Why does my Bolt app work in Bolt but not when I download it?

Bolt runs in a browser-based Node environment (WebContainers). Some packages and behaviours differ from a real machine, and the project was never run anywhere else. Step two of the checklist is exactly this.

Can I deploy a Bolt.new app to my own domain?

Yes — export to GitHub, then connect the repo to Vercel, Cloudflare, Netlify or Fly with environment variables per environment and rollback. Don't rely on the one-click deploy staying in sync.

My Bolt app broke after I added auth. Why?

Supabase's Site URL and redirect list point at a preview URL that changes. Set them to a stable domain per environment and update OAuth callbacks.

Are the keys in my Bolt project exposed?

Treat them as exposed: the .env travels with exports, shares and pushes. Rotate them, move them to the host, and gitignore the file.

How long does this take?

If step two goes smoothly, two to four weeks for a typical app. If the app depends heavily on sandbox behaviour, expect longer and consider the fix-or-rebuild framework.

Vibe coding

Bolt.new to production: getting an app out of the browser sandbox

Author

AI Cubed

Published

September 9, 2026

Read time

8 min

Bolt.new is fast because it runs everything — Node, your dev server, your build — inside the browser using WebContainers. That's a genuine achievement and also the source of most production problems: the app has never run anywhere else. This checklist is about crossing that boundary.

Each step says what "done" looks like. If step two takes more than a day, the app depends on sandbox behaviour more than it should, and that changes the plan.

The checklist, in order

Export to GitHub. Done when: the repo is the source of truth and Bolt is optional.
Run it on a real Node environment with a pinned version. Done when: it builds and runs on a laptop and in CI.
Replace sandbox-only behaviour. Done when: nothing depends on WebContainer specifics or a preview URL.
Rotate and relocate secrets. Done when: the project contains no keys and the host holds them per environment.
Supabase auth on a stable domain. Done when: every auth flow works on the real domain on a phone.
Repair truncated files. Done when: every file parses and the last working state has been reconciled.
Schema as migrations, run on deploy. Done when: a fresh database from migrations matches production.
Deploy from the repo with rollback. Done when: you've rolled back once on purpose.
Tests on the money paths in CI. Done when: a PR that breaks checkout fails.
Monitoring and tested backups. Done when: a test alert reached you and a restore worked.

Bolt-specific gotchas

Gotcha	What happens	Fix
Works in Bolt, fails locally	The app was never run outside the browser; some packages behave differently.	Real Node environment, pinned versions, replace or shim sandbox-only packages.
Auth loops after adding Supabase	Redirect URLs point at a changing preview URL.	Stable Site URL and redirects per environment.
Half-applied edits	Output limits truncate files on large projects.	Diff, repair, branch-and-review.
Deploy button drift	One-click deploy happened once; later changes weren't redeployed.	Repo-connected deploys.
Secrets in exports	.env travels with the project.	Rotate, relocate, gitignore.

What AI Cubed does about this

We run this checklist on Bolt projects, starting with a real-environment run as part of the two-business-day audit. See finish my Bolt app.

Frequently asked questions

Sources

WebContainers — StackBlitz
Bolt.new support — StackBlitz
Redirect URLs — Supabase Docs

Start here

See where your operation is losing time.

Twenty minutes with an operator, not a salesperson. We'll name the one bottleneck costing you the most — and tell you whether it's worth fixing with software at all.

Book your free 20-minute consult→

20 minutes · video call · no preparation needed