Host an internal tool built with AI

The example is a discount-approval queue: sales reps submit requests, finance approves them, and an agent reads the queue each morning. floo puts invite-only sign-in in front of the UI, tells the app each user’s role, stores the requests in Postgres, and admits the agent on one route with a scoped app API key. Requires the tool’s source in a GitHub repository with a Dockerfile that serves on 0.0.0.0:$PORT. The examples use FastAPI on port 8000; any stack reads the same headers.

Set up your agent

curl -fsSL https://getfloo.com/install.sh | bash
floo auth login

For Claude Code, also run floo skills install --path .claude/skills/floo. Other agents: Agent setup.

Agent prompt

Paste into your agent. Replace discount-approvals with your app name.

Deploy this internal tool to floo with App sign-in, app roles, and Postgres. App name: discount-approvals.
Confirm the floo org with `floo orgs list`. If the org has no plan, have me run `floo billing upgrade`.
Run `floo init discount-approvals`. In floo.app.toml, set access_mode = "accounts" under [app], set port 8000 on [services.web], and add [managed.default] with type = "postgres".
Add a [[routes]] table: "/" to service web with access "accounts", and "/api/agent" to service web with access "api_key" and scope "approvals.read".
Read the signed-in user from the X-Floo-User-Email and X-Floo-User-Role headers. Only role "admin" may approve. Do not add a login page, password table, or session store.
Serve GET /api/agent/pending, returning pending requests as JSON. Read DATABASE_URL from the environment.
Run `floo preflight --json` and fix every error.
Commit and push to the default branch.
Have me open https://github.com/apps/getfloo/installations/new, choose the repository's owner, and select this repository. Wait for me to confirm.
Run `floo apps github setup --no-browser` and give me the printed link. Wait for me to confirm GitHub access.
Run `floo apps github connect <owner>/<repo> --no-browser`.
Run `floo deploys status --app discount-approvals --json` until the deploy is live, then report the URL.

floo.app.toml

[app]
name = "discount-approvals"
access_mode = "accounts"

[services.web]
type = "web"
path = "."
port = 8000
ingress = "public"

[managed.default]
type = "postgres"

[[routes]]
path = "/"
service = "web"
access = "accounts"

[[routes]]
path = "/api/agent"
service = "web"
access = "api_key"
scope = "approvals.read"

Every path goes through App sign-in except /api/agent, which accepts only an app API key holding the approvals.read scope. floo strips the key before forwarding the request. Sign-in is invite-only: nobody gets in by email domain or self-signup.

Check the role in code

The gateway sends X-Floo-User-Role as member or admin on every signed-in request:

app/auth.py

from typing import Annotated

from fastapi import Header, HTTPException, status


def require_admin(
    role: Annotated[str | None, Header(alias="X-Floo-User-Role")] = None,
) -> None:
    if role != "admin":
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)

Add Depends(require_admin) to the approve route. Reps get member; finance gets admin.

CLI commands

The same deploy by hand. Replace owner/discount-approvals with your repository.

floo init discount-approvals
floo preflight
git add . && git commit -m "feat: deploy discount approvals to floo"
git push origin main
floo apps github setup
floo apps github connect owner/discount-approvals
floo deploys watch --app discount-approvals

floo apps github setup needs the floo GitHub App installed on the repository’s owner first. See Quickstart steps 2 and 3. Invite the team. App users do not use builder seats and get no access to floo itself:

floo apps invite rep@example.com --role member --app discount-approvals
floo apps invite finance@example.com --role admin --app discount-approvals

Give the agent a key for /api/agent:

floo apps consumers create morning-agent --app discount-approvals
floo apps keys create morning-agent --consumer morning-agent --scope approvals.read --app discount-approvals

The raw key prints once. Store it in the agent’s secret store as APPROVALS_KEY; never paste it into a prompt or commit it.

Verify

floo deploys status --app discount-approvals --json
floo apps members --app discount-approvals
curl -H "Authorization: Bearer $APPROVALS_KEY" https://discount-approvals-dev.getfloo.app/api/agent/pending

Opening https://discount-approvals-dev.getfloo.app in a private window shows floo’s sign-in page. apps members lists each accepted invitee with their role. The curl returns the pending requests; without the header it returns 401. Every push to main deploys to dev, which has its own database. To publish to prod, run gh release create v1 --repo <owner>/<repo>. See Environments.

Next steps

App sign-in

Identity headers, sign-out, sign-in policy, and revoking a member.

App API keys

Consumers, scopes, rate limits, request history, and revocation.

Postgres

Injected variables, pgvector, preview branches, and migrations across dev and prod.

Preview environments

Review an agent’s change on an isolated copy before it reaches the team.

Get started

Build with your stack

Deploy from your agent

Configure your app

Ship and release

Data

Domains and networking

App users and access

Operate

Team and billing

For agents

Host an internal tool built with AI

Set up your agent

Agent prompt

floo.app.toml

Check the role in code

CLI commands

Verify

Next steps

App sign-in

App API keys

Postgres

Preview environments

​Set up your agent

​Agent prompt

​floo.app.toml

​Check the role in code

​CLI commands

​Verify

​Next steps

App sign-in

App API keys

Postgres

Preview environments

Set up your agent

Agent prompt

floo.app.toml

Check the role in code

CLI commands

Verify

Next steps