Developers

Polymai coordinates the work around your coding agent.

It prepares the task before coding, then connects services and checks the finished result.

Get the VS Code extension

01

Polymai

Plans, connects, verifies

Keeps every step around the code connected.

02

Your coding agent

Writes the code

Works from the task Polymai prepared.

03

Your providers

Run the live services

Provide only what the app needs.

Full build checklist

What you need for a complete build.

Every build needs a Polymai account, planning AI, and a coding agent. Other services are added only when the app needs them.

Accounts, tools, and provider access used during a complete Polymai app build.
Build area	What you need	When it is needed
Polymai account	A Polymai activation token from your account page.	Core Activates the extension and checks your app quota.
Planning AI	An OpenAI or Anthropic API key, or a configured local model.	Core Used by Polymai to shape the brief, plan the project, and prepare the coding task.
Coding agent	Codex, Claude Code, or another compatible coding agent installed and signed in.	Core Run after Polymai has prepared the task files. The agent login is separate from Polymai API keys.
Supabase	Project URL and publishable key; provisioning also needs secure project, database, and Management API access.	When used For database, sign-in, storage, Edge Functions, or automated backend provisioning.
Stripe	Publishable and secret keys, webhook signing secret, plus Price IDs or server-owned price configuration.	When used For checkout, subscriptions, billing portals, invoices, or payment verification.
Email	A Resend API key and a verified sender or domain.	When used For transactional email such as sign-in links, receipts, notifications, or alerts.
Generated app AI	A separate OpenAI or Anthropic provider key for server-side AI features in the generated app.	When used Only when the app itself runs analysis, summaries, assistants, or other AI jobs.
GitHub	A personal access token with access to the target repository or organization.	When used When Polymai creates repositories, publishes the app, or configures GitHub Pages workflows.
Calendar or Meet	A Google Cloud OAuth client ID. Do not enter a client secret in Polymai.	When used Only for apps that connect Google Calendar or Google Meet.

Readiness shows connected, missing, and unused services. Secrets never belong in public files; the storage and data boundaries are documented below.

Credentials and saved data

Secrets, public configuration, and project data are kept separate.

Select a card for the exact boundary. Polymai uses VS Code’s encrypted secret storage for credentials, separates public runtime values, and does not make an absolute security promise.

Secret credentials

Encrypted locally; sent directly to the provider.

API keys, private tokens, database passwords, and webhook secrets are kept in VS Code SecretStorage, not normal settings, generated frontend files, or the extension package. When used, they go over HTTPS directly to the selected AI, GitHub, Supabase, Stripe, or email provider. For generated Supabase apps, runtime secrets are placed in your own server-side Edge Function environment.

Public app configuration

Visible by design; never a substitute for access control.

Project content

Local workspace history is useful, but not a secret vault.

Project files, prompts, logs, indexed content, and local history stay in the workspace and normal VS Code local storage. A prompt is sent to the selected AI or coding agent only when you run that action, and source can be published when you choose to publish it. Never put credentials or sensitive customer data in prompts, files, logs, or project notes.

Polymai account data

Account records support access, quota, and app status.

Your activation token is encrypted locally. The Polymai account backend stores a SHA-256 hash plus limited token metadata—not the raw token—and uses it over HTTPS for activation, quota, and app-stat checks. Account records contain identity, plan, usage, generated-app status, and relevant billing references; extension app records use hashes rather than raw workspace paths or prompts.

Use a protected device, test and least-privilege keys where possible, and rotate or revoke a provider key if you suspect exposure. Review generated code and repository contents before publishing.

What Polymai produces

A real project you can inspect and change.

Small files, clear ownership, reviewable changes.

Focused app files

Small files with clear ownership.

Project map

One map for every later change.

Use any compatible coder

Use the coder that fits the task.

Safe, focused updates

Change the app without losing context.

Ongoing provisioning

Service setup updates after every coder run.

Find changes, apply what is needed, and check the result.

01 · Detect

Find what changed

Find what changed after the coder run.

02 · Supabase

Apply the required services

Provision the detected backend changes.

03 · Payments

Keep money changes explicit

Automate tests, confirm live changes.

04 · Publish

Connect publishing

Publish when the project is ready.

05 · Verify

Check and prepare the next fix

Turn blockers into the next focused task.

Run mode: one click normally, automatic in test mode, and confirmed manually for live payment changes.

Setup Model

Your code and service accounts stay yours.

Real files in VS Code, connected to the services you choose.

Any compatible coding agent after Polymai prepares the task
Data, auth, storage, and server functions when needed
Payments, email, and publishing only when used