Everything coding agents need to launch your next app.

---
name: launchbase
description: Create, configure and deploy applications on Launchbase through its MCP or HTTP API. Use when the user asks to build or operate a Launchbase app.
---

# Launchbase

Read https://launchbase.build/agent.md before your first operation. Fetch https://launchbase.build/api/v1/guide for the current deployment contract and https://launchbase.build/api/v1/catalog for capabilities and plans.

## Connect
Reuse an existing credential when available. Otherwise POST https://launchbase.build/api/v1/agent/connect with agentName and a short description. Show the owner the returned verificationUrl. Use the bounded connection helper at https://launchbase.build/agent-connect.mjs: save the connect response to a private file outside the repository, download the helper, then run node agent-connect.mjs <request-file> <new-credential-file>. Exit 0 means connected: stop polling, load the saved credential privately and continue the original task immediately. Exit 2 means still pending: repeat the same command. Never start a long fixed sleep or wait for the owner to send another chat message. For your own poller, read response.data.status and response.data.token (not top-level status/token), exit immediately on approved, and stop on denied, expired or redeemed. Do not print credentials in shell output. Store the approved credential securely, never in source or chat. MCP endpoint: https://launchbase.build/mcp; HTTP base: https://launchbase.build/api/v1.

## Files and background tasks
Store end-user uploads and generated documents in Launchbase Files, never permanently beside the app code. The container filesystem is only for bundled assets and temporary processing. Keep file IDs, ownership and metadata in the database. Create via upload/finalize; list from the user's database records; read via authorised download links; update by uploading a replacement and switching the database reference; delete via the file API. Authenticate and check ownership on every operation; test isolation with two users.
Read https://launchbase.build/docs/files-tasks.md when an app needs uploads, workers or schedules. Enable private file storage, then configure_app_runtime and redeploy. Keep LB_RUNTIME_TOKEN server-only; the app backend must check its users' file ownership. File capacity is separate from Database and upgrades apply to the whole app. Use deploy_task with a verified sourceId and startCommand; omit schedule for a worker or add a UTC cron schedule. Tasks share Hosting capacity and stop with the app. A running worker is not a durable queue: implement leases, retries and idempotent jobs in the app database.

## Customer billing
Read https://launchbase.build/docs/payments.md and get_payment_guide before adding payments. Enable managed Payments, use manage_app_payments for test/live onboarding, plans and billing operations. Agents can create test accounts; only the owner activates live payments with Stripe. configure_app_runtime injects a server-only app token: the backend calls /runtime/v1/payments/{action} and derives customerRef from its verified session. Build your own billing UI with Checkout/Elements; no Stripe secret key is needed. Persist requestId values; confirm paid changes/refunds before executing. Use access.get for paid features and poll customer events; test two-user isolation, failed payments and cancellation. BYOK bypasses managed billing and owns its Stripe webhooks/access logic.

## CDN
Read https://launchbase.build/docs/cdn.md before configure_cdn. Optional CDN is included only with active paid app plans. HTML remains uncached. Send Cache-Control: private, no-store on personalised responses and private file routes: cookies alone do not prevent caching. Successful deployments clear cached assets; purge_cdn clears them manually.

## Recovery
Read https://launchbase.build/docs/recovery.md. restore_release rolls back code only, using current variables; it does not undo SQL or files. get_recovery lists real backups and the recoverable time window. Agents can execute restore_database directly with acknowledgeDataLoss:true and a stable requestId: Grow/Scale for backups, Scale plus the optional $129/month add-on for point-in-time. Use configure_recovery_addon to obtain an owner approval URL; never assume the Scale plan alone enables PITR. Explain that newer database/auth changes are replaced; app hosting pauses during recovery. Poll jobId, never replay an uncertain restore, then test login, permissions and data. Files and external payments are not rolled back.

## Concurrent trials and pause/resume
One concurrent trial is allowed without a verified card; three with one. A testing_limit response includes active, limit and actionRequired. If verify_card is required, open or give the owner the supplied card URL; never enter card details yourself. Alternatively ask which running trial to pause. At three trials, use pause_trial (or POST /api/v1/apps/{id}/billing/trial/pause) after the user chooses the app. It goes offline. Poll the returned job until succeeded before retrying start_trial. Failed or incomplete pauses do not free a slot. Resume with resume_trial (or POST /api/v1/apps/{id}/billing/trial/resume). Resuming reserves a slot; the original trialEndsAt is immutable and the clock continues while paused. Expired trials require an owner-approved paid plan. Never create a replacement app to bypass a deadline. Snapshots are retained for 30 days after the original deadline. Unsupported snapshot data can block pause safely; explain the returned error and contact support, never delete the database yourself.

## Free example apps
Download https://launchbase.build/demos/nextjs.tar.gz or https://launchbase.build/demos/python.tar.gz for the same complete client portal in either language. Each includes AGENTS.md, human instructions, schema.sql and a ready-to-copy prompt. Source is MIT licensed; hosting uses the available trial and paid plans. Follow the included runtime setup instructions instead of deploying an agent management token.

## Build and deploy
1. List apps and select the intended app with switch_app. Switching needs no owner approval. Create a new app only when the user's task calls for it. Read its agentPolicy and enabled services.
2. For a new Next.js app, use https://launchbase.build/starter.tar.gz and create it with config.start = "starter" to provision the starter schema. Other stacks are supported: follow the deployment guide and detected profile. Do not overwrite an existing app with the starter.
3. Use only app runtime variables. Never include Launchbase credentials, provider master keys, .env files or customer data in an upload. Implement and verify row-level security for every user-owned table.
4. Read https://launchbase.build/docs/deploy.md. Download https://launchbase.build/launchbase.mjs outside the app folder; run node launchbase.mjs deploy ./my-app --app APP_ID with LAUNCHBASE_TOKEN privately or --credential-file FILE saved by agent-connect.mjs. Do not turn a codebase into a JSON files map. The helper packages real bytes, validates, uploads and follows the release. Exit 2 means still pending: repeat the same command without waiting for another user message. Exit 1 prints errors and paginated build/runtime logs: fix the cause and rerun. Unchanged source resumes; changed source creates a new release. Verify the public URL and app behaviour before reporting success.
5. After a successful deployment, capture the public landing page without customer data and use set_app_preview for its dashboard card.

## Owner boundaries
The owner approves the initial connection. App/service removal requires a separate owner confirmation, or is blocked by the app's policy. Agents cannot change that policy or grant themselves permissions. Database migrations remain permitted by database:write, including destructive SQL: preserve user data and follow the user's intent. A blocked service removal must not be bypassed by wiping its database.

Rename an app with rename_app {appId, name} or PATCH /api/v1/apps/{id}/name {name}. This changes its display name only; its URL and services stay unchanged.

For domain purchases, call authorize_domain_purchase with the app ID and chosen domain. Open the returned owner URL in a browser if available, otherwise give the URL to the user. A missing card returns card_required and a Launchbase card-setup link that returns to the selected domain. Never enter card details or approve a purchase for the owner.

REST reference: https://launchbase.build/docs/api. Machine-readable endpoint catalogue: https://launchbase.build/api/v1/openapi.json. Tokens can be created and managed by the owner at https://launchbase.build/account/tokens. Public service health: https://launchbase.build/status.json.

Existing credential restrictions still apply. Payments, domain purchases and provider onboarding may return owner-required actions; show the supplied instructions and wait. Follow server budget and authorization decisions. Never retry a denied action with a different identity or route.