Cognition launched Devin Apps on November 13, 2026: private web tools Devin builds in a session and keeps hosting on its cloud computer, each with a stable URL and mandatory Devin sign-in. The feature sits between "the agent wrote a script" and "we shipped a product" — internal dashboards, forms, and staging copies without standing up a separate PaaS pipeline for every experiment.
The announcement lives on Cognition's Devin blog with matching product documentation. This post explains the architecture Cognition describes, who it is for, and what security and platform teams should verify before linking a business workflow to an agent-generated app.
TL;DR
| Question | Answer |
|---|---|
| What shipped? | Devin Apps — hosted web UIs Devin builds and serves from its VM |
| URL shape | Stable https://<slug>.preview.devinapps.com per app |
| Access | Devin login required; share to people, org, or enterprise |
| Runtime | One VM per app; sleeps on idle via memory snapshots |
| Billing | Awake time on the machine |
| Good fit | Admin panels, metrics dashboards, approval queues, beta/staging copies |
| Poor fit | High-traffic customer-facing production (per Cognition limits) |
What Devin Apps add to Devin
Before Apps, Devin already lived in long-running sessions with repos, terminals, and MCP tools — the shape we covered when SWE-2 landed in Devin and when Cognition pushed agent memory specs. Apps add a durable HTTP surface on top of that session:
- You describe the tool in natural language.
- Devin builds it in the session that owns the app.
- Cognition serves it from the same machine at a stable URL.
- Updates go through messages to that session, not a separate deploy button.
That is closer to "living artifact" than a one-off HTML export. It also concentrates risk: the app inherits whatever repos, MCP connectors, and secrets the session already had. Our Corridor acquisition post noted Cognition's push into security review for agent-written code; Apps multiply the number of surfaces that code can expose.
How Cognition says hosting works
According to the docs:
Single-machine hosting. Nothing deploys to a third-party host. The app runs on Devin's machine with whatever database or files you configure there.
Sleep and wake. Apps build on memory snapshots that let Devin hibernate between tasks. When nobody uses the app, the machine sleeps; opening the app wakes it. Cognition warns the first load after sleep can take a few seconds.
Private by default. Every visitor signs in to Devin. Publishers use Share to limit access to named users, the whole organization, or enterprise scope. Admins can pin apps for visibility.
Stack flexibility. Any framework that serves HTTP works. Cognition lists SQLite or Postgres on-machine, uploads stored locally, and optional calls to external APIs via secrets.
Session coupling. The session that built the app also ships updates. Renaming the app does not change the URL.
Templates Cognition highlights
The blog post lists built-in starting points: metrics dashboards, project status pages, and review queues. Teams also use Apps for beta or staging copies of a real product stack — frontend, backend, database, and workers on Devin's VM — so stakeholders click through before production CI runs.
Hosted agent dashboard concept for Cognition Devin Apps internal metrics tools
Secrets, API access, and trust boundaries
Devin documentation is explicit about secrets: keep keys on the server. Anything shipped to the browser is visible to everyone who can open the app.
Apps may call the Devin API with a personal access token or service user key — useful for "start a session from a form" or "team session dashboard" patterns. A personal token acts as you, so Cognition tells teams to share those apps carefully. Service users fit automation better; see Cognition's authentication guide for principal and token types.
That maps to lessons from our Codex on Amazon Bedrock SSO guide: identity follows the token. An internal App that embeds a user PAT effectively gives every viewer your Devin permissions unless you add app-level authorization for writes.
For coding-agent security more broadly, see November 2026 cyberattacks tracker and Cloudflare's ARTEx orchestrator warnings.
Comparison with other "agent builds a UI" moves
| Surface | Who hosts | Typical audience |
|---|---|---|
| Devin Apps | Cognition VM | Org-private, Devin-authenticated |
| Vercel UI SDK for agents | Your Vercel project | Product teams shipping to customers |
| OpenAI Codex + Cloudflare | Your Workers stack | Developers with existing CF tenancy |
| Claude artifacts / Cowork | Anthropic session | Individual knowledge work |
We covered Vercel's agent UI beta in Vercel Labs UI SDK for agents. Devin Apps optimize for fast internal tools on Cognition's trust island, not multi-tenant SaaS scale.
What people are asking
Is this different from Vercel v0 or Replit deployments? Those products target customer-facing sites with production hosting pipelines. Devin Apps are explicitly internal and Devin-authenticated. You are not buying a CDN; you are renting wake time on Devin's VM.
Can I connect production databases? Technically yes via secrets, but Cognition warns about one-machine limits and urges CI/CD for real traffic. Treat production database credentials on a Devin App as you would credentials on a developer laptop running an experimental script.
Who owns the code? The session owns the app. If the session is deleted or access is revoked, the URL may stop working. Export patterns are not spelled out in the November 13 docs; assume you need a git push back to your org repo for long-term retention.
How does this interact with SWE-2 or Oncall? SWE-2 improves coding quality inside sessions; Devin Oncall triages alerts. Apps are the UI layer for humans who do not live inside a terminal harness.
What about compliance logs? Devin sign-in proves who opened the app, not what they changed in downstream systems. Pair Apps with your existing audit trail on databases and ticketing systems.
Example workflows teams describe in the launch materials
Cognition's blog enumerates patterns that map cleanly to enterprise chores:
| Pattern | What Devin builds | Why a URL helps |
|---|---|---|
| Approval queue | Form plus status table backed by SQLite | Managers approve without learning git |
| Support metrics | Dashboard pulling from internal APIs via server secrets | On-call sees live counts without Grafana setup |
| Migration tracker | Page showing batch job percent complete | PMs stop asking engineers for CSV exports |
| Staging clone | Full stack on Devin VM | Design reviews click through real APIs |
Each pattern assumes tens of concurrent users, not thousands. Cognition repeats that high-traffic customer apps belong on your infrastructure.
Billing and capacity planning
Wake billing changes how finance should model agent spend. A dashboard that someone opens once a morning may cost seconds of awake time. A queue app pinged every minute keeps the VM warm and accrues steady charges.
Model this like serverless minimum instances with a cold-start penalty. Cognition's few-second wake after sleep resembles Lambda provisioned concurrency without AWS's granular pricing table. Track:
- Sessions per app per day
- P95 time between opens (does the machine sleep?)
- Whether cron-style refreshes run inside the app
Compare against Devin Fusion efficiency claims only after you have awake-hour metrics; token savings in coding do not automatically shrink hosting minutes.
Security review checklist (before org-wide share)
- Data classification: Can every viewer see every row the app queries?
- Write scope: Does the App call write APIs? Add role checks in the generated server code, not only Devin login.
- Secret rotation: If you rotate an API key, update the session secret and redeploy via the owning session.
- Dependency drift: Devin may install packages during build. Pin versions in the session instructions if compliance requires it.
- Cross-app isolation: Two apps on different sessions are isolated; two apps in one session share memory and secrets.
- Phishing surface: Stable preview URLs on
devinapps.comcould be forwarded externally. Use org-only sharing settings and train users not to forward links outside policy.
For agent-generated code risk, Cognition's Corridor acquisition is the vendor's answer. Your answer may still be internal code review.
Devin Apps wake billing model for private agent-hosted internal tools
Limits Cognition documents
From the product guide:
- No public apps and no service workers, so PWA offline mode is out.
- One machine per app — not for heavy concurrent production traffic.
- High-scale workloads should use your CI/CD with Devin accessing production via controlled secrets and skills, the same pattern AWS describes for moving from AgentCore experiments to real deploys in our AgentCore runtime guide.
What to do before you pin an App org-wide
- Scope the session that owns the app. Remove MCPs and repos the UI does not need.
- Use service users for Devin API calls inside shared Apps, not personal PATs.
- Add app-level authorization if different viewers should see different data — Devin login only proves identity, not row-level policy.
- Set awake-time budgets if finance tracks agent VMs like GPU hours.
- Run Corridor or your own review on generated server routes before pinning, especially if the App writes to production-adjacent systems.
Related reading
- SWE-2 in Devin — frontier-near coding inside Devin
- Devin Dreaming Memory open spec — long-lived agent state
- Corridor security acquisition — guardrails for agent code
- Vercel UI SDK for agents — another agent-to-UI path
- AWS AgentCore runtime — when to leave the agent sandbox
- Plannotator plan review for coding agents — review before agent execution
Cognition product details and URLs are accurate as of November 13, 2026 per devin.ai and docs.devin.ai.