> ## Documentation Index
> Fetch the complete documentation index at: https://getfloo.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Host an internal tool built with AI

> Deploy an agent-built internal tool on floo with invite-only team sign-in, admin and member app roles, managed Postgres, and a scoped app API key so an agent can call the same app.

The example is a discount-approval queue: sales reps submit requests, finance approves them, and an agent reads the queue each morning. floo puts invite-only sign-in in front of the UI, tells the app each user's role, stores the requests in Postgres, and admits the agent on one route with a scoped app API key.

Requires the tool's source in a GitHub repository with a `Dockerfile` that serves on `0.0.0.0:$PORT`. The examples use FastAPI on port 8000; any stack reads the same headers.

## Set up your agent

```bash theme={null}
curl -fsSL https://getfloo.com/install.sh | bash
floo auth login
```

For Claude Code, also run `floo skills install --path .claude/skills/floo`. Other agents: [Agent setup](https://getfloo.com/docs/guides/agent-setup.md).

## Agent prompt

Paste into your agent. Replace `discount-approvals` with your app name.

```text theme={null}
Deploy this internal tool to floo with App sign-in, app roles, and Postgres. App name: discount-approvals.
1. Confirm the floo org with `floo orgs list`. If the org has no plan, have me run `floo billing upgrade`.
2. Run `floo init discount-approvals`. In floo.app.toml, set access_mode = "accounts" under [app], set port 8000 on [services.web], and add [managed.default] with type = "postgres".
3. Add a [[routes]] table: "/" to service web with access "accounts", and "/api/agent" to service web with access "api_key" and scope "approvals.read".
4. Read the signed-in user from the X-Floo-User-Email and X-Floo-User-Role headers. Only role "admin" may approve. Do not add a login page, password table, or session store.
5. Serve GET /api/agent/pending, returning pending requests as JSON. Read DATABASE_URL from the environment.
6. Run `floo preflight --json` and fix every error.
7. Commit and push to the default branch.
8. Have me open https://github.com/apps/getfloo/installations/new, choose the repository's owner, and select this repository. Wait for me to confirm.
9. Run `floo apps github setup --no-browser` and give me the printed link. Wait for me to confirm GitHub access.
10. Run `floo apps github connect <owner>/<repo> --no-browser`.
11. Run `floo deploys status --app discount-approvals --json` until the deploy is live, then report the URL.
```

## floo.app.toml

```toml floo.app.toml theme={null}
[app]
name = "discount-approvals"
access_mode = "accounts"

[services.web]
type = "web"
path = "."
port = 8000
ingress = "public"

[managed.default]
type = "postgres"

[[routes]]
path = "/"
service = "web"
access = "accounts"

[[routes]]
path = "/api/agent"
service = "web"
access = "api_key"
scope = "approvals.read"
```

Every path goes through App sign-in except `/api/agent`, which accepts only an app API key holding the `approvals.read` scope. floo strips the key before forwarding the request. Sign-in is invite-only: nobody gets in by email domain or self-signup.

## Check the role in code

The gateway sends `X-Floo-User-Role` as `member` or `admin` on every signed-in request:

```python app/auth.py theme={null}
from typing import Annotated

from fastapi import Header, HTTPException, status


def require_admin(
    role: Annotated[str | None, Header(alias="X-Floo-User-Role")] = None,
) -> None:
    if role != "admin":
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
```

Add `Depends(require_admin)` to the approve route. Reps get `member`; finance gets `admin`.

## CLI commands

The same deploy by hand. Replace `owner/discount-approvals` with your repository.

```bash theme={null}
floo init discount-approvals
floo preflight
git add . && git commit -m "feat: deploy discount approvals to floo"
git push origin main
floo apps github setup
floo apps github connect owner/discount-approvals
floo deploys watch --app discount-approvals
```

`floo apps github setup` needs the floo GitHub App installed on the repository's owner first. See [Quickstart steps 2 and 3](https://getfloo.com/docs/introduction.md#2-give-floo-access-to-your-github-repository).

Invite the team. App users do not use builder seats and get no access to floo itself:

```bash theme={null}
floo apps invite rep@example.com --role member --app discount-approvals
floo apps invite finance@example.com --role admin --app discount-approvals
```

Give the agent a key for `/api/agent`:

```bash theme={null}
floo apps consumers create morning-agent --app discount-approvals
floo apps keys create morning-agent --consumer morning-agent --scope approvals.read --app discount-approvals
```

The raw key prints once. Store it in the agent's secret store as `APPROVALS_KEY`; never paste it into a prompt or commit it.

## Verify

```bash theme={null}
floo deploys status --app discount-approvals --json
floo apps members --app discount-approvals
curl -H "Authorization: Bearer $APPROVALS_KEY" https://discount-approvals-dev.getfloo.app/api/agent/pending
```

Opening `https://discount-approvals-dev.getfloo.app` in a private window shows floo's sign-in page. `apps members` lists each accepted invitee with their role. The `curl` returns the pending requests; without the header it returns 401.

Every push to `main` deploys to dev, which has its own database. To publish to prod, run `gh release create v1 --repo <owner>/<repo>`. See [Environments](https://getfloo.com/docs/guides/environments.md#the-flow).

## Next steps

> **[App sign-in](https://getfloo.com/docs/guides/app-auth.md)**
>
> Identity headers, sign-out, sign-in policy, and revoking a member.

> **[App API keys](https://getfloo.com/docs/guides/app-api-keys.md)**
>
> Consumers, scopes, rate limits, request history, and revocation.

> **[Postgres](https://getfloo.com/docs/guides/postgres.md)**
>
> Injected variables, pgvector, preview branches, and migrations across dev and prod.

> **[Preview environments](https://getfloo.com/docs/guides/preview-environments.md)**
>
> Review an agent's change on an isolated copy before it reaches the team.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.