Publish an AirApp as a Website

Use the Website engine to put an AirApp at a public address that stays online and let the site read and write the workspace through the Busabase API.

The other three AirApp engines (In browser, This machine, Cloud sandbox) run only while someone has the app open. The Website engine is different: once it is live, the app stays online at a fixed address, and anyone can open it without signing in. Use it for anything people outside your workspace should see: a shop, a landing page, an enquiry form.

A website can have pages and its own backend endpoints. It runs on Cloudflare Workers.

Before you start

Plan: on Busabase Cloud, Plus or higher. On the Free plan, Website shows an upgrade prompt in the engine picker.
Self-hosted: an administrator has to configure the Website engine first. Until then, Website is greyed out in the picker with the reason. Self-hosted has no plan limit, but needs a valid licence.
The app itself: its airapp.json has to ask for the Website engine. Ask your agent to follow the busabase-app-creator skill; it knows how.

Preview and go live

Run: open the app. With the Website engine, running it makes a preview that only members of the workspace can open.
Go live: when the preview looks right, click Go live in the toolbar. What goes live is the version you just previewed, and the status changes to Live.
After changing files: run the app again and check the new preview before you go live. Otherwise you will see "The files changed after this preview. Run it again, then go live." and the live site keeps the old version.

If the toolbar shows Unpublished changes, the preview is newer than what is live.

Address and the Public switch

The app's Settings show the site's Address and a Public switch:

Public on: anyone with the address can open it.
Public off: the site goes offline at once and the address shows a not-found page. Turn it back on to restore it; no need to go live again.
Moved to Trash: the site goes offline. After restoring the app from Trash, turn Public back on.
Deleted permanently: the site and its address are deleted with the app.

Let the site read and write Bases

The site's backend (its Worker) reads and writes the workspace through the Busabase API, the same API and permissions that agents, the CLI and the SDK use.

The key the site gets

Every run and every Go live gives the site an API key:

Whose it is: the live site's key belongs to the person who clicked Go live, and the preview's to the member who ran it. The site can never do more than that person can in the workspace.
What it can do: the level the app's airapp.json asks for: read only (the default), propose changes, or write. Going live is the consent; there is no other approval.
Where it works: in this workspace only. It is refused in that person's other workspaces, and it cannot read their personal Vault values.
Where to see it: in that person's API key list, named Site: <app name> (Site preview: <app name> for the preview). Deleting it there cuts the site off until the next Go live.

The preview gets its own key at the same level and works on the workspace's real data, as the other engines do.

When it stops

Public turned off, or the app moved to Trash: the live key is disabled at once. Turning Public back on restores it.
App deleted permanently: its keys are deleted too.
The person who went live leaves the workspace: the key stops working. Someone with access runs the app and goes live again.
Every Go live: a new key replaces the old one.

The site's changes go through change requests like any API write, and the history names the key.

The site's code decides what a stranger can reach

The key can read and write everything its level allows its owner in this workspace, not just the Bases the site uses. A stranger never sees the key; they can only use it through whatever the site exposes. So have your agent follow the busabase-app-creator skill: expose specific endpoints, and never pass a visitor's request through to the API. If the site does not need to write, leave it read only. There is no CAPTCHA yet, so a public form can be spammed.