Deploy a Google AI Studio app: GitHub, hosting and API keys

Google AI Studio can generate a web app with a React interface and Node server code. Its preview or shared AI Studio URL lets you test the app, but it does not deploy that code to your own hosting. Google offers deployment to Cloud Run; if you want to manage the code in GitHub and publish it with another provider, first check which parts depend on Google.

This guide covers the documented path Google AI Studio → GitHub → Hostbrid Projects. We have not connected an AI Studio account or published a customer’s app to certify an automatic migration; each project needs its own test.

1. Confirm that you built a web app

In Build mode, Google AI Studio can create either a full-stack web application or a native Android app. This route is for the web app. If you chose Android, web hosting will not create an installable app or publish it to the Play Store.

Before moving anything, inspect the code and confirm that you understand its dependencies and how it starts. In AI Studio, link the project to GitHub under Settings → GitHub, or download the code as a ZIP. GitHub sync is two-way: changes can move from AI Studio to the repository and from the repository back to AI Studio. The ZIP is code to review locally; it is not a direct upload to Projects.

2. Check which services the app needs

Do not turn a full-stack app into a static site just to make it build. Look at package.json, identify the install, build and start scripts, and check for server routes, Firebase, authentication, storage or Google Workspace integrations.

Projects publishes Git-connected projects and also offers Node or Docker services, but the public documentation does not certify an automatic migration recipe for an AI Studio full-stack app. A backend may require deploying the interface and service separately, then checking its resources and plan. Before committing to a migration, confirm how its processes, routes and variables fit the available architecture. This also does not configure your external accounts: if you use Firebase, OAuth or an external database, verify credentials, domains, rules and callbacks from the new domain.

If you only have static HTML output, follow the guide to publishing an AI-generated HTML site. If you have a Node process, also read how to publish a Node.js app.

3. Connect the repository to Projects

If the interface is static or the project already has a compatible build configuration, connect GitHub in Hostbrid Projects and select the repository. Set the production branch to the branch you intend to publish. Each push to that branch can start a new deployment; also check that the GitHub connection is still authorised. If you downloaded a ZIP, extract it first, review .gitignore and the files you plan to push—especially .env—and create a Git repository; Projects connects repositories and does not accept the ZIP directly.

Let Projects detect the project and review the settings before the first deployment. If needed, set the install command, build command, output directory or monorepo subfolder. Do not copy generic values without checking the repository’s actual scripts. For static output, point to the folder the build actually creates. If the app has server processes, confirm which service runs them and how they connect to the interface; a static build alone does not publish Node endpoints.

After publishing the interface and configuring any required services separately, test the HTTPS URL, open an internal route directly and check browser requests to the backend. A successful build does not prove that OAuth, the database or Gemini calls work in production.

4. Set the Gemini key as a secret

AI Studio may configure GEMINI_API_KEY as a server-side secret. Do not assume that setting transfers to the new provider. Add the key to Projects environment variables and read it from server code. Do not put it in React code, a VITE_* variable, a file committed to Git or logs.

Google says that when you download an app as a ZIP to host elsewhere, you must configure GEMINI_API_KEY in the hosting environment. Gemini API calls have their own limits and possible costs; changing hosting does not remove them. Also check what happens when Google returns an error or a quota is exhausted.

If the key is already in published JavaScript

Treat any server key that reached the browser as compromised. Create a replacement key and update the server secret; deploy and verify it works, then disable the exposed key promptly. If you detect active abuse, disable it immediately even if the app stops working until you deploy the replacement. Review activity, quotas and billing: deleting a file or commit does not invalidate a copied key. Remove it from frontend code and public variables. Vite bundles values prefixed with VITE_, so that prefix is not a place for secrets.

To verify the fix, create a fresh build and inspect the publicly served JavaScript and source maps, as well as the browser’s network requests. Search for the old key locally; do not paste it into an online scanner or share it in a screenshot. Confirm that the interface calls your server and that server code reads the secret from a Projects environment variable. The backend must validate requests and limit access, rate and usage; an open proxy merely moves abuse to your account. If the key was pushed to Git, remove it from history and logs too, while keeping rotation as the action that invalidates it.

5. Test integrations and connect your domain

Test the app on its temporary HTTPS domain before changing the final domain. Verify sign-in, OAuth callbacks, data reads and writes, permissions, file uploads and each Gemini call. If an integration was automatically connected in AI Studio, test it again in the new environment instead of assuming its configuration carries over.

After those tests pass, connect the domain and recheck the HTTPS certificate, routes, APIs and authentication. If the app needs managed services, network access, disk or sustained workloads beyond Projects, compare the current plans and limits before moving it.

The result depends on the repository and its services. GitHub helps move and review code; it does not automatically copy secrets, users, data, API quotas or OAuth settings.

Sources: Google AI Studio Build · Gemini API keys · Vite environment variables · OWASP Secrets Management · Hostbrid Projects guide