The App Create API allows you to create and update AI-generated applications that are hosted on the Cloudflare Workers platform with dynamic subdomain routing.
POST https://vibes-diy-api.com/api/apps
Authentication is optional for this endpoint. You can provide a JWT token via the X-VIBES-Token header for enhanced functionality:
X-VIBES-Token: <your-jwt-token>
With Authentication:
- User email is attached to the app
- User context is available for the application
Without Authentication:
- App is still created successfully
userIdandemailfields will benull- All other functionality works normally
Content-Type: application/json
| Field | Type | Required | Description |
|---|---|---|---|
chatId |
string | ✓ | Unique identifier for the chat session (only required field) |
userId |
string | User identifier | |
code |
string | The application code to save (defaults to empty string) | |
raw |
string | Raw code before processing | |
prompt |
string | The prompt used to generate the app | |
title |
string | Display title for the app (defaults to "App {slug}") | |
screenshot |
string | null | Base64 encoded screenshot image | |
remixOf |
string | null | Slug of the original app if this is a remix | |
shareToFirehose |
boolean | Whether to post to Bluesky |
Minimal Request:
{
"chatId": "chat_abc123"
}Complete Request:
{
"chatId": "chat_abc123",
"userId": "user_456",
"code": "function App() { return <div>Hello World</div>; }",
"raw": "// Raw code here",
"prompt": "Create a hello world app",
"title": "My Hello World App",
"screenshot": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA...",
"remixOf": null,
"shareToFirehose": false
}cURL Example:
curl -X POST "https://vibes-diy-api.com/api/apps" \
-H "Content-Type: application/json" \
-H "X-VIBES-Token: your-jwt-token" \
-d '{"chatId": "my-app-123", "title": "My Test App"}'{
"success": true,
"app": {
"name": "app-1672531200000",
"slug": "mighty-wave-42",
"code": "function App() { return <div>Hello World</div>; }",
"raw": "// Raw code here",
"prompt": "Create a hello world app",
"title": "My Hello World App",
"templatedCode": null,
"chatId": "chat_abc123",
"userId": "user_456",
"email": "[email protected]",
"hasScreenshot": false,
"screenshotKey": null,
"remixOf": null,
"updateCount": 0,
"shareToFirehose": false
}
}When creating a new app (chatId doesn't exist):
- Generates a unique slug using the format
{adjective}-{noun}-{number} - Sets
updateCountto 0 - Stores the app in Cloudflare KV using both
chatIdandslugas keys - Processes and stores screenshots if provided
When updating an existing app (chatId exists):
- Updates the code, raw, and templatedCode fields
- Increments the
updateCount - Updates other fields only if provided in the request
- Maintains the original slug and creation metadata
If a screenshot is provided:
- Removes the data URL prefix if present
- Decodes base64 to binary data
- Stores in KV with key format:
{slug}-screenshot
After successful creation/update, an event is sent to the publish queue:
- Event type:
app_createdfor new apps,app_updatedfor updates - Includes full app data and metadata
- Used for downstream processing (Discord notifications, etc.)
Once created, apps are accessible at:
https://{slug}.vibesdiy.app- Live application- Apps are served through a templated HTML wrapper with React 19 and Tailwind CSS
The API will return appropriate HTTP status codes:
200- Success400- Bad Request (validation errors, malformed JSON)500- Internal Server Error
Note: Authentication errors do not return 401. Invalid or missing JWT tokens are ignored, and the request continues without user context.
If required fields are missing or invalid, you'll receive a 400 response:
{
"errors": [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": ["body", "chatId"],
"message": "Required"
}
],
"success": false,
"result": {}
}The API includes full CORS support:
Access-Control-Allow-Origin: *Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE,PATCH- OPTIONS preflight requests return 204
Rate limiting is handled at the Cloudflare Workers level. No authentication tier restrictions apply.
- Uses chanfana for OpenAPI schema validation with Zod
- Screenshot processing is optional and handled asynchronously
- Queue failures do not prevent app creation/update success
- Apps are double-indexed in KV storage (both
chatIdandslugas keys) - JWT authentication uses ES256 algorithm with base58btc-encoded JWK public keys
- Invalid authentication tokens are silently ignored (no error returned)
- Apps are immediately accessible after creation at
https://{slug}.vibesdiy.app
JWT Token Requirements (when provided):
- Header:
X-VIBES-Token - Algorithm: ES256
- Issuer:
FP_CLOUD - Audience:
PUBLIC - Must not be expired
Public Key Verification:
- Server uses
CLOUD_SESSION_TOKEN_PUBLIC_KEYenvironment variable - Fallback to
CLOUD_SESSION_TOKEN_PUBLIC_KEY_DEVfor development - Keys are base58btc-encoded JWK format