Creative tools & workflows
Best AI App Builders: Backend, Deployment, and Ownership
How Lovable, Bolt, Replit, and v0 handle database, auth, server logic, deployment, costs, and ownership.
· · Diagram Studio Editorial
Your AI app builder just produced a screen that looks right. The next question is whether that screen can become something people actually use: records that persist, logins that enforce boundaries, and logic that runs where users cannot bypass it. This article compares documentation and pricing pages checked on 4 November 2026.
It is not a hands-on benchmark, and no app was built, deployed, load-tested, or audited for it. Lovable, Bolt, Replit, and v0 form a focused shortlist because each shows a path from generated UI to a fuller web application. They are not the only options, and none is best for every team.
Direct answer
No single AI app builder suits every team; these four are a focused shortlist, not the whole market. Lovable bundles hosting with a Supabase-based database, auth, storage, realtime, and edge functions. Bolt pairs JavaScript full-stack generation with Bolt Cloud, Git workflows, and paid custom domains. Replit provides a hosted build-and-publish workflow; Core is $18/month billed annually, Pro $90/month billed annually. v0 generates Next.js code deployed through a connected Vercel project. Choose the operating model you can run, then verify data rules, permissions, and payment flows.
What Counts as a Working App
An AI-generated preview can look like a finished product while still being a mockup. For this comparison, an app clears three bars: persistent data, server behavior, and permissions. Records must survive a reload. Useful actions (saving an approval, sending a notification, updating a status) must run outside the browser, where a user cannot rewrite them. And a user should see only what their role allows.
Consider a client portal for a consultancy. Two companies log in, and each should see only its own projects, files, and approvals. If the server answers "show me all projects" instead of "show me projects where owner = current user," either company sees the other's records. If the portal is just a screen with sample data, nothing persists and nothing enforces that boundary. A login screen proves nothing until data is stored per organization, the signed-in user's membership is verified server-side, and every query is filtered to the organizations and roles that user may access.
Each tool in this shortlist documents a path past static UI. Lovable's built-in Cloud includes database, authentication, storage, realtime, and edge functions (Cloud docs). Bolt covers JavaScript-based full-stack apps, with Bolt Cloud adding database, auth/user management, functions, hosting, and domains (getting-started guide). Replit's publish workflow manages the public URL, access controls, production database, monitoring, security scans, and hosting settings (publishing overview). v0's editor supports server-side code, API routes, databases, and environment variables on a Next.js/React/TypeScript/Tailwind/shadcn/ui stack (FAQ).
The decision is not whether these tools can build an app. It is which parts of the lifecycle each tool operates and which parts remain yours.
Four Tools, Four Operating Models
All four converge on generated UI, then diverge on what they operate after generation. The bundle you choose is effectively the operating model you sign up for.
Lovable: one managed backend. Lovable's Cloud runs on a Supabase open-source foundation and combines database, auth, storage, realtime, and edge functions. Enabling any of database, auth, or storage provisions all three together; pausing the shared backend pauses all three. Server-side functions, jobs, secrets, logs, and credit usage live inside the project; a separate Supabase account is not required. That coupling is the tradeoff: the platform handles more, but you manage the bundle as one unit. Custom domains are a paid feature, and a project must be published before the domain serves traffic.
Git sync works on all plans; direct code download is paid. On Pro and above, built-in payments support subscriptions and one-time charges through Paddle or Stripe, still subject to provider verification, go-live requirements, and processing fees.
Bolt: JavaScript full-stack plus Bolt Cloud. Bolt builds JavaScript-based full-stack web applications; mobile apps use the Expo integration rather than a responsive website. Bolt Cloud provides database, authentication and user management, functions, hosting, and domains. Projects publish to a free bolt.host subdomain; custom domains require paid access. A database can be claimed into Supabase for external management. GitHub import, version control, and direct code editing are part of the workflow. The browser environment runs on StackBlitz WebContainers, and code-view access on mobile differs from desktop. Free hosting allows up to 333K requests per month; Pro raises that to 1M. Those are plan caps, not throughput guarantees.
Replit: a hosted build-and-publish workflow. Replit treats publishing as one workflow, not a share button. The Publishing tool manages the public URL, access controls, production database, monitoring, security scans, and hosting settings. Apps get a replit.app URL; a custom domain can be connected after publishing. Production-database setup and deployment configuration (deployment type, machine, secrets, geography) happen as part of that publish flow, so moving an app to production is a configuration step, not just sharing a link.
The free Starter tier offers capped agent chat and one published app for 30 days; full builds and Plan Mode require Core or Pro (AI billing docs). The pricing page currently shows Core at $18 a month billed annually and Pro at $90 a month billed annually; those are annual-billing labels, so confirm the checkout state before purchasing.
v0: a Next.js editor that deploys through Vercel. v0's full editor and sandbox previews run server-side code, API routes, databases, and environment variables. The stack is Next.js, React, TypeScript, Tailwind, and shadcn/ui. Full deployments, previews, and environment configuration go through a connected Vercel project. GitHub integration is optional: v0 can import a repository, branch, commit, and open pull requests, and it does not push directly to main. For GitHub-backed projects, Publish creates or reuses a pull request and merges it before production deployment, so required checks and reviews still apply.
Without GitHub, Publish deploys the current chat directly to the connected Vercel project. Code can be exported and deployed elsewhere, though running outside Vercel changes the operating model.
| Tool | The platform runs | You still own |
|---|---|---|
| Lovable | Hosted app with built-in Cloud: database, auth, storage, realtime, edge functions; project-level secrets, jobs, logs; paid custom domains; Paddle/Stripe payments on Pro+ | Verifying generated data rules and business logic; confirming what an export contains and how data would move; paying provider fees and passing payment verification |
| Bolt | Bolt Cloud: database, auth/user management, functions, hosting, domains; free bolt.host subdomain; GitHub workflow | Custom domains beyond free tier; request caps; claiming a database into Supabase if needed; validating permissions |
| Replit | Hosted publishing: replit.app URL, access controls, monitoring, security scans; production-database and deployment configuration | Choosing access tier within entitlement; configuring machine, secrets, geography; checking annual billing state |
| v0 | Editor/sandbox; optional GitHub flow; deployment through the connected Vercel project | Connecting Vercel; configuring database and services; review gates; deciding whether to stay on Vercel |
Each row is a different contract. A small internal tool may benefit from a bundled backend; a team already in Git and Vercel may fit v0's flow. To judge which contract fits, follow the data first: where it lives and who can reach it.
Where Data Lives, and Who Can Reach It
A generated UI persists nothing until a database exists. Lovable's built-in Cloud provisions database, auth, storage, realtime, and edge functions as one bundle on a Supabase foundation; enabling one provisions all three core services, and a separate Supabase account is not required. Bolt supplies a database through Bolt Cloud and lets you claim it into Supabase for external management; plan pages count databases among included resources, but a count is not a capacity or correctness guarantee. Replit makes production persistence part of the publish flow: the production database has its own setup step within the Publishing tool.
Sharing a Replit preview proves the UI exists, not that records will survive. v0's editor supports databases in the sandbox, but full deployments run through the connected Vercel project; database and service configuration still matter, and the preview and deployed project can diverge.
Authentication answers who gets in; permissions answer what they can do; tenant isolation answers whether one customer's data stays invisible to another. Lovable's auth belongs to the same backend bundle, so pausing that bundle pauses login too. Bolt provisions authentication and user management inside Bolt Cloud; provisioning a login flow is not proof that a signed-in user only sees their own records. Replit's access controls cover public, password-protected, workspace-only, and invite-only access; they guard the app entry point, not application-level roles, and account entitlement determines which tiers are available.
For v0, authentication and session behavior live in the repository you deploy; production security is a property of the deployment, not the preview.
The client-portal example shows why this matters. If the server queries "show me all projects" instead of "show me projects where owner = current user," either company sees the other's records. Planning two test organizations turns that abstraction into a check you can run. The acceptance table below is designed for a trial of any of these platforms. It was designed for this article and not executed; treat it as your evaluation script, not a vendor promise.
| # | Check | Test account/role | Action | Expected result | Result |
|---|---|---|---|---|---|
| 1 | Unauthorized access | Guest | Open a protected URL directly | Redirect to sign-in; no data rendered | ☐ |
| 2 | Cross-tenant and shared-tenant access | User in Company B; another member of Company A | Request Company A's record URL or API endpoint from Company B; open a shared Company A record as a Company A member | Company B receives a 404 or 403 and no Company A data; the Company A member sees the shared record | ☐ |
| 3 | Role limits | Approver | Attempt to edit a record outside role | Edit rejected; action logged | ☐ |
| 4 | Persistence | Customer | Create an approval; reload the page | Record still present | ☐ |
| 5 | Failed upload | Customer | Upload invalid file type or oversize file | Clear error; no partial record | ☐ |
| 6 | Duplicate submission | Customer | Submit same form twice quickly | Exactly one record created | ☐ |
| 7 | Session expiry | Customer | Return after token expires | Prompt for sign-in; no stale session | ☐ |
| 8 | Notification failure | Admin | Trigger a notification with a bad provider key | Failure logged; app keeps working | ☐ |
| 9 | Migration | Admin | Apply a schema change in staging, then production | Both schemas match; existing rows intact | ☐ |
| 10 | Secrets | Admin | Inspect client bundle and repository | No secrets in client code or git history | ☐ |
These checks depend on where the logic runs. A notification or payment call that lives only in a page script can be bypassed or rewritten by the user; the work belongs on the server. Sketch the login and permission flows before prompting, so the builder starts from a concrete model rather than a vague request (flowchart generator).
Server Logic, Secrets, and Integrations
A working app runs code the user cannot edit in the browser. All four platforms give server-side code a place to run; they differ in how much of that environment is visible and how it connects to outside services.
Lovable's built-in Cloud provides server-side functions and jobs alongside database, auth, storage, realtime, and edge functions. Secrets, logs, and credit usage are accessible in the project, so inspection starts where the backend runs. On Pro and above, Lovable's built-in payments support subscriptions and one-time charges through Paddle or Stripe (payments docs). The platform manages the setup, but you still operate a payment provider: the business must qualify, products must be configured, test and live environments differ, and processing fees apply. Managed payment plumbing does not remove provider rules or merchant fees.
Bolt runs functions in Bolt Cloud as part of its JavaScript full-stack platform. The Bolt Cloud console includes a database table view and activity logs alongside edge functions, secrets, and user/auth management, so routine debugging can start there rather than only in a repository. Direct code editing and GitHub import remain available when logic outgrows the prompt interface. If phones are in scope, use the Expo integration rather than assuming a responsive website covers mobile.
Replit treats runtime configuration as part of deploying. Hosting settings cover deployment type, machine configuration, secrets, and geography, and budgets, hard caps, alerts, and usage tracking are available; usage display can lag by up to 30 minutes. Supported third-party APIs can consume credits at their public API prices, so an API key can become a variable cost rather than just a credential.
v0's editor supports server-side code, API routes, databases, and environment variables in the sandbox. Production behavior runs through the connected Vercel project, which is where secrets, routing, and database connections actually matter. For GitHub-backed projects, the pull-request flow places code review before production; without GitHub, deployment is direct to the connected Vercel project.
For any third-party service (email, file storage beyond the bundled limits, AI APIs, SMS) ask three questions: where does the server-side code run, where does the secret live, and what happens when the provider fails or rate-limits? A generated function can place an order only if the integration is wired and the failure path is handled. That is why "did the server return a useful error" belongs in the acceptance checklist.
Deployment, Domains, and Environments
Server logic in a sandbox is not a deployed service. Each platform publishes a live URL, but the route from preview to production differs.
Lovable hosts the app through its built-in Cloud. The default URL is a lovable.app subdomain; custom domains are a paid feature, and the project must be published before the domain serves traffic (custom domain docs). Bolt projects publish to a free bolt.host subdomain; custom domains require paid access. Free hosting supports up to 333K requests per month, Pro up to 1M, and those caps are plan limits rather than measured throughput. Replit publishes to a replit.app URL; a custom domain connects after publication.
Production-database setup and deployment configuration happen inside the Publishing workflow, so publishing means configuring the runtime, not merely exposing a preview. v0 relies on the connected Vercel project for full deployments, previews, and environment configuration. For GitHub-backed projects, Publish creates or merges a pull request before production; without GitHub, Publish deploys directly. Code can be exported and deployed elsewhere, but running outside Vercel changes the operating model.
Before putting real users in front of anything, confirm which environment will serve them and where it runs. Staging, a custom domain, and a production database are separate resources. A preview URL may share data or configuration with a future production app, and a custom domain changes which URL you verify, store, and tell customers about.
| Tool | Default URL | Custom domain | Path to production |
|---|---|---|---|
| Lovable | xxx.lovable.app | Paid, after publish | Hosted by the platform; backend provisioned with the app |
| Bolt | bolt.host subdomain | Paid plans | Publish to bolt.host; claim database into Supabase if needed |
| Replit | replit.app | Connect after publishing | Publishing workflow configures production database and deployment settings |
| v0 | Via connected Vercel project | Through Vercel | PR merge for GitHub-backed projects; direct otherwise |
A deployed app answers where it runs. The harder question is what you keep if you leave.
Export, Git, and What You Actually Own
Ownership is the test that comes after deployment. When a client asks who holds what, or when you decide to leave a platform, you need two separate answers: whether you can take the code, and whether you can move the operations. These often get blurred in AI app builder marketing.
Lovable states that customers own their code, customer data, and generated output, subject to third-party rights (pricing). Its GitHub integration syncs project code in two directions and works on all plans; a direct codebase download is a paid feature (GitHub docs). The sync creates a new repository and syncs one branch at a time. Bolt documents GitHub import, version control, and direct code editing. v0's optional GitHub integration imports a repository, branches, commits, and opens pull requests; code can be exported and deployed elsewhere. Replit's documentation used here does not detail a code-export workflow; if you expect to leave, verify that path before relying on it.
A repository gives you source access and version history. It is not a statement of legal ownership of every dependency, generated asset, or third-party component; that is a terms question, not a Git question.
Code is only half the exit. The production database records, authenticated users, uploaded files, secrets, scheduled jobs, and edge-function state live in the managed environment. Because Lovable's shared backend provisions database, auth, and storage together, pausing it pauses all three; exporting a repository does not automatically move hosted records or identities. Bolt offers a route to claim a database into Supabase for external management, but that is a deliberate migration step, not an automatic part of export. Replit's production database has its own setup step. v0 code moved off Vercel runs under a different operating model, with its own environment and secrets.
Treat export as the start of a second project. Ask for the export format, a schema dump of production data, an auth-user migration path, storage and secret backups, and a way to recreate scheduled jobs. Each is a separate verification. Source control proves you have the files; it does not prove you can pick up the production database and move it. That gap affects the choice long before you need to leave. It also shapes what the app costs once real users arrive.
The Real Cost of Running an App
The final piece is what the app costs when people are actually using it. The pricing pages are not interchangeable: Lovable uses credits, Bolt uses tokens with daily and monthly caps, Replit uses credits for agent and cloud work, and v0 uses seats plus model-priced credits. Comparing those numbers directly creates false conversions. The figures below were checked on 4 November 2026, and the vendors' pricing pages remain the purchase authority.
Separate four cost layers:
Monthly cost = build subscription + extra generation + production hosting/database + third-party API costs.
| Tool | Subscription | Extra generation | Hosting/database | Third-party APIs |
|---|---|---|---|---|
| Lovable | Free: 5 build credits/day (30/month cap), 20 monthly Cloud credits, 4 AI-feature credits. Pro: $25/month or $250/year with 100 monthly subscription credits. Business: $50/month or $500/year with 100 credits. Paid credits are shared; members are not charged per seat. Credit value depends on plan and feature. | Default-mode building varies with complexity; Plan Mode costs 1 credit per message. Monthly credits expire after two months; top-ups after 12. | App hosted through built-in Cloud; database, auth, storage, realtime, and edge functions provisioned together. | Payments via Paddle/Stripe on Pro+: provider verification, go-live requirements, processing fees. Other services bill separately. |
| Bolt | Free: 1M tokens/month, 300K daily cap, branding, 10MB uploads, 333K requests. Pro: $25/month billed monthly, 10M tokens, no daily cap, 100MB uploads, custom domains, 1M requests. Teams: $30/member/month. | Tokens cover reading files, prompts, planning, writing code; larger iterative projects consume more. Teams tokens are per member, not shared; paid rollover requires active subscription and is time-limited. | Hosting and databases included up to caps; counts are limits, not unlimited storage or compute. Database can be claimed into Supabase. | Providers beyond the plan bill separately; the page lists caps, not overage prices. |
| Replit | Starter: capped Agent/Free Mode, one 30-day published app. Core: $18/month billed annually (up to five builders). Pro: $90/month billed annually (up to 15 builders, pooled credits, no per-user fees). | Credits cover Agent work and cloud services. Paid Agent work is effort-based; Plan Mode can incur reasoning costs without code changes. Pro credits are tiered and roll over two months. | Published apps, storage, and databases consume credits. Production database has a separate setup step. Budgets, caps, and alerts exist; usage display can lag 30 minutes. | Supported third-party APIs consume credits at their public API prices. |
| v0 | Free: 7 messages/day, GitHub sync, Vercel deployment. Plus: $30/user/month. Business: $100/user/month. Enterprise: custom. Taxes excluded. | Plus/Business include $30 monthly credits plus $2 daily login credits per user. Additional usage is credit-based; model token prices vary by Mini/Pro/Max/Max Fast. | Deployed app runs through a connected Vercel project; v0's credits do not establish that all Vercel or database charges are covered. | Providers beyond Vercel bill separately. |
Apply the worksheet to one app. Use a small approval tracker as a mental model: about 50 end users, a modest database, one custom domain, one builder seat, and a few hours of iterative building per month. This is an illustrative exercise, not a measured budget, and it assumes no extra generation above the included allowances.
The formula is the same in every scenario: monthly cost = build subscription + extra generation + production hosting/database + third-party API costs.
- Lovable Pro at $25/month (or $250/year) includes 100 monthly subscription credits and the built-in Cloud (subscription plans). To price usage beyond the allowance, check what credits remain after your build and cloud activity; the pricing page does not state overage prices, so measuring real usage is the only reliable way to fill that cell.
- Bolt Pro at $25/month includes 10M tokens, custom domains, and hosting up to 1M requests (pricing). Usage beyond those allowances (extra tokens, storage, database growth, API calls) is not priced on the page, so that cell needs measured usage.
- Replit Core at $18/month billed annually includes up to five builders and credits covering agent and cloud services (pricing). Published apps, storage, and databases consume the same credits, so the worksheet entry depends on actual usage; the Pro two-month rollover and credit tiers complicate any single-number comparison.
- v0 Plus at $30/user/month includes $30 in monthly credits plus $2 per day in login credits (pricing). Log in all 30 days and the credit inflow is $30 + 30 × $2 = $90 for the month. The deployed app runs through a connected Vercel project, and v0's credits do not establish that all Vercel or database charges are covered.
The point of the worksheet is to make the recurring cost visible before committing. A generous build allowance can hide a production bill. Every tool in this group can run an app, but the services that hold real customer data (database, storage, email, payments) are the ones that accrue monthly cost.
Which Bundle Fits Your Situation
| Tool | Choose if | You will still own |
|---|---|---|
| Lovable | You want one managed bundle covering hosting, database, auth, storage, realtime, and edge functions, with payments available on Pro+ and Git sync for source handoff. | Verifying generated data rules and business logic; managing the coupled backend; confirming payment provider eligibility and fees; checking what an export contains. |
| Bolt | You want full-stack JavaScript, a hosted cloud, a Git-based handoff, and mobile via Expo if needed. | Paying for custom domains beyond bolt.host; staying inside request caps; deciding whether to claim the database into Supabase; validating permissions. |
| Replit | You want the development environment and the hosted runtime in one place, with explicit control over machine, secrets, geography, and production database setup. | Checking Core/Pro annual billing state; staying within paid builder pools; verifying any future code export. |
| v0 | You already work in Next.js or Vercel and want PR-based deployment and standard front-end tooling. | Connecting the Vercel project; configuring database and services; respecting review gates; accepting that moving off Vercel changes the operating model. |
Frequently Asked Questions
Does code export mean I can move my data too?
Code export gives you source files. Lovable documents Git sync and paid direct download; Bolt and v0 document Git workflows. Migrating hosted records, users, storage, secrets, or scheduled jobs is a separate task with its own verification, and none of the sources here promises one-click data migration.
Are credits and tokens comparable across tools?
No. Lovable uses credits with plan-dependent value; Bolt uses tokens for reading, planning, and writing; Replit uses credits for agent and cloud work; v0 uses seats plus model-priced credits. Compare with a monthly cost worksheet that separates subscription, generation, hosting, and API fees.
Is the included database and authentication production-ready?
Not automatically. Provisioning a database and login flow is not the same as verifying correct permissions, tenant isolation, input validation, and failure behavior. Use the proposed acceptance table as a trial script; it is designed, not executed, and it is not a vendor guarantee.
Can I use my own domain on a free plan?
Not generally. Bolt free projects stay on bolt.host; custom domains require paid access. Lovable custom domains are paid. Replit lets you connect a custom domain after publishing, subject to account entitlement. v0's domain path runs through the connected Vercel project.
What should I test before paying for a plan?
Pick one small real task, such as an approval tracker. Verify login, role permissions, cross-tenant isolation, persistence, server actions, deployment, and spending controls. Then test export and restoration. That protocol is proposed for this article, not executed, so use it as your evaluation script.
Do I need an engineer to run one of these apps?
The tools remove server provisioning, not software judgment. You still need to read generated logic and logs, configure secrets, handle provider failures, and migrate data. If that skill is missing, start with a smaller scope and keep the acceptance table strict.
Where This Leaves the Decision
"Best" is a fit decision, not a verdict. Lovable, Bolt, Replit, and v0 all show paths from a generated UI to a working application, but they divide the work differently: what they host, what they expose, what they charge per month, and what moves if you leave. The decision is less about which prompt produces the prettiest first screen and more about which operating model you can sustain once real users arrive.
The next step is not picking a winner from a chart. Choose one small real task, such as an approval tracker or client portal, define acceptance criteria using the table here, prototype it on the free or cheapest tier of one or two candidates, and measure what you actually use: build credits, runtime requests, storage, and API calls. Test the export and restoration path before you depend on it. Then pay for the plan that matches the measured need.