Questions.

What is 1sh.app?

You describe an app in a few sentences and a language model writes it — one self-contained web page, HTML and CSS and JavaScript in a single file. You watch the code stream in as it’s written, and you can keep the result private or publish it at a URL you choose. “One-shot” is the whole idea: one prompt, one attempt, a working application at the end of it.

Do I need an account?

Yes, and it’s free — create one with an email and password or with Google. You can browse Explore without one.

Why do I need my own API key?

Because someone has to pay the model provider, and 1sh.app doesn’t charge you anything. You bring a key from a provider you already have an account with, your builds bill to that account, and there’s no subscription here to cancel. It also means you pick the model rather than being handed whichever one is cheapest for us.

Where do I get a key?

From any one of four providers — you only need one:

• OpenRouter — one key reaches models from many vendors, and it’s the only one of the four with free models: its Free Models Router sits at the top of the picker and is already selected, so your first build can cost nothing at all. The easiest starting point.
• OpenAI — GPT models.
• Anthropic — Claude models.
• xAI — Grok models.

Create the key in that provider’s dashboard, then paste it into Settings. You can add more than one and switch between them per build.

What does it cost?

1sh.app is free. Your provider charges you for tokens, which for a single small app is usually a fraction of a cent to a few cents depending on the model — or nothing at all on an OpenRouter key, whose Free Models Router is the default and costs zero. The model picker shows an estimated range before you build (or free), the finished build reports what it actually used, and Usage totals it up over time. Those are estimates — your provider’s dashboard is the real bill.

How do I build my first app?

Add a key in Settings, then type what you want on the home page and pick a model. The code streams in on one side while the app runs live on the other. If it isn’t right, ask for a change and it rebuilds; when you like it, save it or publish it. Nothing is published until you say so.

Where are my keys stored?

In your browser, encrypted — never in our database. Each key is sealed with an AES-256-GCM key that lives in your browser’s own storage and is marked non-extractable, meaning the page can use it to decrypt but can never read it out. What sits on your disk is ciphertext plus the last four characters, so the Settings page can show you which key is which.

Does the server ever see my key?

For the length of one request, yes — it has to, in order to call the provider on your behalf. Your browser decrypts the key and sends it with the build request; the server holds it in memory only, uses it for that one call, and never writes it to disk, to the database, or to a log. There is no table it could go in. When the request ends, the server’s copy is gone.

Why do I have to re-enter my key on another device?

Because the encrypted key never leaves the browser you added it in. That is the trade: keys we don’t store are keys we can’t sync for you. Add it once per browser you build from.

I cleared my browser data and my keys are gone.

That’s expected, and there’s no recovery on our side — we never had a copy. Clearing site data or using a private window that you then close removes the encrypted key with it. Paste the key in again from your provider’s dashboard. Your saved apps are unaffected; they live in your account.

How do I know a key isn’t sent to the wrong provider?

Each key is only ever sent to the provider it belongs to — the OpenAI key goes to OpenAI, the Anthropic key to Anthropic, and so on. The provider is chosen by which key you picked, not by anything the model returns.

What do you store about me?

Deliberately little:

• Your email address and username.
• A bcrypt hash of your password, if you set one — never the password.
• The apps you save, and their publish settings.
• Usage as daily totals: for each day and model, how many builds and how many tokens in and out.

No API keys, no prompts, no analytics, no advertising, no fingerprinting — and no row per build, no cost, and nothing about what you built. The full detail is in the privacy policy.

Do you read or keep my prompts?

No. Your prompts are never stored. No table has a column for one. A prompt goes to the model provider you chose, under their privacy terms, and is checked in memory against the acceptable-use filter on the way — that check keeps nothing, not even which category it matched.

Saving an app stores the app: its code, the name you give it, and an optional description you write. The description is never prefilled from your prompt — it starts empty, and an app with no description is perfectly fine unless you want it listed in Explore, where a public catalog entry needs one. Both are editable any time from My apps.

What are the numbers on the Usage page?

Daily totals — for each day and each model, how many builds and how many tokens. Not a row per build, so there’s no record of the order or timing of what you made, and nothing at all about what any of it was. See Usage.

Cost isn’t stored. A build’s cost is shown once as it finishes, then discarded — only some providers publish prices, so a saved figure would be missing or estimated for many builds.

For the real detail, check your provider. Every build runs on your own key, so it appears in your provider’s API logs and billing — every request, with its exact charge and timestamp. That is the authoritative record of your spend; ours is a convenience.

Do you log what I’m doing?

We keep a thin activity log so the service can be operated and abuse investigated, and it’s built to record that something happened rather than what you were making: the kind of event and an internal id, like “this account published app 12.” It holds no app names or routes, not which category the content filter matched, and no IP addresses anywhere. Nothing is copied to an outside log service. Activity entries are deleted after 90 days and usage rows after 400, automatically.

Cookies and tracking?

One cookie, to keep you signed in. No analytics, no trackers, no third-party scripts anywhere on the site.

What email will I get?

Exactly one kind: a password-reset link, and only when you ask for one. No newsletters, no product announcements, no marketing.

How do I delete everything?

Settings → Delete account. It removes your account, your saved apps, and your usage rows immediately, and published URLs stop resolving the moment you confirm. Activity entries are detached from your account rather than kept under your name. Your API keys were only ever in your browser — clear this site’s data to remove those too. Database backups age out on their own schedule.

Where does a published app live?

At 1sh.app/your-username/your-route, where you choose the route when you publish. Nothing is published automatically — saving an app keeps it to yourself.

Who can see it?

You pick, per app, and you can change it later:

• Private — only you. The URL returns nothing for anyone else.
• Anyone with the link — a public page, but nothing points at it unless you share it.

Listing an app in Explore is a separate opt-in on top of that, so “anyone with the link” never means “in the catalog” unless you asked for it.

What is Explore, and what are stars?

Explore is the catalog of apps whose owners chose to list them. A star is a one-click way to say an app is good; the Top 100 ranks listed apps by how many they’ve collected. You can’t star your own.

Will my app show up in Google?

No — published apps are marked noindex, so search engines are asked not to list them. Being in Explore doesn’t change that. Treat a link as shareable, not as secret: anyone you give it to can open it.

Can I use an app like a real app on my phone?

Yes — save it to your home screen and it opens full-screen with no browser bars, its own icon, and its own entry in the app switcher. Because every app is a single self-contained page, it also keeps working with no signal.

• iPhone and iPad (Safari): open the app’s link, tap the Share button, scroll to Add to Home Screen, then Add. It has to be Safari — Chrome on iOS can’t do this.
• Android (Chrome): open the link, tap the ⋮ menu, then Add to Home screen or Install app if it’s offered.

One caveat worth knowing: an app only opens without browser bars if its HTML includes the tags that ask for it. New builds do — that’s part of the instructions every app is generated with. If you saved an older app and it still shows the address bar, rebuild it, or just ask for “make it work as a standalone home-screen app” and the model will add them.

Can I change my username?

Once every 30 days, from Settings. Your old username is kept so existing links don’t break — they redirect to the same app under your new name, as long as it’s still published.

Can I use my own domain?

You can point one at an app by forwarding it — the address bar will show the 1sh.app URL after the redirect. Custom domains walks through it. Serving an app under your own domain isn’t supported.

How many apps can I build?

Up to 10 builds a minute, and 30 publishes an hour. The limits exist to keep one account from swamping the service; normal use won’t reach them. There’s no cap on how many apps you can keep.

Why was my request declined?

Some things won’t be built here — phishing pages, credential harvesters, malware, and the rest of the acceptable-use list. A request can be declined before it ever reaches a provider, or by the model itself. If you think a perfectly ordinary request was caught by mistake, rephrase it — and if it keeps happening, tell us.

Which model should I pick?

On an OpenRouter key, start with the one already selected: the Free Models Router at the top of the picker, marked free. It routes your build to whichever zero-cost model is available, so trying this out costs nothing. OpenRouter rate-limits free models and they’re weaker than the paid ones, so treat it as the cheap first attempt rather than the model for a demanding app.

Otherwise a small fast model — they handle most single-page apps and cost the least. Reach for a larger one when the app has real logic, when a smaller one has already failed, or when you care about the details of the design. The picker shows an estimated cost range next to each.

What does “Show thinking” do to my bill?

It shows the model’s reasoning before the code starts, which is useful for a complicated request and costs real money: reasoning is billed as output tokens, so expect a noticeably larger bill for that build. Leave it off unless you want to watch the plan.

The app it built doesn’t work.

Tell it what’s wrong and let it rebuild — describing the broken behaviour usually fixes it faster than starting over. If a model keeps getting it wrong, switch to a stronger one and rebuild the same prompt. Apps are single self-contained pages, so anything needing a server, a login, or a database to persist data is outside what this can make.