Private services: keep an app off the public internet

Every app you deploy gets a public address by default, such as shop.productecho.com. Anyone who has the link can open it.

A private app, also called a private service, is the same kind of app with the public address switched off. People on the internet cannot reach it. The other apps in your workspace can still call it, using an internal address that only works inside ProductEcho. Your workspace is the space that holds your apps, databases and team. Core concepts explains it.

Private is a setting on a full-stack app, not a different kind of app. A private app is built and deployed like any other, and it counts toward your plan's app limit.

Use one for any app that your other apps need and visitors never do:

• An API that only your own web app calls. Nobody else can send requests to it.
• A worker or job runner that your other apps trigger over HTTP.
• An internal tool or admin service that your other apps use.
• One of several small services that together make up a product, with a single public app in front.

What an internal address looks like

An internal address is http://, then a short code for your workspace, then the app name, then -svc. For an app named api it looks like http://ab12cd34-api-svc. It uses plain HTTP on the default port, so it has no port number and no https://. Copy it from the console or ask your agent for it instead of typing it.

The address only works from inside ProductEcho. Opening it in a browser, or calling it from your own computer, fails.

Choose private when you first deploy an app, or switch an app that is already live. Only full-stack apps can be private. A static site cannot.

Deploy a new app as private

Switch an app that is already live

Within a few seconds the app shows a lock icon and a Private label in the Applications list.

Or ask your coding agent

To deploy a new app as private:

/productecho-plugin:productecho-deploy deploy the api folder as a private app

To switch an app that is already live:

/productecho-plugin:productecho-deploy make the api application private

The agent calls deploy_application with is_private set, or set_application_visibility for an app that is live. In another MCP client, leave off the /productecho-plugin:… part and ask in plain language.

Your other apps need the private app's internal address. Give it to them as an environment variable, then call it from server code.

const res = await fetch(`${process.env.API_URL}/orders`);
const orders = await res.json();

It is a normal HTTP request, so it works the same way in any language. Or ask your agent to wire the two apps together:

/productecho-plugin:productecho-deploy deploy the web folder as a public app and set API_URL to the internal address of the api application

• It takes a few seconds. ProductEcho does not rebuild or restart the app, so the app keeps running and its internal address keeps working throughout.
• Going private: the public address stops working at once. A visitor sees a not-found page, or a browser certificate warning over HTTPS, because nothing serves the address any more. Other apps in your workspace keep calling the app as before.
• Going public: the same public address works again within seconds. ProductEcho keeps the address for the app while it is private, so nobody else can take it, and there is no new certificate to wait for. Anyone with the address can then open the app, so check that it does not expose anything meant to stay internal.
• Redeploying keeps the setting. A private app stays private after a redeploy, and a deploy does not change visibility. Use the switch, or ask your agent.

• Static sites cannot be private. A static site is served straight to visitors' browsers, so it is always public.
• A private app cannot have a custom domain. To add one, make the app public first. To make an app that has custom domains private, remove the domains first.
• You cannot choose which apps may call it. Every app in your workspace can, and no app outside it can. If an app holds data that not every app in your workspace should read, check who is calling in your own code.
• The setting is for apps. It does not change who can reach your databases or your other resources.

The calling app cannot reach the private app

Check four things. The address is copied exactly and starts with http://, not https://. Both apps are in the same workspace. The private app is Ready. The call runs in server code and not in the visitor's browser: a browser cannot reach an internal address, and the usual error is that the name cannot be found.

The old public address shows a not-found page

That is expected for a private app. If visitors need the address again, make the app public.

Make private is refused

The app has custom domains. Remove them on its Domains tab, then try again.

Adding a domain to a private app fails

A private app cannot have a custom domain. Make it public first, then add the domain.

There is no Visibility card or Make private button

A static site has no switch because it is always public. For a full-stack app, only workspace owners, admins and developers can change it.

A webhook never arrives

The service sending the webhook is outside ProductEcho, so it cannot reach a private app. Keep the app that receives webhooks public.