Cursor Live Apps Guide (2026): Build, Host and Share Web Apps From a Cloud Agent

Cursor just stopped being only a code editor. On 5 November 2026 it launched Live Apps: you ask a cloud agent for a web app, and Cursor writes it, adds a Postgres database and sign-in, hosts it, and hands you a shareable link.

It is aimed at internal tools: dashboards, sign-up forms, onboarding pages and the like. Nothing goes live until security checks pass and you press publish.

This guide covers which plan you need, the exact steps, sharing and API keys, admin controls, what it costs, how it compares with Replit, Lovable, v0 and Bolt, and the gaps Cursor has not explained yet.

What Are Cursor Live Apps?

Until now, Cursor agents wrote code and pushed a branch. Deploying it was your job, usually through Vercel, a cloud VM or a company platform.

Live Apps closes that gap. When you ask a cloud agent for an app, Cursor now handles four jobs for you:

• Code: it scaffolds the web app in a new or existing repo.
• Database: it provisions Postgres automatically if the app needs one.
• Sign-in: it puts the app behind Cursor SSO, so only allowed people get in.
• Hosting: it deploys to a dedicated, isolated hosting account for your team (or for you on an individual plan).

If the app needs your systems, such as a data warehouse, the agent asks for the secrets it needs. Cursor says the agent never sees the secret values.

Cursor’s own examples come from non-engineering teams: event registration tools, sales dashboards and onboarding pages built by sales, ops, legal and finance staff.

Which Cursor Plan Do You Need?

Live Apps runs on Cloud Agents only, not on the local desktop agent. So you need a plan that includes Cloud Agents. Prices below are from Cursor’s pricing page in November 2026.

Note: legacy paid plans with Cloud Agent access also qualify. On Teams and Enterprise, an admin can switch Apps off for the whole team.

Not sure Cursor is the right editor at all? Our Cursor vs Windsurf vs Claude Code vs Cline comparison covers prices, models and agent features side by side.

How to Build and Publish a Live App

First, update Cursor to the latest version. Then follow these steps:

1. Connect source control (once). A Cursor admin must connect GitHub before agents can work on existing repos. For a brand-new app you can start without a repo, and Cursor creates one on Cursor Origin.
2. Start a Cloud agent. In Cursor Desktop pick Cloud in the dropdown under the agent box. You can also use cursor.com/agents in any browser, the iOS app, Slack (@cursor) or Linear.
3. Set a spend limit. The first time you use Cloud Agents, Cursor asks you to set one. Pick something sensible, such as $20, while you test.
4. Ask for an app, explicitly. Say “build an app” and describe it. Example: “Build an app where my team logs customer demo requests, with a table view and a CSV export. Store data in Postgres.”
5. Add secrets if asked. If the app reads your warehouse or an external API, the agent prompts for the keys. Admins usually add team secrets in the Apps dashboard.
6. Preview in the tray. When the build is ready, open the tray to click through the app before anyone else sees it.
7. Publish and choose a URL. Pick a unique app address (you can change it later). Cursor then runs its security checks.
8. Fix and republish if blocked. If a check fails, Cursor lists what to fix. Ask the agent to fix it, then publish again.
9. Share the link. Choose who can open it (see the next section) and send the live link.

Tip: describe the data you store and who should see it in your first prompt. It saves a round of security-review fixes later.

If your team already uses another cloud agent, our Claude Code on the web guide and OpenAI Codex guide show how those tools handle cloud runs. Neither hosts your app for you today.

Sharing Options and Who Can Open Your App

Every app has one of three visibility levels:

• Individual plans: public sharing is available.
• Teams and Enterprise: public sharing is off by default. An admin can allow it in the Apps dashboard.
• Turning public off: if an admin disallows public apps later, existing public apps move back to team-only.

Warning: people outside your company need a Cursor account to open private or team apps. For customer-facing tools you would need public mode, which skips sign-in completely.

API Keys for Scripts, Bots and CI

Apps can also be called by scripts, Cursor’s Grok Bot or CI jobs. You create keys in the Apps dashboard under API keys.

• Personal keys: open any app the key’s owner can open.
• Team keys: open only the team apps they were given access to.
• Public apps: open with either key type.

Send the key in the x-cursor-app-token header on every request. Query strings and cookies are not supported.

curl -H "x-cursor-app-token: $CURSOR_APP_KEY" https://YOUR-APP-URL/api/requests

Keyed requests are logged as automated and show the key, not a person. A key without access is treated like a signed-out user and gets the sign-in redirect.

Security Checks and Admin Controls

What runs before every publish

• Secret scan: blocks API keys and access tokens written into app files.
• Credential files: blocks private keys, service-account keys and auth-token files.
• .env files: excluded from the deploy.
• Source maps: removed, so your original source is not exposed.
• AI security review: an agent reads the app files and blocks serious issues.

What team admins can do

• See every app and every secret on the team.
• Add custom instructions to the AI review (they cannot remove the built-in checks).
• Approve a publish the review blocked, except for malicious code, hardcoded secrets or exposed credentials.
• Allow or block public apps and API-key access.
• Unpublish any app or switch Apps off for the team.

Every settings change goes into the team audit log. Independent coverage stresses one point: the checks are a gate, not a guarantee that an app is free of bugs or vulnerabilities.

What Does It Cost?

Cursor has not published a separate price for hosting, databases or app traffic. Here is what we know:

• Building the app: cloud agents draw on your plan’s usage at the chosen model’s rate, like any agent work.
• Third-party models: billed at API list price on top of the plan.
• Bigger context costs more: large contexts raise token use and cost.
• Spend limit: you set one the first time you use Cloud Agents.
• Hosting: included for now with no listed quota, provided “as is” and “as available”.

Cursor Live Apps vs Replit, Lovable, v0 and Bolt

Prompt-to-app builders already exist. Here is how Cursor’s version lines up. Rival prices are early-2026 entry plans from an independent comparison (Altar.io, May 2026) and change often.

Which should you pick?

• Choose Cursor Live Apps for tools only your colleagues use, where Cursor SSO and admin review are a plus, not a hassle.
• Choose Lovable or Bolt for apps that strangers will sign up to, because your users will not have Cursor accounts.
• Choose v0 if your stack is already Next.js on Vercel.
• Choose Replit if you want an all-in-one browser IDE with hosting and a clear credits model.

Want your app’s agent to talk to Slack, Notion or a database? Our best MCP servers list includes Cursor config examples.

Limits and Open Questions

• Cloud only: the feature does not work with the local desktop agent.
• Git providers: Cursor Origin and GitHub only. GitLab and others are “coming soon”.
• Stack: web apps on Postgres, Cursor SSO and Cursor hosting. Custom networking, other identity providers or special infra still need a normal pipeline.
• Lock-in: the code lives in your repo, but moving an app off Cursor means replacing its sign-in and hosting.
• Removal: Cursor can revoke, suspend or remove apps that break its terms or for business or legal reasons.
• Not published yet: hosting quotas, database size limits, custom domains, uptime terms, data retention and how individual owners delete an app.
• Explicit ask needed: the agent only builds an app when you clearly ask for one.

Troubleshooting

• No Cloud option under the agent box: your plan lacks Cloud Agents (Free and Plus), or your Cursor version is old. Upgrade the plan or update the app.
• Agent cannot see your repo: an account admin must connect GitHub first, and you need read-write access to the repo and any submodules.
• Agent wrote code but offered no app tray: it only builds an app when asked directly. Say “build and publish this as an app”.
• Publish blocked: secret found: move the key out of the code into a team or personal secret in the Apps dashboard, then ask the agent to read it from the environment.
• New secret not picked up: secrets are injected only when an agent starts. Start a fresh agent after adding one.
• Blocked publish that an admin cannot approve: hardcoded secrets, exposed credentials and malicious code can never be overridden. Fix the code.
• Script gets the sign-in page: the key lacks access to that app, or you sent it as a query string. Use the x-cursor-app-token header.
• Public option greyed out on a team: public apps are off by default for Teams and Enterprise. Ask an admin to allow them.

My Take

This is a smart move. Most “vibe-coded” internal tools die on the last step: someone has to host them, add login and keep secrets safe. Cursor now owns that step, with admin controls a security team can live with.

The trade-off is that your app is tied to Cursor sign-in and hosting. That is perfect for a sales dashboard, awkward for anything customers touch.

The biggest gap is pricing. “Included for now” with no quotas is great for testing, but I would not move a business-critical tool here until Cursor publishes limits. I will update this guide when it does.

FAQ

Is Cursor Live Apps free?

No. It needs a paid plan with Cloud Agents, starting with Premium at $30 a month. Free and Plus plans do not include it.

Can I use my own domain?

Cursor lets you pick a unique app address and change it later. It has not documented custom domain support yet.

Does Cursor Live Apps work with GitLab?

Not yet. It works with new repos on Cursor Origin and existing GitHub repos, and Cursor says other providers are coming soon.

Can people without a Cursor account use my app?

Only if the app is public. Invite-only and team apps require Cursor sign-in, and teams need an admin to allow public apps.

What database does it use?

Cursor provisions Postgres automatically when the app needs one. Size limits and the provider behind it are not published.

Does the agent see my API keys?

Cursor says no. You or an admin add secrets in the Apps dashboard, and the agent uses them without seeing the values.

How do I take an app offline?

Team admins can unpublish any app from the Apps dashboard. Cursor has not yet documented the steps for individual owners.

Sources

• Cursor changelog: “Build Live Apps in Cursor” (5 November 2026)
• Cursor docs: Cloud Agent and Cloud Agent Apps pages
• Cursor pricing page (plans and Cloud Agent availability)
• Superpower Daily, CellCog and DEV Community coverage of the launch (caveats and limits)
• Altar.io: Lovable vs Bolt vs v0 vs Replit vs Base44 (May 2026) for rival entry prices
• Sam on AI, AI Brief 6 November 2026