How to Deploy Your Vibe-Coded App: The Non-Coder's Checklist (Localhost to Live)

Every failed first deploy traces back to five predictable gotchas: environment variables, build versus dev commands, authorised domains, DNS records, and missing budget caps. Work through them in order and most apps go live the same evening. The five, in the order they usually bite: 1. Environment variables that exist on your laptop but not in your hosting panel. 2. A build command that is stricter than the dev command you have been testing with. 3. Authorised domains and callback URLs in your auth and database config that still point to localhost. 4. DNS records for your custom domain that were never created, or point at the wrong place. 5. Budget caps and billing alerts nobody set, so the first mistake becomes the first invoice. Each gotcha gets its own short section below, with the exact check to run. Across 13 vibe-coding tutorials analysed for this guide, these five account for nearly every on-camera deploy failure (13Labs research, 2026). None of them requires reading code. All of them require knowing they exist before you click deploy.

Your app works on localhost because your keys sit in a local file your host never sees. Until you re-enter every variable in your hosting provider's dashboard, the deployed version of your app has no keys at all. Your .env.local file lives on your laptop and is deliberately excluded from Git. That is correct for security and fatal for deployment. Open your hosting panel (in Vercel: Project, Settings, Environment Variables) and copy across every variable your app reads, one name at a time. A single typo in a name fails silently. This is so predictable that instructors see it coming. Midway through the flagship tutorial, Riley Brown tells his audience, 'I'm pretty sure it's going to fail because we haven't yet entered our environment variables,' and it does (Riley Brown, 2026). In the same 180,928-view video, his AI tool writes a secret API key directly into a route file twice, and both times he has to catch it by eye (Riley Brown, 2026). The check: after deploying, open the live URL and exercise every feature that uses a key: login, a database write, an AI call. Whichever one fails names the missing variable.

The dev command you have been running all week rebuilds your app on every keystroke and forgives loose ends. The build command your host runs is stricter, and its verdict decides whether anything goes live at all. Run npm run build on your laptop before you push. It compiles the production version exactly the way your host will, and it fails on things dev mode shrugs at: type errors, unused imports, unescaped characters. Fixing those at home takes minutes. Reading them out of a deploy log at midnight takes hours. When a build fails, scroll to the last twenty lines of the log, copy the error, and paste it into your AI tool with the words 'this is my production build error'. That one habit turns a wall into a speed bump, and nobody teaches it. One creator's breakdown of a typical vibe-coded build counted 10 minutes of AI generation followed by 90 minutes of debugging edge cases, an hour of refactoring, and 3 hours of production firefighting (DevForge, 2026). The check: your host shows a green Ready status and the live URL loads without a console full of red.

Login that works on localhost but silently dies on your live URL is almost always an authorised-domain problem. Your auth provider still trusts only localhost, so it politely refuses to talk to your new domain. Riley Brown hits this exact rock on camera: 'When I click on this, nothing happens. We're getting an error... localhost is automatically authorized... but it's not set up for the deployed one' (Riley Brown, 2026). The fix took him one trip to Firebase's settings. First-timers lose evenings here because the error message never mentions domains. Add every URL your app can be reached at: the yourapp.vercel.app preview address, your production address, and your custom domain once you have one. Firebase calls the setting 'Authorized domains'. Supabase keeps the same idea under Authentication, URL Configuration, where redirect URLs must be listed. Clerk, Auth0 and Stripe webhooks all have their own equivalent lists. While you are in the database console, check your access rules. Firebase's test mode, the default most tutorials teach, expires and locks your database 30 days after creation (Google Firebase documentation, 2026), and one creator who audits vibe-coded apps blames test-mode thinking for 'almost every single headline' breach (Chris Raroque, 2026). The check: sign up fresh on the live URL and complete the full login loop.

A custom domain is two records and a waiting game. You tell your registrar where to point, you tell your host which domain to expect, and then you wait for the internet to notice. Buy the domain from any registrar, then add it on your host's domains page. Your host will show you the records to create: usually an A record for the bare domain and a CNAME record for www. Copy them exactly into your registrar's DNS page. One wrong character and nothing resolves. Propagation is the part that feels broken but is not. DNS changes can take up to 24 to 48 hours to reach every corner of the internet, though most resolve within the hour (Vercel documentation, 2026). Your host provisions the HTTPS certificate automatically once it can see the domain pointing at it, so a certificate warning on day one usually means wait, not fix. The check: open the domain on your phone using mobile data, not wifi. Your phone holds no cached answers, so if it loads there, it loads everywhere.

The cheapest insurance in your stack is a spending limit. Set hard caps and billing alerts on every paid service the day you deploy, before a leaked key or a runaway script turns into an invoice. This is not theoretical risk. Creator Chris Raroque tells his audience, 'I woke up to a $30,000 bill,' after one leaked environment variable let strangers run machine-learning jobs on his AWS key (Chris Raroque, 2026). He adds that 'people woke up to a $50,000 bill' in other cases, and warns it is far better for your app to go down briefly than to eat a five-figure charge (Chris Raroque, 2026). When he audited viewers' vibe-coded apps, over half had the same payment-bypass flaw (Chris Raroque, 2026). Set the caps where the money leaves: a usage limit with your AI provider (OpenRouter and OpenAI both offer them), spend management on Vercel, the spend cap on Supabase, and budget alerts in Google Cloud for Firebase. Ten minutes, once, per service. The check: log into each billing page and confirm a dollar limit and an alert email exist. If you cannot find the page, that is your answer.

You are deployed when a stranger can open your app on their phone, use its main feature, and create data that survives a refresh. A green tick in your hosting dashboard is necessary but nowhere near sufficient. Run the stranger test yourself, in order, on mobile data: 1. Open your custom domain on your phone. 2. Create a brand new account. 3. Do the one thing your app exists to do. 4. Refresh the page and confirm your data is still there. 5. Send the link to one friend and watch what happens. Step 5 is where silent problems surface, because real users click what you never thought to test. One retailer's AI-built search feature queried the database on every keystroke and crashed the site in 4 minutes, at about $12,000 per minute in lost sales (DevForge, 2026). It worked in testing. It failed at traffic. When all five steps pass, you are not almost deployed. You are live. Screenshot the URL, because the next hundred decisions get easier from here.

Get help when you have run the checklist and the same error survives three honest attempts. Past that point, solo debugging stops being persistence and starts being tuition paid in weekends. The self-taught route is real but priced in hours. One creator logged more than 500 hours programming with AI before publishing his lessons (The Coding Sloth, 2026). The $20,000-per-month builder Starter Story profiled needed 6 to 8 months and a failed first app before anything worked (Starter Story, 2026). Both got there. Neither got there fast. The usual solo loop is screenshot, paste, hope. It works right up until your project stops matching any tutorial, and then there is nobody to ask. If you would rather ship with support, week 3 of buildAcademy is a full debug-and-ship session: you bring your app, we work the checklist with you, and you deploy it live with mentors in the room. Cohorts are small, live and Melbourne-based. Details at 13labs.au/buildacademy.

Why does my app work on localhost but fail when deployed? Three causes cover most cases. Your environment variables never made it into the hosting panel, your production build is stricter than your dev server, or your auth provider does not recognise the new domain. The checklist above walks through each fix in the order they usually bite. Do I need to know how to code to deploy my app? No. Deployment is configuration, not coding: copying values into panels, adding domains to lists, creating two DNS records. Everything in this guide is clicking and pasting. What you need is the map of which panels matter, which is what most tutorials skip. How long does a first deployment take? With the checklist, one focused evening is realistic for a typical vibe-coded app. Without it, creators report losing entire weekends to a single silent error. Riley Brown fixed his live auth failure in minutes on camera, but only because he had seen the authorised-domains gotcha before. How much does it cost to put a vibe-coded app live? Usually nothing beyond the domain at first. Vercel, Supabase and Firebase all carry free tiers that cover a small app's early life. The real paid risk is not hosting fees but uncapped API usage, which is why budget caps come before you share the link. Is it safe to deploy an app that AI wrote? Ship it, but verify the boring parts first. Researchers at Stanford found programmers using AI assistants wrote significantly less secure code while believing it was more secure (Stanford University, cited by Logically Answered, 2026). Set budget caps, check your database rules, keep secrets out of your code, and have someone experienced review anything touching payments.