Build with Replit

Replit lets you describe an app in plain English and have its Agent build, and host, it for you. You can point that Agent at your live gallery data — available works, artwork details, contacts — and deploy the result as a public website or an internal tool.

The whole flow runs on one scoped agent key. That key does two jobs:

• Build time — the Agent connects to your gallery's MCP server and works against live data as it writes the app.
• Runtime — the deployed app calls /api/v1 with the same key through the gallery-platform SDK.

You mint the key once, and it works even with two-factor authentication on your account.

1. Create an agent key

On your gallery's API settings page (/gallery/<your-gallery>/api), open the Build with Replit card and choose an access level:

• Read-only — for a public gallery website. The Agent (and the deployed app) can read your gallery and artworks but change nothing.
• Read & write — for a management tool that also creates or updates records.

The key (gpk_…) is shown once. Keep it somewhere safe — you'll paste it into Replit in a moment, and it's also your deployed app's credential.

2. Connect Replit's Agent

The card gives you a one-click Add to Replit link with the key already filled in. Click it, then Test & save in Replit — the Agent connects immediately, with no extra sign-in.

To connect by hand instead: in Replit, open + Add MCP server, paste your MCP URL —

https://<your-host>/api/mcp/g/<your-gallery>/mcp

— open Advanced, add a header Authorization: Bearer gpk_…, and Test & save.

The Agent now has your gallery's tools (list and read artworks, and — with a read & write key — create and update them) and can build against real data.

3. Build the app

Describe what you want — "a website showing my available works with an inquiry form", say — and let the Agent build it. Because it can read your live gallery, the code it writes targets your real fields and records.

Keep two house rules so the app is sound:

• Call the API server-side only, through the gallery-platform SDK. Never ship the key to the browser.
• A read-only key is enough for a public site. Add write access only for a tool that manages records.

4. Deploy

Deploy on Replit Autoscale (it scales to zero when idle). Put the same key in Replit Secrets — in both the workspace and the Deployments pane — as GALLERY_API_KEY, and set GALLERY_API_BASE_URL to https://<your-host>/api/v1. The deployed app reads your gallery through the SDK with that key.

import { GalleryPlatform } from "gallery-platform";

const gp = new GalleryPlatform({
  apiKey: process.env.GALLERY_API_KEY,
  baseUrl: process.env.GALLERY_API_BASE_URL,
});

const { data } = await gp.artworks.list({ query: { status: ["available"] } });

Rotate or revoke

Manage the key from the same API settings page. Rotating replaces it — update the key in Replit Secrets (and reconnect the Agent) afterward.

Learn more

• Authentication — keys, scopes, and principals.
• The SDK — the gallery-platform client the app uses.
• Rate limits — the headers to respect in your app.