Everything your app needs to be a business

Gemmein hosts your frontend’s static files. Every publish lands on the Development site; the Live site changes only when you approve a promote.

• Development: <slug>-dev.gemmein.dev, a private preview. Live: <slug>.gemmein.dev.
• Publish from a computer with npx gemmein publish, or from a chat through the connector. Every publish answers PUBLISHED or FAILED.
• Every version is kept: roll back on Development, promote any version to Live, download any version as a zip, or share the preview with one link you can change.
• Up to 5 of your own domains per Live app, each added with its own approval. Two DNS records: a TXT at _gemmein proves the domain, and CNAME www → <slug>.gemmein.dev shows the site. The site is served at www; the bare domain forwards to it at the registrar. Gemmein sets up https.
• Static files only (HTML, CSS, JavaScript, images, fonts), up to 25 MiB a file and 50 MiB a site. Server logic runs in a relay’s call to your URL or on your own server.
• From a chat, your AI reads a file as it is now (site_read) before it changes it, then puts the changed file and publishes.
• Taking the Live site offline keeps every version. The Live site and each of your own domains then show “This site is offline”, and the domain’s page reads Your site is offline.

Read the site guide

Passwordless email-code sign-in on the web, in Expo and in Swift. Gemmein holds and checks every session.

• g.auth.sendEmailCode() then g.auth.verifyEmailCode(); g.auth.currentUser() reads the session.
• Up to 10 devices per person; an 11th sign-in signs out the oldest. g.auth.devices(), signOutDevice(id), signOutEverywhere().
• A sign-in from a device or country the person hasn’t used before emails them, with a link that signs out everywhere.
• g.account.export() returns the person’s data, once every 30 days. g.account.delete() erases them and sets their Stripe subscriptions to cancel at the end of the period.
• Mobile SDKs keep the session in the device’s secure store. You can suspend a person or end their sessions from the dashboard.

Read the sign-in guide

Stripe is built in, on your own Stripe account. Gemmein never holds or moves money: it receives Stripe’s events and records who holds what. Any other provider reaches Gemmein through a relay.

• Connect Stripe with a restricted key: 5 permissions, plus 2 if you sell plans. It can’t pay out, refund or read cards.
• Plans: Gemmein makes each plan’s Payment Link and the billing portal. g.subscriptions.plans(), checkout(), mine(), manage().
• One-off products and credit packs: g.payments.products(), g.payments.buy(), g.purchases.mine(), g.credits.balance(). Product files up to 100 MB, or 500 MB for video.
• Products and plans live in gemmein/payments.json; the CLI syncs them.
• In Development, payments run in Stripe’s test mode with its published test cards.
• A full refund in Stripe takes back that purchase’s access and credits; a partial refund doesn’t revoke anything on its own. App Store and Google Play purchases arrive through RevenueCat and a relay.
• Another payment provider: you run its checkout, and its signed webhook reaches a relay. The signature is checked by its standard (Standard Webhooks, or a signature recipe: HMAC-SHA1, SHA-256 or SHA-512, Ed25519 or ECDSA P-256). A call that fails the check is refused, and a sender that doesn’t sign each event can’t grant anything unless you opt in. The relay then fulfils a product (its access and credits), grants a plan or access, or adds credits, so Gemmein enforces what each person holds.

Read the payments guide

Each collection has exactly one of eight safety rules, enforced on Gemmein’s servers on every read and write.

• The rules: private, shared, admin_write, public_read, community, addressed, direct and app_only (only your dashboard, your server and relays reach it). The same on the web, in Expo and in Swift.
• Options beside a rule only hide or order, never widen access: show and hide times (showFrom, showUntil, judged by the server’s clock) and rankable numbers ("rankable": ["score"], up to 3 number fields; each record carries its rank).
• Fields are declared in the collection’s file. In Live, a write with an undeclared field is refused with an explanation; a new field goes through a promotion you approve.
• Publishing (posts wait as drafts until you approve), open fields for likes, votes, polls and RSVPs (once per person), and messages to up to 20 people.
• Files are stored with the record they belong to and read under its rule: up to 100 MB of audio, 500 MB of video.

Read the safety rules

A relay runs a list of Gemmein’s own actions when a verified webhook arrives, a schedule is due or a record changes.

• Webhooks are checked by their signing standard, not by who sent them: Stripe’s format and Standard Webhooks are built in; any other sender is described by its algorithm (HMAC-SHA1, SHA-256 or SHA-512, Ed25519 or ECDSA P-256), its key, the signed text and where the signature sits.
• Actions: fulfil or refund a product, grant or revoke access, grant or end a plan, add credits, write a record, email the person, call your URL with a signed request, run an AI tool.
• A schedule has no person, so it can only write a record and call your URL.
• A failed run retries six times over about a day, then waits for your replay. Events are kept for 30 days.
• Relays run no custom code. Your own code runs on your server and is reached by call_url.

Read the relays guide

An AI tool keeps its instructions, prompt, input rules and model on Gemmein’s server. Your app sends only the tool name and inputs.

• Providers on your own keys: OpenAI, Anthropic, Google, Replicate, fal, ElevenLabs, Runway, Deepgram and AssemblyAI, for chat, image, speech, video and transcription, and any OpenAI-compatible chat provider (OpenRouter, Mistral, Groq).
• Priced in credits per call, or per unit the provider meters (such as 1,000 tokens). Gemmein checks the inputs, the person, their access and their credits before the provider runs; a failure before any output refunds the credits.
• g.ai.run() and g.ai.chat() from the app; every run is listed per person, and keeping prompts and answers is opt-in per tool.
• Your own pipeline as a provider: an external tool sends your URL a signed run with the person, a credit ceiling and a deadline of up to 24 hours. Acknowledge within 10 seconds, then return the result or a failure.

Read the AI tools guide

Email sends from your own domain, and replies land in the dashboard Inbox as threads.

• npx gemmein domains add yourdomain.com --email: the app sends from mail.yourdomain.com, and the CLI lists the DNS records to add.
• Gemmein sends the sign-in codes and the purchase email with its receipt. g.notify(personId, { subject, text, key }) emails one person; the key stops a retry sending twice. Templates live in gemmein/emails/.
• One person at a time: broadcasts and group sends are not part of Gemmein.
• From a chat, the connector reads the Inbox (live_inbox) and drafts a reply (inbox_reply); you approve the exact text in your browser before it is sent.

Read the email guide

The dashboard at app.gemmein.com has one page for each part of the business.

• Pages: Overview, Inbox, Customers, Subscriptions, Get started, Data, Payments, Domains, Site, Relays, Emails, AI, Logs, Errors and Settings.
• Errors groups every refused write by what went wrong, with the refusal message your app received.
• From a chat, the connector reads Live without changing it: live_overview, live_people, live_revenue, live_subscriptions, live_records, live_errors, live_logs, live_usage, live_webhooks, live_emails and live_inbox.
• Scoped, revocable secret keys let your own servers and scripts use the server API.

Read the dashboard guide

Approvals, rules and secrets are enforced on Gemmein’s servers, never in the app’s code.

• Each Live change is approved on its own in your browser. A change to one customer is the approval alone.
• Going live is your approval, then paying for the plan, with no code. A plan you paid for first means going live is the approval alone.
• A change to how the business runs (a promote or Live push, products and prices, a domain, email sending, Stripe, a Live secret key, deleting a collection, relay or AI tool, taking the site offline) also asks for the code Gemmein emails, and your authenticator code when you have set one up.
• Your AI never sees Live secret keys. Settings → Approvals lists every machine and connector you approved; revoking one ends its access at once.
• Every sign-in and change is in Logs. Data is encrypted in transit and at rest, with abuse and brute-force protection.

Read how it’s kept safe

Gemmein is an SDK, a CLI, a hosted connector and one guide your AI reads first.

• Chat apps (ChatGPT, Claude.ai, Lovable, Replit, Bolt, v0) add the connector at https://api.gemmein.com/mcp. It builds in Development and never sees a secret key. ChatGPT works on every plan, Free included.
• Coding tools (Claude Code, Cursor, Codex) use the npx gemmein CLI, with a free local backend (npx gemmein dev) under the same rules as Live; syncing to the cloud is approved in your browser.
• The guide your AI reads first: https://docs.gemmein.com/llms.txt.
• SDKs: @gemmein/sdk for the web, @gemmein/sdk/expo for iOS and Android, and the GemmeinSwift package for iOS 17+ and macOS 14+.
• Every refusal names what was refused and what to change, so your AI fixes the cause.

Read the quickstart