https://<app>-dev.getfloo.app with managed Postgres and sign-in for your team. floo signs people in at its gateway and tells your code who they are in a request header, so the backend has no auth code, and the browser never talks to the database.
Agent prompt
Paste into Claude Code, Codex, Cursor, or any agent that can run shell commands. Replaceorders-api with your app name.
The files
server.js
floo.app.toml
node:22-slim one in the Express guide. migrate_command runs with the new image before traffic moves to it; a failed migration stops the deploy and the previous version keeps serving. The examples use ESM, so package.json needs "type": "module".
Deploy
Why there are no row-level security policies
Backends that let the browser query the database need a correct row-level security policy on every table, or the data is readable with the public key. Here the browser only talks to your Express routes, every request passes floo’s gateway first, and only your server holdsDATABASE_URL. Who can see which rows is the where created_by = $1 in your own code, which your agent can test and you can review.
Let an agent call the API
To let a script or another agent call/api/* without a browser session, declare which routes accept keys and create a key for it. It is scoped, rate-limited, and revocable on its own. See App API keys.
Verify
401 or a redirect to sign-in from curl means the app is up and sign-in is working. Invite people with floo apps invite <email> --app orders-api.
Next steps
Build an Express app
Dockerfile, storage, custom domain, and local dev with real credentials.
Postgres
Injected variables, pgvector, preview branches, and migrations.
Cron jobs
Run a script on a schedule in the same image.
floo deploy
Every flag and error code.