Polymai

Polymai is an AI app-building workflow inside VS Code. It helps you turn a product idea into a planned app contract, hand the work to Codex or Claude Code, preview the result, provision connected services, and track generated apps from your Polymai account.

Polymai is built for builders who want fast app generation without giving up structure, reviewability, or ownership of their provider accounts.

See Polymai In Action

Watch the demo on YouTube

Accounts And API Keys

Polymai uses a bring-your-own-account model. Only a Polymai activation token is needed to activate the extension; other credentials are required only for the providers and features you choose to use.

Feature	What you need	When it is needed
Polymai account	Polymai activation token	Required to activate the extension and check app quota
Cloud AI	OpenAI API key and/or Anthropic API key	When you run supported cloud models directly from Polymai
Codex or Claude Code handoff	The corresponding installed and signed-in CLI or VS Code extension	When you hand implementation work to that coding agent; an API key is not entered in Polymai for the handoff itself
Supabase	Project URL, publishable/anon key, and—when provisioning server-side resources—service-role key, database credentials, and a Management API token	Only for apps that use Supabase or automated Supabase provisioning
Stripe	Publishable key, secret key, webhook signing secret, and relevant Price IDs	Only for apps that use Stripe payments
GitHub	Personal access token with access to the target repository or organization	Only when Polymai creates or publishes to GitHub repositories or GitHub Pages
Email	Resend API key plus a verified sender/domain	Only for apps that send email through Resend
Google Calendar or Meet	Google Cloud OAuth client ID; do not enter a client secret in Polymai	Only for apps that use Google Calendar or Meet integrations

Provider secrets are entered after installation and stored through VS Code secret storage where applicable. They are not included in the extension package. Start with test-mode and least-privilege credentials, and never place server-side secrets in generated frontend code. Detailed setup links are included below under Full Setup Checklist and Where To Find Provider Keys.

How Credentials And Saved Data Are Handled

Polymai separates secret credentials, intentionally public runtime configuration, local project content, and Polymai account records. No software can truthfully promise absolute security: protect the device that runs VS Code, use least-privilege keys, and rotate or revoke a provider key if you suspect exposure.

Value or data	Where it is kept	How it is used	Public?
Polymai activation token	Encrypted in local VS Code `SecretStorage`. The Polymai account backend stores only a SHA-256 hash with limited token metadata, not the raw token.	Sent over HTTPS to Polymai account endpoints for activation, quota, and app-stat checks.	No. Revoke it from your Polymai account if exposed.
Planning AI keys	Encrypted in local VS Code `SecretStorage`.	Sent over HTTPS directly to the selected AI provider when you run planning or chat; not routed through the Polymai account backend for the provider call.	No.
GitHub, Supabase, Stripe, email, and generated-app AI secrets	Encrypted in local VS Code `SecretStorage`.	Sent over HTTPS directly to the selected provider for testing, provisioning, deployment, or publishing. Generated-app runtime secrets are provisioned to the user's own server-side environment, such as Supabase Edge Function secrets.	No.
Public runtime configuration	Normal extension/project configuration and, when needed, generated frontend code.	May include a Supabase URL and publishable/anon key, Stripe publishable key, Price IDs, or Google OAuth client ID.	Yes, by design. It is not a server secret.
Project files, prompts, logs, and local history	Workspace plus normal local VS Code storage/indexes. This is not encrypted secret storage.	A prompt goes to the selected AI or coding agent only when the user runs that action. Source can be published if the user chooses to publish it.	Potentially. Never put secrets or sensitive customer data there.
Polymai account and usage records	Polymai account backend.	Stores account identity, plan/quota, token metadata, generated-app status, and relevant billing references. Extension app records use hashed workspace-path and prompt identifiers rather than raw local paths or prompts.	No.

VS Code SecretStorage encrypts credentials at rest using the platform credential mechanism; it is not a separate Polymai cloud vault. A compromised device, malicious process with your user access, or weak operating-system credential-store configuration can still put secrets at risk. Review generated code and repository contents before publishing.

Generated browser code receives only intentionally public configuration. Keep privileged values in a server-side environment, such as Supabase Edge Function secrets, and protect Supabase data with Row Level Security and authorization policies as described in Supabase's API-key guidance. Read the matching Polymai security guide.

What Polymai Does

Turns ideas into app build plans and handoff files.
Opens build tasks in supported coding agents such as Codex and Claude Code.
Provides app previews while files are being created or updated.
Helps provision supported services such as Supabase, Stripe, GitHub Pages, and Resend when configured.
Tracks app quota and generated app usage through your Polymai account.
Keeps provider accounts bring-your-own-key, so your OpenAI, Supabase, Stripe, GitHub, and email usage stays under your control.

Install And Activate

Install the Polymai extension in VS Code.
Open the Polymai activity bar view.
Create or open your Polymai account.
Create an activation token on your Polymai account page.
Paste the activation token into Polymai Settings -> Account in VS Code.
Connect the provider accounts you want to use in Polymai Settings.

The extension can be installed freely. App quota, subscription status, activation tokens, and app stats are managed through your Polymai account.

Bring Your Own Keys

Polymai does not include provider accounts or provider credits. You connect your own accounts where needed.

Supported configuration areas include:

OpenAI or compatible AI model providers
Supabase projects, database access, Auth, Storage, and Edge Functions
Stripe payments and webhooks
GitHub publishing
Resend transactional email
Local preview and local/offline app data where supported

Secrets are stored through VS Code secret storage where applicable. Generated frontend apps should only receive frontend-safe configuration.

Build Workflow

Polymai works in a staged flow:

Describe the app or change you want.
Polymai plans the structure and required files.
Polymai creates a build task for a coding agent.
You hand the task to Codex, Claude Code, or another worker.
Preview and review the result in VS Code.
Provision connected services when the app requires them.
Publish or continue iterating.

What You Can Build

Polymai is designed for app projects that benefit from planning, previews, and connected services, such as:

SaaS prototypes
dashboards and portals
internal tools
landing pages and product sites
apps using Supabase Auth, database, Storage, or Edge Functions
apps using Stripe Checkout, subscriptions, or webhooks
static apps published to GitHub Pages or another static host

Explore more Polymai examples.

Polymai.com is also built using Polymai.

Requirements

Core requirements:

VS Code
A Polymai account and activation token
Your own provider accounts and keys for the services you enable

Optional external tools:

Codex or Claude Code for agent-based implementation
Supabase project access for database, Auth, Storage, and Edge Function provisioning
Stripe account access for payment features
GitHub token for repository publishing
Playwright Chromium for some visual capture flows
Ollama or another local model service if you choose to use local models

Polymai does not install or operate third-party provider services for you. Provider setup, usage, pricing, limits, and compliance remain under your own provider accounts.

Full Setup Checklist

Polymai can run with only an activation token, but full app-building and provisioning features require connected provider accounts.

For AI planning and app generation:

Polymai activation token from your Polymai account
OpenAI API key, or another configured model provider
Codex, Claude Code, or another coding agent if you use agent handoff

For Supabase-backed apps:

Supabase project URL
Supabase publishable/anon key
Supabase service role or secret key for server-side/provisioning work
Supabase database connection string and database password for schema provisioning
Supabase Functions base URL for Edge Function calls
Supabase Management API access where automated Edge Function/Auth/template provisioning is used

For payments:

Stripe publishable key
Stripe secret key
Stripe webhook signing secret
Stripe Price IDs for fixed plans, or server-side price configuration for dynamic checkout
Stripe test mode first; live mode only after you have verified your own Stripe setup

For publishing:

GitHub personal access token with access to the target repository or organization
Target repository name and branch
GitHub Pages enabled if you publish static apps there

For email:

Resend API key
Verified sending domain or sender address in Resend
Sender and notification email addresses for generated apps that send email

For optional local/visual features:

Playwright Chromium installed for screenshot-based visual review
Ollama running locally if you choose local model execution

You can configure these gradually. Polymai readiness checks show what is connected, missing, or only required for the current app.

Where To Find Provider Keys

Most provider dashboards require you to sign in first. Use test mode keys for early app builds.

Polymai account:

Activation token

OpenAI:

Anthropic / Claude:

Supabase:

Project dashboard
Project URL and API keys: open your project, then Settings -> API Keys or Integrations -> Data API
API key documentation
Data API documentation
Management API access tokens
Management API documentation
Database connection string: open your project, then Connect or Project Settings -> Database
Edge Functions URL: usually https://PROJECT_REF.supabase.co/functions/v1

Stripe:

GitHub:

Resend:

Google Calendar / Meet:

Optional local tools:

Privacy And Legal

Use of Polymai is governed by the Polymai legal terms.

Polymai uses your activation token to check subscription access, quota, and app stats. Provider API keys and secrets should remain in your local VS Code secret storage or your own provider environments.