Skip to main content
An Express backend your agent wrote, live at https://<app>-dev.getfloo.app with managed Postgres and sign-in for your team. floo signs people in at its gateway and tells your code who they are in a request header, so the backend has no auth code, and the browser never talks to the database.

Agent prompt

Paste into Claude Code, Codex, Cursor, or any agent that can run shell commands. Replace orders-api with your app name.

The files

server.js
floo.app.toml
The Dockerfile is the two-stage node:22-slim one in the Express guide. migrate_command runs with the new image before traffic moves to it; a failed migration stops the deploy and the previous version keeps serving. The examples use ESM, so package.json needs "type": "module".

Deploy

The first run creates a floo-hosted project and its dev database. Later runs push the new commit. See Deploy without a GitHub repository for what each run does, or connect your own GitHub repository instead.

Why there are no row-level security policies

Backends that let the browser query the database need a correct row-level security policy on every table, or the data is readable with the public key. Here the browser only talks to your Express routes, every request passes floo’s gateway first, and only your server holds DATABASE_URL. Who can see which rows is the where created_by = $1 in your own code, which your agent can test and you can review.

Let an agent call the API

To let a script or another agent call /api/* without a browser session, declare which routes accept keys and create a key for it. It is scoped, rate-limited, and revocable on its own. See App API keys.

Verify

A 401 or a redirect to sign-in from curl means the app is up and sign-in is working. Invite people with floo apps invite <email> --app orders-api.

Next steps

Build an Express app

Dockerfile, storage, custom domain, and local dev with real credentials.

Postgres

Injected variables, pgvector, preview branches, and migrations.

Cron jobs

Run a script on a schedule in the same image.

floo deploy

Every flag and error code.