace/jobs/:jobId` — Status of a workspace-deploy job

`GET /hosting/app/:id/pending-changes` — Uncommitted / undeployed workspace changes

`PUT /hosting/app/:id/repo/visibility` — Toggle the app's GitHub repo public/private. Body: `{"visibility": "private"}`

### Deploy History & Rollback

`GET /hosting/app/:id/deploys` — List deploy history with timestamps, commit info

`POST /hosting/app/:id/deploys/:deployId/rollback` — Rollback to a specific deploy snapshot (max 10 snapshots per app)

### Collaborators

Only the app owner can invite/remove/change roles.

`GET /hosting/app/:id/collaborators` — List all collaborators

`POST /hosting/app/:id/collaborators` — Invite. Body: `{"email": "...", "role": "editor"}`

`PATCH /hosting/app/:id/collaborators/:collabId` — Change role. Body: `{"role": "viewer"}`

`DELETE /hosting/app/:id/collaborators/:collabId` — Remove collaborator

`POST /hosting/collaborators/accept` — Accept invite. Body: `{"token": "..."}`

Roles: `owner`, `editor` (can use agent, edit files), `viewer` (read-only)

`GET /hosting/shared-apps` — List apps shared with you as a collaborator

### AI Agent (continued)

`POST /hosting/app/:id/agent/upload` — Upload file to workspace (multipart `file` field or JSON `{filename, content}`)

`POST /hosting/app/:id/agent/tts` — Text-to-speech. Body: `{"text": "...", "voice": "alloy"}`

`GET /hosting/app/:id/agent/character` — Get agent character config

`PUT /hosting/app/:id/agent/character` — Set character. Body: `{"species": 1, "palette": 0, "color": "#a78bfa"}`

`GET /hosting/app/:id/agent/avatar` — Get agent avatar (base64)

`PUT /hosting/app/:id/agent/avatar` — Set agent avatar (base64, max 500KB)

`POST /hosting/app/:id/agent/compact` — Compact agent context (summarize old history)

`POST /hosting/app/:id/agent/clear-memory` — Reset agent memory (deletes MEMORY.md and daily logs)

`POST /hosting/app/:id/agent/clear-sessions` — Clear all session history (preserves memory)

`GET /hosting/app/:id/agent/roles` — List defined agent roles

`PUT /hosting/app/:id/agent/roles/:roleName` — Create/update a role

`GET /hosting/app/:id/agent/roles/:roleName/history` — Role execution history

`DELETE /hosting/app/:id/agent/roles/:roleName` — Delete role

`GET /hosting/app/:id/agent/subagents` — List active sub-agents

`GET /hosting/app/:id/agent/features` — Get automation feature flags

`PUT /hosting/app/:id/agent/features` — Update features. Body: `{"features": {"qaValidation": true}}`

Allowed keys: `qaValidation`, `worktrees`, `autoMerge`

`GET /hosting/app/:id/agent/config` — Get agent config (system prompt, tools, settings)

`POST /hosting/app/:id/agent/config` — Update agent config

`GET /hosting/app/:id/agent/context` — Current context-window usage + token breakdown

`POST /hosting/app/:id/agent/warmup` — Pre-warm the agent gateway (reduce first-message latency)

`POST /hosting/app/:id/agent/stop` — Interrupt the agent's current turn

`DELETE /hosting/app/:id/agent/messages` — Delete chat messages

`GET /hosting/app/:id/agent/live-activity` — Live tool-call / streaming activity

`GET /hosting/app/:id/agent/models` — Models available to this app's agent

`POST /hosting/app/:id/agent/update-openclaw` — Update the agent's OpenClaw gateway version

`GET /hosting/app/:id/agent/preview` — Preview proposed changes before applying

`GET /hosting/app/:id/agent/changes` — Diff of pending agent file changes

`GET /hosting/app/:id/agent/export` — Export agent (memory, sessions, config) for transfer

`POST /hosting/app/:id/agent/import` — Import a previously exported agent into this app

### Per-App Usage

`GET /hosting/app/:id/usage?days=30` — Token cost tracking by model and day (max 90 days)

### Account (continued)

`GET /models` — List available AI models

`PUT /repos/active` — Set active repo. Body: `{"repo": "owner/name"}`

`PUT /account/profile` — Update display name. Body: `{"name": "..."}`

`PUT /account/avatar` — Upload profile avatar (base64)

`DELETE /account/avatar` — Remove profile avatar

`POST /checkout` Products: `builder` ($19.99/mo), `pro` ($49.99/mo), `topup_<dollars>` packs (`topup_5`, `topup_10`, `topup_15`, `topup_20`, `topup_25`, `topup_50`, `topup_75`, `topup_100`), `container_1gb` (Boost), `database_addon` (Database). (Always-on is billed via its own endpoint `POST /hosting/app/:id/always-on/checkout`, not `/checkout`.)

`GET /account/providers` — BYOK provider status (which keys are connected, preferred provider)

`GET /account/preferences` — Get account preferences

`PUT /account/preferences` — Update account preferences

`PUT /account/email-notifications` — Toggle email notifications. Body: `{"enabled": true}`

`POST /account/api-key/rotate` — Rotate your `vk_` API key

`POST /account/subscription/cancel` — Cancel your active subscription

`GET /account/referral` — Your referral code + stats

`POST /account/referral/apply` — Apply a referral code. Body: `{"code": "ref_xxx"}`

`GET /account/github` — Connected GitHub account info

`GET /account/github/profile` — GitHub profile details

`GET /account/github/connect` — Start GitHub OAuth connect (browser redirect)

`DELETE /account/github` — Disconnect GitHub

### Two-Factor Auth (2FA)

`GET /account/2fa/status` — Whether 2FA is enabled

`POST /account/2fa/setup` — Begin TOTP setup (returns secret + QR)

`POST /account/2fa/enable` — Confirm and enable 2FA. Body: `{"code": "123456"}`

`POST /account/2fa/verify` — Verify a 2FA code. Body: `{"code": "123456"}`

`POST /account/2fa/disable` — Disable 2FA. Body: `{"code": "123456"}`

### Billing (continued)

`GET /plans` — List plans with prices, session caps, app/memory/domain limits

`POST /billing/portal` — Stripe customer billing-portal URL

`POST /credits` — Create a credits-purchase checkout session. Body: `{"package": "sessions_10|sessions_30|sessions_100"}`

### Projects

`GET /project/:id` — Project details

`GET /project/:id/domains` — List project domains

`POST /project/:id/domain` — Attach a custom domain. Body: `{"domain": "example.com"}`

`DELETE /project/:id/domain/:domain` — Remove a project domain

### Push Notifications (PWA)

`GET /push/vapid-key` — Get VAPID public key

`POST /push/subscribe` — Register push subscription

`POST /push/unsubscribe` — Remove subscription

`GET /push/preferences` — Notification channel preferences

`PUT /push/preferences` — Update preferences

`POST /push/test` — Send test notification

`POST /push/register-device` — Register a native device token

`POST /push/unregister-device` — Remove a native device token

`POST /push/opened` — Report a push notification was opened

### Email API

Send transactional emails from your app. Each app sends from `{subdomain}@vibekit.bot`.

`POST /hosting/app/:id/email/send` — Send email. Body:
```json
{
  "to": "user@example.com",
  "subject": "Welcome!",
  "html": "<h1>Welcome</h1>",
  "text": "Welcome!",
  "replyTo": "support@example.com"
}
```

`to` supports comma-separated (max 10). Daily limits: Free 10, Builder 200, Pro 1000.

`GET /hosting/app/:id/email/quota` — Check usage and daily limit

### Payments API (Stripe Connect)

`GET /hosting/app/:id/payments/connect` — Get Stripe OAuth URL

`DELETE /hosting/app/:id/payments/connect` — Disconnect Stripe

`GET /hosting/app/:id/payments/status` — Connection status

`POST /hosting/app/:id/payments/checkout` — Create checkout session. Body:
```json
{
  "mode": "payment",
  "line_items": [{"price": "price_XXX", "quantity": 1}],
  "success_url": "https://myapp.vibekit.bot/success?session_id={CHECKOUT_SESSION_ID}",
  "cancel_url": "https://myapp.vibekit.bot/pricing"
}
```

`POST /hosting/app/:id/payments/portal` — Customer billing portal. Body: `{"customer_id": "cus_XXX", "return_url": "..."}`

`GET /hosting/app/:id/payments/products` — List products from connected Stripe account

Stripe events auto-forwarded to `POST /api/stripe/webhook` with `X-VibeKit-Stripe-Event` header.

---

### Database (continued)

`GET /hosting/app/:id/database/schema` — Full schema (tables, columns, types)

`GET /hosting/app/:id/database/tables/:table` — Browse rows. Query: `?limit=50&offset=0&orderBy=col&orderDir=desc`

`POST /hosting/app/:id/database/query` — Run a read-only SQL query. Body: `{"sql": "SELECT ..."}`

### QA Testing (continued)

`GET /hosting/app/:id/qa/history/:runId` — Full results for one QA run

`GET /hosting/app/:id/qa/history/:runId/screenshots/:filename` — Annotated screenshot from a past run

`GET /hosting/app/:id/qa/screenshots/:filename` — Screenshot from the latest run

### Worktrees (continued)

`POST /hosting/app/:id/worktree/cleanup` — Remove stale / merged worktrees

### Schedules

Recurring agent tasks per app (cron-driven).

`GET /hosting/app/:id/schedules` — List the app's scheduled agent tasks

`POST /hosting/app/:id/schedules` — Create a schedule. Body: `{"name", "message", "schedule"}` (cron expression)

`PATCH /hosting/app/:id/schedules/:jobId` — Update a schedule. Body: `{"enabled", "name", "message", "schedule"}`

`DELETE /hosting/app/:id/schedules/:jobId` — Delete a schedule

`GET /hosting/app/:id/schedules/insights` — Schedule run summary / insights

`GET /hosting/app/:id/schedules/:jobId/runs` — Execution history for one schedule

### Analytics & Ideation

`GET /hosting/app/:id/analytics` — App traffic / usage analytics. Query: `?days=30` (max 90)

`POST /hosting/app/:id/ideation` — Generate feature/improvement ideas for the app. Body: `{"category", "deep": false}`

### Webhooks (continued)

`POST /hosting/app/:id/webhooks/:webhookId/rotate-secret` — Rotate a webhook's signing secret

### Tasks & Templates

`POST /template-deploy` — Deploy directly from a template. Body: `{"template", "subdomain"}`

`GET /apps` — List apps created via the task/deploy API

### Public (no auth)

`GET /gallery` — Public gallery of published apps

`POST /feedback` — Submit feedback. Body: `{"message", "email?", "source?"}`

`POST /switchback/route` — Hosted cascade-router model classifier (charges $0.001/call against credits). Body: `{"userMessage", "ladder?", "recentHistory?"}` → `{recommended_model, tier, classifier}`

## Links

- **Dashboard:** https://app.vibekit.bot
- **CLI:** `npm install -g vibekit-cli`
- **MCP:** `npm install -g vibekit-mcp`