Deploy a Bolt app to production: a step-by-step guide (2026)

I checked Bolt.new’s help center on October 21, 2026, and this guide follows it from the first publish to production for an app you built in Bolt.new (bolt.new), the AI app builder. Choose your host and run the security audit before you publish to bolt.host, then connect a domain or send the app to Netlify, the app stores, or your own host.

What you need before you deploy a Bolt app

Deploying a Bolt app requires a project with changes to release and a role that allows publishing. Viewers can open a published site, and the owner and collaborators with the Editor or Co-owner role publish it and control who can view it.

Prerequisites:

• A Bolt project you own, or one where you hold the Editor or Co-owner role
• A Pro, Teams, or Enterprise plan, needed only for private sites, custom domains, and the security audit
• A domain you own and access to its DNS settings, needed only for a custom domain
• A Netlify, Expo, or GitHub account, needed only for those routes

Time required: The first publish takes about a minute. Allow up to 24 hours when you connect a custom domain.

Plan limits vary by feature, so check your plan against what you need. Custom domains and the security audit require a paid plan (Pro, Teams, or Enterprise). Bolt’s $9 Lite plan covers neither, and October 14, 2026 was the last day to sign up for it, so it only applies if you were already subscribed.

How to deploy a Bolt app step by step

This walkthrough takes a project from preview to a live URL in six steps.

Step 1: Choose your host before the first publish

Bolt hosting is the default and needs no separate hosting account. Netlify is the other hosting option inside Bolt, and Bolt's guide says projects that save data, like user accounts or orders, should stay on Bolt hosting.

Netlify also offers Netlify Database and serverless Functions, and connecting them to a Bolt project falls outside that guide, so a project that needs either has no documented path through Bolt.

Switching later means unpublishing the project first and adding your custom domains again on the new host. One exception applies: projects published to Netlify before August 14, 2025 can stay there.

Step 2: Run the security checks

The full audit is included in Pro and excluded from Free and Lite, and a database check runs on every plan. Open the Publish menu and click Run security audit.

Once it runs, the audit applies fixes on its own and collects the issues it can't fix under Needs your action, like settings in a connected email or payment service.

The audit reviews who can view or change data, what the app exposes publicly, sign-in and session handling, misuse such as changed prices, visitor input such as file uploads, and where keys and security settings appear. It skips any area that doesn't apply to your project.

On any plan, open the Security tab in your database settings. It reports missing row-level security (RLS) and access policies that are too open, such as a table that anyone can read and change.

You get up to 30 audits per day, and the count resets at midnight UTC. To keep the fixes Bolt made, describe later changes in chat, because rolling back to an earlier version removes them.

Run the audit from the button in the Publish menu, which costs no tokens according to the release notes. Prompting Bolt to audit in chat uses tokens.

Once you've handled the items under Needs your action, you're ready to publish. The Superblocks guide to vibe coding security covers the risks of shipping AI-generated code.

Step 3: Publish your Bolt.new app to bolt.host

To publish:

1. Click Publish in the top-right corner.
2. In the Publish your project menu, click Publish again.
3. Wait about a minute.
4. Click the link that appears in the chat to open your site.

On mobile, Publish also appears on the preview card and in the project menu.

The first publish creates a random bolt.host URL. To change it, select the pencil icon (Edit domain) in the Publish menu and enter the new URL. Select Republish after updating if you want it applied right away, then click Save.

Step 4: Set visibility and access

Sites are public by default, and search engines can index them. When you switch the dropdown in the Publish menu from Public to Private, only your team and invited users can view the site, and search engines can't list it. On Teams, admins can also restrict visibility to private only or public only.

To invite viewers, enter their email addresses under Manage access and select Invite. To give everyone with a company email address access, enter the company domain under Trusted domains (Manage) and select Save domains. Apply the change with Publish (first time) or Update.

Sites with a custom domain can only be public. To switch to private, disconnect the domain first. To connect a domain, see Step 5.

Step 5: Connect a custom domain

Custom domains need a Pro, Teams, or Enterprise plan and a published site. Click the gear icon, choose All project settings, then Domains & Hosting, and click Connect a domain you own. Enter the domain, then add these records at your registrar:

For a subdomain such as app.yourcompany.com, add the TXT record first and click Verify and add subdomain. You do this once, and TXT verification takes 3 to 5 minutes. Watch the Status column on Domains & Hosting.

Connect the root domain with an ALIAS or ANAME record (a flattened CNAME also works). An AAAA record, which points to IPv6 addresses, can't connect it. If your registrar has no ALIAS support, the domain FAQ points to an A record fallback in the SSL guide.

Once the records are in place, domains typically connect within a few hours, and some take up to 24.

Step 6: Update or unpublish the live site

Click Update in the Publish menu after you make changes to send them to the live site.

To unpublish the site, disconnect any custom domain. Click Unpublish and confirm.

That covers the Bolt hosting route. The next three sections cover Netlify, the app stores, and your own host.

How to deploy a Bolt app to Netlify

You deploy a Bolt app to Netlify by connecting your account and selecting it as the hosting provider. Publishing then works as it does on Bolt hosting, and the steps below follow the Netlify guide.

Bolt suggests Netlify for sites that run entirely in a browser, like landing pages and portfolios. If you switch from Bolt hosting, add your custom domains again in Netlify's Domain Management.

Connect Netlify:

1. Open a project and click the gear icon.
2. Choose All project settings.
3. Under Account settings, select Applications.
4. In the Netlify section, click Connect and log in.

Publish to Netlify:

1. Choose All project settings and click Domains & Hosting.
2. In the Hosting Provider dropdown, select Netlify and close settings.
3. Click Publish, then Publish again.
4. Wait about a minute and open the link in the chat.

The Hosting Provider dropdown appears only when the project is unpublished, your Netlify account is connected, and you have permission to manage the project's domains.

If a Netlify publish fails instead, run npm run build and download the project. After that, deploy it with Netlify's manual drag-and-drop option.

How to deploy a Bolt app to the App Store and Google Play

You deploy a Bolt mobile app by building it with Expo and EAS, then sending the iOS build to TestFlight and uploading the Android build to Google Play Console. Include "mobile app" in your first prompt, because projects started as web apps don't switch over easily.

Before you build for the stores, click the Device Preview icon next to Responsive mode and scan the QR code with Expo Go on your phone. According to the Expo guide, you need Node.js LTS and Git on your computer, plus an Expo account. Each store also asks for its own developer account.

Apple's program costs 99 USD per membership year, and prices vary by region. Google charges a US$25 one-time registration fee.

Set up locally. Download the code and install the EAS CLI with npm install -g eas-cli. Log in with eas login, then run npm install and npx expo-doctor.

Next, in app.json, set the display name and slug, and choose the slug carefully, since it can't change after your first build. Finish with eas init and eas build:configure.

iPhone. Run eas build --platform ios --auto-submit. EAS builds the app and creates an app listing in your Apple Developer account, then sets up a testing group and sends the build to TestFlight.

Testers then get an email invitation. For release, fill in app details in App Store Connect and submit for review.

Android. Run eas build --platform android and download the APK or AAB file. In Google Play Console, set up the app and go to Testing > Internal testing. Create a release, upload the file, and add tester email addresses.

Before you go public, personal accounts created after November 13, 2023 must run a closed test with at least 12 testers opted in for 14 days, then click Apply for production on the Dashboard.

After that, choose Production, add a release, and submit it for review once the store listing is complete. Google's review takes seven days or less, and occasionally longer.

After the first release, update the app in Bolt, download the new code, and resubmit the mobile builds.

How to take a Bolt app to production on your own cloud with GitHub

You take a Bolt app to production on your own cloud by syncing it to GitHub or downloading the code, then deploying it on a host that serves static files or runs Node.

Click the GitHub icon in the top-right corner and log in. Authorize the app, then install the GitHub App. Each change that doesn't break the project becomes a commit, and Bolt checks GitHub every 30 seconds for edits made there. New repositories start private.

Three limits matter here. Bolt creates and switches branches, and you merge them in GitHub. If both sides update at nearly the same time, Bolt keeps your changes and overwrites the GitHub version. Disconnecting is permanent, and reconnecting to the same repository takes a request to support.

If you'd rather skip GitHub, click the project title, then choose Export > Download. To run it locally, install Node.js and unzip the file, then run this in the project folder:

npm install && npm run dev

Whether you sync through GitHub or download the zip, choose a host:

• Vercel. Drag the zip onto vercel.com/drop. Each drop creates a new project and URL, and a push through GitHub keeps the URL stable. Secrets panel values remain in Bolt. Recreate each variable in Vercel and redeploy.
• AWS. Amplify Hosting connects a repository in GitHub, Bitbucket, GitLab, or AWS CodeCommit and deploys it to AWS's CDN with continuous deployment.
• Other hosts. Run the build command, usually npm run build, and follow that host's deployment guide.

Superblocks' overview of AI app deployment compares hosts by layer.

Common mistakes to avoid

These problems tend to appear right after the first publish or after a security audit, and each one has a fix you can apply yourself.

• Projects over 100 MB. Bolt rejects the deployment with "Project is too large to deploy. The maximum allowed size is 100MB." Large images and videos can make a project exceed the limit. Move media to external storage such as Supabase Storage, Cloudflare R2, or AWS S3, then point the app at those URLs.
• bolt.host SSL errors. ERR_SSL_PROTOCOL_ERROR can appear when a network or internet provider blocks .bolt.host addresses. Open the site on mobile data with any VPN off. If it loads there, your original network is blocking .bolt.host. Allow it in your router or provider security settings.
• Duplicated projects. Duplicating a project copies your code and project settings but not the GitHub and Netlify integrations, so reconnect Netlify on the copy. If you duplicate to another account, the custom domain stays with the original until you disconnect it there.
• Rollbacks after an audit. The rollback removes the fixes Bolt applied. Describing the change in chat keeps them.

Bugs can also appear after a clean deploy. The Superblocks guide to deploying vibe-coded apps covers hardcoded localhost URLs, missing environment variables, and CORS errors.

Deploy a Bolt app on company data with Superblocks

Bolt publishes to bolt.host or Netlify. If your team needs an app on company data to run inside its own network, with SSO and a record of who created it, Superblocks, a platform for AI-generated internal apps, lists Bolt among its app import sources. If Bolt.new isn’t the right fit for a production internal app, compare other builders in our guide to Bolt.new alternatives.

• Direct Bolt import. Click Import and upload the app, and Clark, Superblocks' AI agent, processes it. Superblocks says the UI and business logic carry over (post dated May 27, 2026).

• Checks before production. Code Security adds supply chain, static analysis, and Security Agent checks, and Policy Agents enforce the rules your admins write, such as no hardcoded secrets.

Code Security has been on for all customers since October 9, 2026, and its default mode, Blocking, flags security issues before an app reaches production.

‍

For Git-connected apps, Superblocks recommends running security and code checks in your CI pipeline in place of pre-publish Policy Agents.

• In-network deployment (Enterprise). Hybrid keeps the data plane in your AWS, GCP, or Azure account. Cloud-Prem runs the full platform in your own cloud (AWS, GCP, or Azure), as the deployment overview describes.

• Access and audit. RBAC comes with Teams. SSO/SAML/OIDC and audit logs are Enterprise features, and so is the Admin MCP. Superblocks states that it's SOC 2 Type II certified and HIPAA compliant.

Teams costs $125 per month, billed monthly, or $100 per month billed annually. It includes 100 Governed Agent Units a month and 1 hosted app per Team, with room for up to 15 builders and RBAC.

Extra hosted apps cost $10 per app per month. Enterprise uses custom pricing. In-network deployment, through Hybrid or Cloud-Prem, is what separates Enterprise from Teams.

To see a Bolt import in action, start a 14-day free trial on Teams. To see Hybrid or Cloud-Prem deployment, which are part of Enterprise, book a demo. The Superblocks docs cover the rest.

Frequently asked questions

How do you deploy a Bolt app?

You deploy a Bolt.new app by clicking Publish twice, once in the top-right corner and once in the menu, then opening the link Bolt posts in the chat about a minute later. The site gets a random bolt.host URL that you can edit.

Is it free to deploy a Bolt app?

Yes, publishing to a bolt.host URL is free, and every Free plan site is public and shows a "Made in Bolt" badge.

Free hosting allows up to 10 GB of bandwidth and 333,333 requests per month, and a site that uses its monthly data allowance goes offline until the next billing cycle.

Some features also need a paid plan, including private sites, custom domains, and the security audit, and Lite includes neither the domains nor the audit.

Can you deploy a Bolt app to iOS and Android?

Yes, if you build it with Expo. EAS builds both. It auto-submits iPhone builds to TestFlight, and for Android you download the APK or AAB and upload it in Google Play Console.

You need an Apple Developer account at 99 USD per membership year and a Google Play Developer account with a US$25 one-time fee.

Is Bolt safe to deploy to production?

Run both of Bolt's checks before you publish. The security audit comes with Pro, and the database Security tab is available on every plan.

The audit applies fixes on its own and collects the issues it can't fix under "Needs your action," and someone on your team still has to handle those items before the site is published.

Can Superblocks run a Bolt app inside my own cloud?

Yes, on the Enterprise plan. Superblocks imports Bolt apps, and Enterprise includes Hybrid, which keeps the data plane in your AWS, GCP, or Azure account, and Cloud-Prem, which runs the full platform in your own cloud (AWS, GCP, or Azure).