Vibe coding a mobile app

Free · 14 minutes · 6 interactive parts · Updated 3 November 2026

You can vibe code a phone app three main ways: an installable web app with no store at all, a web app wrapped for the stores with Capacitor, or a real mobile app from a builder like Rork or from Expo. Whichever you choose, the app file sits on people's phones where anyone can open it, and every release passes App Store review.

Part 1

Do I need a mobile app or a web app?

Start from what the app must do on a phone. If people just need it on their home screen, an installable web app (a PWA) works with no store, no review and instant updates. If you need push notifications on every phone, the camera, background location or a store listing to be found, build for the App Store and Google Play.

Web app or app store?Tick what you need

Tick what your app must do on a phone.

  • A store app means reviews, release builds and old versions in the wild. Make sure you need it.
  • You can start as a web app and wrap it later, once you know people use it.
Trail: into the app stores

Part 2

What's the difference between Rork, Expo and Capacitor?

Capacitor puts an existing web app inside a native shell, so your Lovable, Bolt or v0 app runs in an app frame. Expo, and Rork Pro which builds on it, make React Native apps, where your code drives real native screens. Rork Max writes native SwiftUI for iPhone only. The closer to native, the more it feels like an app, and the less web code you reuse.

What's inside the appPick an approach
Made with
Your Lovable, Bolt or v0 app
Web code you reuse
High: your existing web app
How it feels
Web-like unless you add native touches
Apple rejects wrappers that only repeat the website.
  • Rork's own FAQ says Rork Max apps are iOS-only; Rork Pro apps can go to both stores.
  • Whichever you choose, export the code to GitHub so you're never locked in.
Compare Rork, Bolt, FlutterFlow and Capacitor

Part 3

Where should API keys go in a mobile app?

Only public keys belong in a mobile app, such as a Supabase anon key or a Stripe publishable key. Anyone can download the app file and read what's inside it, and old copies keep any key you shipped. Secret keys for OpenAI, Stripe or anything that costs money go on a server function that your app calls instead.

Phone or server?Sort each item
  • OpenAI API key
  • Supabase anon key
  • Stripe secret key
  • Stripe publishable key
  • The price of Pro
  • Who may read which rows
  • Your app icon
Sort all 7 first.
  • If a secret already shipped, delete it and make a new one, then move the call to your server.
  • Public keys are only safe if your database rules (like Row Level Security) are on.
Scenario: the key inside the app

Part 4

Why do apps get rejected from the App Store?

The rejections AI-built apps hit most are: no way to delete an account inside the app, a reviewer who can't sign in because login needs an emailed code, an app that only repeats the website, missing privacy details, and crashes on a clean install. Each is quick to fix before submitting, and slow to fix after a rejection.

Submit for reviewTick what your app has
  • Write review notes: how to sign in, and which features to try.
  • Test on a fresh install, on a phone that has never run the app.
Capacitor checklist

Part 5

How do I update a mobile app after launch?

Changes to native code, such as a new camera or payments package, new permissions or a new icon, need a new store build and review. Changes to the JavaScript or web layer can often ship instantly as over-the-air updates, with tools like Expo Updates or a Capacitor live-update service. Mixing them up crashes apps on launch.

Instant update or store build?Sort each change
  • Fix a typo on a screen
  • Add a camera package
  • Change a button colour
  • Ask for location permission
  • Fix a bug in how totals are added
  • Change the app icon
  • Over-the-air updates should fix and improve, not change what the app is. Store rules expect that.
  • Roll updates out to a small share of users first, so a bad one can be pulled back.
Scenario: the update that crashed on launch

Part 6

How do I test and release a mobile app?

Test release builds, not just your development setup: use TestFlight on iPhone and an internal testing track on Google Play, on phones away from your home Wi-Fi. Then prepare the store listing with screenshots, privacy details and review notes with a working sign-in, and submit. First reviews can take a day or more, so leave time.

Release steps0 of 6 ticked

  • Release builds behave differently from development ones. Install them like a user would.

  • Close your laptop before testing a release build. If the app still works, it's really shipping its own files.
  • Keep your server working for older app versions; people update slowly.
Scenario: the app that loaded my laptop

Questions

Can I turn my Lovable app into a mobile app?
Yes. A common route is wrapping it with Capacitor and publishing to the stores, but Apple rejects apps that only repeat the website, so add real phone features. An installable web app needs no wrapping at all.
Is Rork better than Capacitor?
They solve different problems. Rork builds a mobile app from scratch with AI; Capacitor wraps a web app you already have. Pick Rork for a phone-first app, Capacitor to reuse a working web app.
Do I need a Mac to publish to the App Store?
Not always. Cloud build services such as Expo's EAS Build and some AI builders can produce and submit iOS builds for you. You do need an Apple Developer account.

Now see how apps break.

Walk a real incident in four minutes: a customer changes one number in the address bar and sees someone else's invoice. Free, no account needed.

Try a free lesson Coding basics, free