# How to share an app you built with AI, just with your team

> Canonical: https://teamonly.dev/guides/share-an-ai-built-app-with-your-team

Last updated 25 October 2026. Written by TeamOnly. We make one of the options below, so prices and limits link to each vendor's own pages.

**Quick answer:** Put the app on a host that checks your company login before the app loads. Coworkers sign in with their work Google or Microsoft account, or a code sent to their work email, and nobody else gets in.

Skip the public link with a password, and don't make everyone sign up for the tool you built it with. The rest of this page shows each option, the steps, and a five-point test for "private".

## What are my options for sharing it privately?

Here are the common routes, ours included. They differ in who can get in, whether coworkers need a new account, and how much you have to set up yourself.

| Option | Who gets in | New account for coworkers? | Database included | Cost to make it private | Best for |
|---|---|---|---|---|---|
| Public host + password (Vercel, Netlify, Replit) | Anyone who has the shared password | No, just the password | Not on Vercel or Netlify. Replit has one built in | Vercel: $20/mo per project on Pro. Netlify: Pro plan, $20/mo | A short demo for someone outside the company |
| The builder's private sharing (Lovable, Replit, Vercel Authentication) | People with an account on that platform, in your workspace or invited | Yes, on that platform | Lovable and Replit: yes. Vercel: add one | Lovable: Business plan, from $50/mo. Replit: Starter or Core and up. Vercel Authentication: free | Teams where everyone already uses that platform |
| Cloudflare Access (in front of your own host) | Your company login or an emailed one-time PIN, once you set it up | No | No, it isn't a host | Free to 50 users, then $7 per user a month, billed yearly | Technical builders already running on Cloudflare |
| Tailscale or a VPN (a private network) | People connected to your private network | Yes, everyone installs and signs in to the VPN app | No, you run the server | Depends on your VPN plan | Companies where everyone already runs the VPN |
| Internal tools platform (Retool and similar) | Users you add to the platform | Yes, a user seat | Yes | Retool Team: $10 per builder and $5 per user a month, billed yearly | Building in a visual builder instead of with code |
| **TeamOnly** (a host with company login built in) | Anyone at your company: work Google, work Microsoft or an emailed code | No | Yes, one per app, plus file storage and secrets | $19/mo for the builder. People who only use apps are free | An app you built with Claude Code or Cursor that the team should use today |

Checked 25 October 2026. Sources: [Vercel Deployment Protection](https://vercel.com/docs/deployment-protection), [Netlify password protection](https://docs.netlify.com/manage/security/secure-access-to-sites/password-protection/), [Replit: who can access your app](https://docs.replit.com/cloud-services/deployments/private-deployments), [Lovable plans](https://docs.lovable.dev/introduction/subscription-plans), [Cloudflare Access plans](https://www.cloudflare.com/zero-trust/products/access/), [Retool pricing](https://retool.com/pricing). More detail: [the full comparison](https://teamonly.dev/compare).

## How do I share it with TeamOnly?

Five steps, about ten minutes the first time. You need Node.js on your computer, which Claude Code and Cursor users already have.

1. **Start free with your work email.** Try it free for 14 days, no card needed. After that, Builder is $19 a month for one builder and up to three apps. Your email domain becomes the door. https://teamonly.dev/pricing#trial
2. **Run `npx teamonly init` in your project.** It adds instructions that Claude Code and Cursor read, plus the small library your app uses for the signed-in person, the database and files.
3. **Ask your AI tool for the app.** Plain English is fine: "Build an expense approval tool. People submit receipts, managers approve, finance marks them paid." The instructions keep it to a shape that runs on TeamOnly: a React front end and a small API.
4. **Sign in once, then deploy.** Run `npx teamonly login` the first time on your computer, then `npx teamonly deploy`. You get a link like `expenses.acme.teamonly.app`. The database, file storage and secrets are created on the first deploy.
5. **Send the link.** Anyone at your company can open it. You can narrow it to named people with `npx teamonly access only dana@acme.com sam@acme.com`.

```
$ npx teamonly init
✔ Added instructions for Claude Code and Cursor
$ npx teamonly login
✔ Signed in as dana@acme.com
$ npx teamonly deploy
✔ Live at https://expenses.acme.teamonly.app
  Only @acme.com accounts can sign in.
```

You can also ask Claude Code or Cursor to run these for you. They ask before running anything. No Cloudflare account, no database service, no login code to write.

## What will my coworker see?

A sign-in screen with your company's name on it, then your app.

They click "Sign in with Google" or "Sign in with Microsoft" and pick their work account, or type their work email and enter the 6-digit code we send. The app knows who they are by name. Next time, they are already signed in.

Someone with a personal Gmail, or from another company, is turned away at that screen. Your app never loads for them. More: [company login](https://teamonly.dev/company-login).

## Why not just use a public link with a password?

Most hosts are built for websites anyone can visit. Making one private for a team is an add-on, and it usually means a shared password.

- **The password travels.** It ends up in a chat thread or an email to a contractor, and you can't tell who has it.
- **It has no names.** If everyone logs in the same way, the app can't record who approved an expense.
- **It doesn't leave with people.** Someone who leaves the company still knows it until you change it and tell everyone else.
- **Unlisted is not private.** A link nobody was told about still gets found, shared and sometimes indexed.

Vendor research: security company Red Access reported finding more than 380,000 publicly reachable assets on the main vibe-coding platforms. About 5,000 looked like company tools, and more than 2,000 of those held sensitive business or personal data. [Summary on The Hacker News](https://thehackernews.com/2026/05/what-2000-exposed-vibe-coded-apps.html) (a contributed article, May 2026).

## What does "private" have to mean for a work app?

Whatever you choose, check these five things. Each one takes a minute.

1. **The login comes before the app.** Nobody sees a single screen of the app, or gets any data out of it, until they have signed in. A page that loads first and then asks for a login is not private. *How to check:* open the link in a private browser window. You should land on a sign-in screen. Try an address from the app's API too, like `/api/expenses`. It should refuse you.
2. **Only company accounts get in.** People sign in with an account your company controls, and the email domain is checked on the server. Personal accounts are turned away. *How to check:* try signing in with a personal Gmail or Outlook address. You should be refused.
3. **Each app's data is kept apart.** The app has its own database, files and keys. Another app, or a stranger with the database address, can't read them. *How to check:* ask whether anyone could reach the database without going through the app's login. With Supabase, check that row-level security is on for every table. Make sure no keys are written into the code.
4. **It doesn't show up in search.** Search engines are told not to list the app, and they can't see inside it anyway. *How to check:* search for the app's address in Google. Check the response for a `noindex` header.
5. **Access ends when someone leaves.** When a person leaves the company, they lose access without you doing anything special, and nobody needs a new password. *How to check:* if this person's work account were turned off today, could they still get in tomorrow? With a shared password, the answer is yes.

**With TeamOnly**, all five are handled for you. Sign-in is checked before any app code runs, on every request. Personal addresses are refused. Each app gets its own database, file storage and secrets. Every response says `noindex`. Sign-in goes through the work account, so when it is turned off, new sign-ins stop; a session lasts at most 7 days, and taking someone off an app's list works on their next click. More: [security details](https://teamonly.dev/security).

## I built it in Lovable, Bolt, Replit or v0. Can I still do this?

Start with the platform's own private sharing. If everyone on your team already has an account there, it may be all you need: Lovable's Business plan can limit a published app to your workspace, and Replit can publish to your workspace or to invited people.

If your coworkers don't have accounts there, export the code. TeamOnly runs a React front end with a small JavaScript or TypeScript API. Apps that rely on Supabase for login and tables, or on Next.js server features, need changes first. Python apps can't run here. Email hello@teamonly.dev with what you have and we will tell you straight.

## I built it in Claude Code or Cursor. What changes?

Very little. Run `npx teamonly init` in the project and ask your AI tool to fit the app to TeamOnly. It reads the instructions and uses our login, database and files instead of reaching for services we don't run.

- [Claude Code guide](https://teamonly.dev/claude-code)
- [Cursor guide](https://teamonly.dev/cursor)
- [Templates to start from](https://teamonly.dev/templates)

## Questions people ask

### How do I share an app I made with Claude Code with my coworkers?

Host it somewhere that checks your company login before the app loads, then send the link. With TeamOnly that is `npx teamonly init`, `npx teamonly login` and `npx teamonly deploy`. Coworkers open the link and sign in with their work Google or Microsoft account, or a code sent to their work email.

### How do I keep a vibe-coded app private without putting it on the internet?

Every web app is on the internet in the sense that it has an address. What matters is that nobody can use it, or read its data, without signing in with a company account first. A shared password or an unlisted link does not do that. A login in front of the app does.

### Do my coworkers need an account to use it?

It depends on where you host it. Private sharing on Lovable, Replit or Vercel needs an account on that platform. Cloudflare Access and TeamOnly use the work account people already have. On TeamOnly, people who only use apps are free.

### Is a password on a Vercel or Netlify site good enough for a team?

For a short demo, maybe. For a tool people use every day, no. The password gets passed around, the app can't tell who did what, and someone who leaves still knows it. It also costs extra: $20 a month per project on Vercel Pro, and a Pro plan on Netlify, as of October 2026.

### Can I run it on my laptop and share the link?

With a tunnel tool you can, but the app is off whenever your laptop is asleep, and the data lives on your machine. It is fine for showing someone a draft. For a tool the team depends on, put it on a host.

### Is Cloudflare Access enough to protect an AI-built internal app?

It is a strong login gate, free for up to 50 users. You still need to host the app, pick a database, connect an identity provider and write a policy for each app. If you are comfortable doing that, it is a good choice. [TeamOnly vs Cloudflare Access](https://teamonly.dev/compare/cloudflare-access) goes through it.

## Keep reading

- [TeamOnly vs Cloudflare Access](https://teamonly.dev/compare/cloudflare-access)
- [Every option, side by side](https://teamonly.dev/compare)
- [Company-only login](https://teamonly.dev/company-login)
- [How it works](https://teamonly.dev/how-it-works)
- [Pricing](https://teamonly.dev/pricing)

Try it free for 14 days, no card: https://teamonly.dev/pricing#trial. Or subscribe: https://teamonly.dev/pricing#subscribe (Builder $19/mo, Team $249/mo)
Not ready? Get updates: https://teamonly.dev/waitlist