On November 5, 2026, Cursor shipped Build Live Apps. A cloud agent can now scaffold a web app, provision Postgres and Cursor SSO auth when needed, run security checks, and publish a live URL you share with teammates or, on individual plans, publicly.
Last updated: November 6, 2026
Table of contents
- What changed on November 5, 2026
- Feature summary
- How to build and publish a Live App
- Sharing, API keys and admin controls
- Plans, limits and how this differs from earlier Cloud Agents
- Frequently asked questions
- Sources
What changed on November 5, 2026
Cursor’s Build Live Apps changelog and Apps documentation describe an end-to-end path from a cloud-agent prompt to a hosted URL. Earlier cloud agents could write code, open pull requests, and preview work through forwarded ports. Live Apps adds managed hosting for internal tools: scaffolding, optional Postgres, Cursor SSO for private and team apps, secrets the agent never sees, and a publish tray that returns a live link.
The release targets ops tools, demos, training portals, sales dashboards, and engineering service portals. A teammate who is not a full-time engineer can describe a narrow internal tool and share the result without a separate hosting project. For environments, canvases, and the Environments API, see our Cursor Cloud Agents guide. For phone control of a local agent, see Cursor Remote Control.
Feature summary
| Capability | What Cursor provides | Notes from official docs |
|---|---|---|
| Scaffolding | Cloud agent builds the web app from your prompt | Must say you want to build an app; local agents are not supported |
| Hosting | Dedicated hosting account per team or individual | Isolated from other teams and users |
| Database | Automatic Postgres when needed | Provisioned during the build flow |
| Auth | Cursor SSO for private and team apps | Public apps on individual plans skip Cursor auth |
| Secrets | Prompted or Apps-dashboard secrets | Agent never sees secret values |
| Git sources | New or existing Cursor Origin and GitHub repos | GitLab and other providers listed as coming soon |
| Publish gate | Deterministic checks plus AI security review | Nothing goes live until you publish after a pass |
| Automation access | x-cursor-app-token header with a Cursor API key |
Header only; no query parameter or cookie |
How to build and publish a Live App
The steps below follow Cursor’s Apps docs and the November 5 changelog.
- Confirm plan and Cloud Agents. Apps requires a paid plan with cloud agents enabled. Free and Plus do not include Cloud Agents. If Cloud Agents are new to your team, complete source-control setup and an environment first using the Cloud Environment Setup docs.
- Start a cloud agent. From Cursor Desktop, Web, or another supported surface, choose Cloud under the agent input. Say explicitly that you want to build an app. Sample prompts in the docs include dashboards, bug-report trackers, launch microsites, and “Deploy this repo as an app.”
- Choose a repo path. Start from scratch to create a new Cursor Origin repository, or point the agent at an existing Origin or GitHub repository. When the app needs a data warehouse or other systems, supply secrets through the prompts or the Apps dashboard so values never enter the agent transcript.
- Preview, then publish. When the agent is ready, Cursor shows a tray to preview the app. Pick a unique domain URL (you can change it later), then publish. Cursor runs the four always-on checks and the AI security review.
- Fix blocked issues and republish. If a check fails, the agent lists what to fix. Tell it to remediate, then publish again. The changelog states that nothing goes live until checks pass and you explicitly publish.
- Share the link. Invite people or groups, share with the whole team, or, on individual plans, make the app public. Team admins control whether public sharing is allowed.
For scripted callers after publish, create a Cursor API key and call the live URL with curl -H "x-cursor-app-token: $CURSOR_API_KEY" https://<your-app-url>. Requests made with a key are marked as automated and identify the key, not a person.
Sharing, API keys and admin controls
Sharing has three tiers: people you invite, the entire Cursor team, and public. Public sharing is off by default for Teams and Enterprise. Personal API keys open apps their owner can open; team keys open only granted team apps. Public apps accept either key like a normal visitor.
Team admins can see every app and secret, add custom security-review rules, approve blocked publishes (except malicious code, hardcoded secrets, or exposed credentials), unpublish apps, and control whether Apps, public sharing, or API-key access are allowed. Audit logs record these setting changes. Custom review instructions cannot remove the built-in publish checks.
The four always-on checks block secrets in app files, block credential files, omit .env files, and omit source maps.
Plans, limits and how this differs from earlier Cloud Agents
Cursor bills Cloud Agents against your plan usage at the selected model’s rate (Cloud Agents overview). The Apps docs do not list a separate Live Apps price. Hosting is separate from Cursor’s core services and is provided as-is; Cursor may revoke a subdomain, account, or published app for policy or Acceptable Use reasons.
Compared with the October Cloud Agents updates in our Cloud Agents guide, Live Apps adds managed hosting, optional Postgres, Cursor SSO, a publish tray, and the Apps dashboard. It does not replace pull-request workflows, and it is not a substitute for the Cursor Agent SDK. For self-hosted coworker agents, compare Open Duet 0.8. For a CLI-centric path, see Antigravity CLI 1.5.
Limits to remember: you need a cloud agent; GitHub and Cursor Origin are the launch repo sources; public sharing on Teams and Enterprise needs an admin toggle; automated clients must use the header-based API key.
Frequently asked questions
What are Cursor Live Apps?
Live Apps are web apps that a Cursor cloud agent builds and publishes for you. Cursor hosts the app, can provision Postgres and Cursor SSO auth, and returns a live URL after you publish and security checks pass. The feature shipped in the November 5, 2026 changelog.
Which Cursor plans include Live Apps?
Cursor’s Apps docs state that Apps is available on all paid plans with access to cloud agents. Free and Plus do not include Cloud Agents, so they do not include Live Apps.
Can I build a Live App from an existing repository?
Yes. The November 5 changelog says Cursor can deploy apps from new or existing repos on Cursor Origin and GitHub. Support for other git providers such as GitLab is listed as coming soon. You must use a cloud agent; the feature is not supported locally.
What security checks run before an app goes live?
Four checks always run: blocking secrets written in app files, blocking credential files, never publishing .env files, and never publishing source maps. An AI security review also reads the app and can block serious issues. Nothing goes live until checks pass and you explicitly publish.
How do scripts or Grok Bot call a private Live App?
Provision a Cursor API key and send it on every request in the x-cursor-app-token header. Personal keys open apps their owner can open; team keys open only the team apps they are granted. There is no query-parameter or cookie path for the key.
Can teammates open public Live Apps?
On individual plans you can share apps publicly. For Teams and Enterprise, public sharing is disabled by default; a team admin can turn it on in the Apps dashboard. Admins can also unpublish any app and see every app and secret on the team.
Sources
- Cursor Changelog: Build Live Apps in Cursor (November 5, 2026)
- Cursor Docs: Cloud Agent Apps
- Cursor Docs: Cloud Agents overview
- Cursor Docs: Cloud Environment Setup
- Cursor Changelog index
Featured image: Laptop coding programs (Unsplash), Wikimedia Commons, CC0 public domain.