Polymai

Plan, build, and improve apps in VS Code.

Polymai turns your idea into a structured app plan and hands implementation to Codex, Claude Code, or another coding agent. Preview the result, connect the services your app needs, and keep building from the same requirements and project structure.

Work with your preferred AI tools and connect Supabase, Stripe, GitHub, and other supported services as your app takes shape.

From First Prompt To Working App With Codex

Use Codex throughout the Polymai workflow: describe your idea, refine the requirements, create a structured plan, and continue building and iterating in the OpenAI Codex VS Code extension.

Install the Codex extension and sign in with ChatGPT, then select AI & Agent → AI connection → Codex (ChatGPT sign-in) in Polymai. Codex powers the dialogue and planning through the local Codex connection while Polymai manages the process. When the build task is ready, click Open Codex Plugin: Polymai attaches POLYMAI_TASK.md to the Codex thread. Press Enter in Codex to send the task and begin implementation.

Your original prompt, clarifications and approved acceptance criteria travel with the task. Polymai's Tinyfiles structure and file registry keep the project organized for later changes, and you can hand the work to another coding agent when needed.

No separate OpenAI API key is needed for this planning and coding flow when both use Codex with ChatGPT sign-in. It uses your account's Codex access and usage limits. AI features inside the generated app and connected services such as Supabase or Stripe retain their own configuration.

See Polymai In Action

Watch the demo on YouTube

Accounts And API Keys

A Polymai account is optional. For AI planning and implementation, configure the AI connection or coding agent you want to use. Other credentials are needed only for the services and features you enable.

Feature	What you need	When it is needed
Polymai account (optional)	Account connection token from polymai.com	Only to view account information and register new apps with your Polymai account
Cloud AI	OpenAI API key and/or Anthropic API key	When you run supported cloud models directly from Polymai
Codex planning connection	Local Codex CLI or Codex VS Code extension, signed in with an eligible ChatGPT account	An alternative to direct API calls for Polymai dialogue and planning, starting with the first message
Codex or Claude Code handoff	The corresponding installed and signed-in CLI or VS Code extension	When you hand implementation work to that coding agent; an API key is not entered in Polymai for the handoff itself
Supabase	Project URL, publishable/anon key, and—when provisioning server-side resources—service-role key, database credentials, and a Management API token	Only for apps that use Supabase or automated Supabase provisioning
Stripe	Publishable key, secret key, webhook signing secret, and relevant Price IDs	Only for apps that use Stripe payments
GitHub	Personal access token with access to the target repository or organization	Only when Polymai creates or publishes to GitHub repositories or GitHub Pages
Google Play	A Play Console app plus a least-privilege Google service account with Android Publisher access	Only when Polymai uploads a signed AAB to Internal testing
Email	Resend API key plus a verified sender/domain	Only for apps that send email through Resend
Google Calendar or Meet	Google Cloud OAuth client ID; do not enter a client secret in Polymai	Only for apps that use Google Calendar or Meet integrations

Provider secrets are entered after installation and stored through VS Code secret storage where applicable. They are not included in the extension package. Start with test-mode and least-privilege credentials, and never place server-side secrets in generated frontend code. Detailed setup links are included below under Full Setup Checklist and Where To Find Provider Keys.

Choose The Planning Connection

In AI & Agent → AI connection, choose API (current flow) or Codex (ChatGPT sign-in). API remains the default and keeps the existing OpenAI, Anthropic and local Ollama settings. Each connection keeps its own model preferences.

For Codex, use Check connection. If needed, Install Codex opens the extension listing and Sign in with ChatGPT opens the Codex sign-in flow. Polymai discovers available models and reasoning levels from Codex. The model runs online through Codex; it is not an offline model installation and uses your ChatGPT account's Codex access and limits.

Polymai still owns the dialogue, prompts, plan validation and approval steps. Once the plan is ready, choose Codex, Claude Code or another coding agent for implementation. The planning connection does not decide that handoff.

Codex planning does not use saved provider API keys or silently switch to an API after an error. Image analysis is supported; API image generation is separate and skipped in Codex mode. Retrieval uses local embeddings or text search. App AI settings for the generated app remain separate.

How Credentials And Saved Data Are Handled

Polymai separates secret credentials, intentionally public runtime configuration, local project content, and Polymai account records. No software can truthfully promise absolute security: protect the device that runs VS Code, use least-privilege keys, and rotate or revoke a provider key if you suspect exposure.

Value or data	Where it is kept	How it is used	Public?
Optional Polymai account token	Encrypted in local VS Code `SecretStorage`.	Sent over HTTPS to the Polymai account API when you connect, refresh account information, or register new apps while connected.	No. Revoke it from your Polymai account if exposed.
Planning AI keys	Encrypted in local VS Code `SecretStorage`.	Sent over HTTPS directly to the selected AI provider when you run planning or chat; not routed through the Polymai account backend for the provider call.	No.
GitHub, Supabase, Stripe, email, and generated-app AI secrets	Encrypted in local VS Code `SecretStorage`.	Sent over HTTPS directly to the selected provider for testing, provisioning, deployment, or publishing. Generated-app runtime secrets are provisioned to the user's own server-side environment, such as Supabase Edge Function secrets.	No.
Android release credentials	The generated upload keystore is stored in VS Code's extension storage outside the app; its random password and an optional Google Play service-account JSON are encrypted in local VS Code `SecretStorage`.	Signs the release AAB and, when requested, authenticates directly to the Google Play Android Publisher API.	No. Neither value is written into the generated app or repository. Back up the upload key.
Public runtime configuration	Normal extension/project configuration and, when needed, generated frontend code.	May include a Supabase URL and publishable/anon key, Stripe publishable key, Price IDs, or Google OAuth client ID.	Yes, by design. It is not a server secret.
Project files, prompts, logs, and local history	Workspace plus normal local VS Code storage/indexes. This is not encrypted secret storage.	A prompt goes to the selected AI or coding agent only when the user runs that action. Source can be published if the user chooses to publish it.	Potentially. Never put secrets or sensitive customer data there.
Optional Polymai app records	A local retry queue in VS Code workspace storage and, after successful registration, your Polymai account.	New builds started while connected can report app names, identifiers, status, timestamps, file counts, and the build method. Account reporting does not send source code, raw prompts, provider keys, or raw local workspace paths.	No.

VS Code SecretStorage encrypts credentials at rest using the platform credential mechanism; it is not a separate Polymai cloud vault. A compromised device, malicious process with your user access, or weak operating-system credential-store configuration can still put secrets at risk. Review generated code and repository contents before publishing.

Generated browser code receives only intentionally public configuration. Keep privileged values in a server-side environment, such as Supabase Edge Function secrets, and protect Supabase data with Row Level Security and authorization policies as described in Supabase's API-key guidance. Read the matching Polymai security guide.

What Polymai Does

Turns ideas into app build plans and handoff files.
Opens build tasks in supported coding agents such as Codex and Claude Code.
Provides app previews while files are being created or updated.
Helps provision supported services such as Supabase, Stripe, GitHub Pages, and Resend when configured.
Can generate an isolated Capacitor Android sidecar, a debug APK for device testing, and a release-signed AAB for Google Play.
Can upload the signed AAB directly to an existing app's Google Play Internal testing track.
Uses live website delivery as the default Android wrapper model, so ordinary hosted HTML, CSS, and JavaScript releases do not require a new Android binary; bundled delivery remains available for offline-first apps.
Optionally registers new apps with your Polymai account and displays account statistics.
Keeps provider accounts bring-your-own-key, so your OpenAI, Supabase, Stripe, GitHub, and email usage stays under your control.

Get Started

Install the Polymai extension in VS Code.
Open a project folder and the Polymai activity bar view.
In Settings -> AI & Agent, configure your planning connection and preferred coding agent.
Describe your app, review the plan, and hand it to your coding agent to build.

Connect services such as Supabase, Stripe, or GitHub when your app needs them. No Polymai signup or activation is required to plan, build, or hand work to a coding agent.

Optional Polymai Account

Connect a Polymai account if you want new apps registered on polymai.com. Create a token on the account page, then paste it into Settings -> Account -> Account connection token and select Connect account. The website may call this an activation token; it connects your account and is not needed to use the extension.

New builds started while connected can register an app record in the background once generated output is available. The record contains the app name, identifiers, status, timestamps, file count, and build method. Existing projects and builds started without an account connection are not uploaded later.

Account registration limits, expired tokens, and account service outages do not block planning, building, or agent handoff. Disconnecting stops further account reporting and clears pending local reports. Records already registered remain in your Polymai account. Your chosen AI providers and connected services retain their own usage limits.

Bring Your Own Keys

Polymai does not include provider accounts or provider credits. You connect your own accounts where needed.

Supported configuration areas include:

OpenAI or compatible AI model providers
Supabase projects, database access, Auth, Storage, and Edge Functions
Stripe payments and webhooks
GitHub publishing
Resend transactional email
Local preview and local/offline app data where supported

Secrets are stored through VS Code secret storage where applicable. Generated frontend apps should only receive frontend-safe configuration.

Build Workflow

Polymai works in a staged flow:

Describe the app or change you want.
Polymai plans the structure and required files.
Polymai creates a build task for a coding agent.
You hand the task to Codex, Claude Code, or another worker.
Preview and review the result in VS Code.
Provision connected services when the app requires them.
Publish or continue iterating.

Android Delivery Models

Polymai keeps Android generation isolated under mobile/android-wrapper and offers two explicit delivery choices:

Live website (default): the Android WebView loads one configured HTTPS app URL. The generated shell disables cleartext and mixed content, records the exact trusted origin, provides a local connection-error page, and advertises the worker contract's versioned PolymaiNativeBridge/<version> marker. Normal web releases appear without rebuilding the Android binary.
Bundled web app: Polymai copies a verified web build into the Android sidecar. This can start without the hosted website, but every web change needs a new Android build.

Android support starts with a new version-1 profile for each app. There is no legacy Android profile or previously released Polymai Android app to migrate. Re-running generation only updates the sidecar that Polymai created for that same project, and stops if a managed file has been edited manually.

The Android page has one primary Create Android app action, enabled only after a successful GitHub Pages publication and a passing local preflight for Node.js, Java, Android SDK Platform, and Android SDK Build Tools. Missing prerequisites are shown before generation with official download links, and no wrapper files are written until they pass. Polymai detects the app name, published URL, package ID, version, build number, and supported native features; it then prepares the wrapper and builds a debug APK. Once the project exists, Build signed AAB creates or reuses a protected upload key and produces the Play artifact. Publish internal test builds the AAB when necessary and uploads it to the existing Play Console app's Internal testing track. Advanced contains only optional overrides and output links.

Release secrets stay outside the generated project. For a new Play app, Polymai can generate an upload key; for an existing package, it can validate and copy the package's existing upload key. The managed copy stays in VS Code extension storage and its password stays in VS Code SecretStorage; Google service-account JSON is also stored only in SecretStorage. The package ID becomes effectively permanent after the first Play release. The Play Console app must already exist, the Android Publisher API must be enabled, and the service account must have suitable app permissions. Back up the upload key before relying on it for future updates.

Native plugins, permissions, foreground services, icons, signing, and native-bridge contract changes always require a new Android build in either mode. A wrapper does not keep browser JavaScript alive when the screen turns off. For continuous work, Polymai can generate a native specialUse foreground-service host only when the app supplies a validated, app-owned Java worker contract. The generated host requires an explicit user start, displays a persistent notification with a Stop action, exposes versioned configure, start, stop, status, power-settings and storage-clear methods through the trusted-origin Capacitor bridge, and lets the app worker acquire only the bounded Wake Locks its reviewed protocol requires.

The app declares that worker in native/android/background-worker.json:

{
  "version": 2,
  "bridgeApiVersion": 2,
  "purpose": "Keep encrypted peer storage available while the user enables node mode.",
  "notificationTitle": "Node is online",
  "notificationText": "Background storage is active.",
  "workerSource": "native/android/PolymaiAppBackgroundWorker.java",
  "workerSources": ["native/android/PolymaiAppProtocol.java"],
  "gradleDependencies": ["com.example:reviewed-library:1.2.3"],
  "androidPermissions": ["android.permission.INTERNET"],
  "trustedOrigins": ["https://example.com"],
  "restartOnBoot": true
}

Every referenced Java class must use the placeholder package __POLYMAI_PACKAGE__. The primary class implements the generated PolymaiBackgroundWorker interface, cooperates with its stop flag, accepts public configuration through configure, reports a structured status snapshot, and implements app-scoped storage clearing. Polymai validates the exact trusted origins, permission allow-list, pinned Maven dependencies and reviewed source paths, then binds and copies them into the isolated Android project. This separation is deliberate: arbitrary hosted JavaScript, browser WebRTC, IndexedDB, and Web Crypto do not automatically become reliable screen-off code. Each app must implement and device-test its actual long-running behavior in reviewed native sources.

Live website delivery is network-dependent. Its current implementation uses Capacitor's external server.url, which Capacitor documents as a live-reload setting rather than a production distribution mechanism. Polymai can build and upload this shell, but that does not prove the app will pass Play review or behave correctly on real devices. Authentication, routing, offline recovery, external links, native bridge boundaries, background behavior, billing-policy compliance, and store acceptance still require app-specific device and Play testing.

What You Can Build

Polymai is designed for app projects that benefit from planning, previews, and connected services, such as:

SaaS prototypes
dashboards and portals
internal tools
landing pages and product sites
apps using Supabase Auth, database, Storage, or Edge Functions
apps using Stripe Checkout, subscriptions, or webhooks
static apps published to GitHub Pages or another static host

Explore more Polymai examples.

Polymai.com is also built using Polymai.

Requirements

Core requirements:

VS Code
A configured planning connection: Codex, a supported AI API, or a local model
Your own provider accounts and keys for the services you enable

Optional external tools:

Codex or Claude Code for agent-based implementation
Supabase project access for database, Auth, Storage, and Edge Function provisioning
Stripe account access for payment features
GitHub token for repository publishing
Playwright Chromium for some visual capture flows
Ollama or another local model service if you choose to use local models
Node.js 22+, Java 21, Android Studio/SDK, and the generated compile-SDK platform when you choose to build Android artifacts
An existing Play Console app and a least-privilege Android Publisher service account when you choose direct Internal testing upload

Polymai does not install or operate third-party provider services or Android SDK tools for you. Debug APKs use the standard local debug key; release AABs use the separate managed upload key. Provider setup, usage, pricing, limits, policy declarations, store review, and compliance remain under your own provider accounts.

Full Setup Checklist

Configure the tools and services your workflow needs. A Polymai account is optional throughout planning and app building.

For AI planning and app generation:

One planning connection: Codex with ChatGPT sign-in, a supported AI provider API key, or a local model
Codex, Claude Code, or another coding agent if you use agent handoff

For Supabase-backed apps:

Supabase project URL
Supabase publishable/anon key
Supabase service role or secret key for server-side/provisioning work
Supabase database connection string and database password for schema provisioning
Supabase Functions base URL for Edge Function calls
Supabase Management API access where automated Edge Function/Auth/template provisioning is used

For payments:

Stripe publishable key
Stripe secret key
Stripe webhook signing secret
Stripe Price IDs for fixed plans, or server-side price configuration for dynamic checkout
Stripe test mode first; live mode only after you have verified your own Stripe setup

For publishing:

GitHub personal access token with access to the target repository or organization
Target repository name and branch
GitHub Pages enabled if you publish static apps there

For email:

Resend API key
Verified sending domain or sender address in Resend
Sender and notification email addresses for generated apps that send email

For optional local/visual features:

Playwright Chromium installed for screenshot-based visual review
Ollama running locally if you choose local model execution

You can configure these gradually. Polymai readiness checks show what is connected, missing, or only required for the current app.

Where To Find Provider Keys

Most provider dashboards require you to sign in first. Use test mode keys for early app builds.

Optional Polymai account:

Account connection token (called an activation token on the website)

OpenAI:

Anthropic / Claude:

Supabase:

Project dashboard
Project URL and API keys: open your project, then Settings -> API Keys or Integrations -> Data API
API key documentation
Data API documentation
Management API access tokens
Management API documentation
Database connection string: open your project, then Connect or Project Settings -> Database
Edge Functions URL: usually https://PROJECT_REF.supabase.co/functions/v1

Stripe:

GitHub:

Resend:

Google Calendar / Meet:

Optional local tools:

Privacy And Legal

Use of Polymai is governed by the Polymai legal terms.

Connecting a Polymai account enables account information checks and background registration of new apps, as described under Optional Polymai Account. Without that connection, the extension does not send account checks or app reports to the Polymai account API. Your chosen AI tools and connected services process the data needed for their features. Provider API keys and secrets should remain in your local VS Code secret storage or your own provider environments.