Qoder launched Qoder Sites on 2026-09-20. You describe a web app in one sentence and Sites builds it and ships it live with a shareable link. Unlike the throwaway pages most Vibe Coding tools make, Sites also provisions a backend database, so visitor data actually lands and keeps updating, turning the page from a demo into a usable online app. Go further and bind Qoder Cloud Agents with one sentence, giving the page an agent ability: visitor requests go to a cloud agent that understands, calls tools and returns results. This is a hands-on SOP from version checks and prompt writing, through first publish and persistence checks, to wiring Cloud Agents and picking use cases. Menu paths, button labels, quotas, region rules and deploy domains follow the client and official announcements. For benefits and edition differences see the Qoder free credits SOP and the Qoder international vs CN review. Every step below works from either the desktop client or the CLI, so pick the entry you prefer; the two produce identical sites.
Prepare: confirm the version and the entry point
Sites is built into recent Qoder clients and wakes from /sites. Confirm the version first: desktop v0.3.3 or newer and CLI v1.1.54 or newer both fully support it. If /sites does nothing, upgrade before assuming no access. Two entries give identical output. Desktop: type /sites with your description; generation, preview and publish share one window, good for first tries. CLI: trigger the same command in a terminal for workflows. If you have only used front-end generators before, the auto-provisioned database may feel unfamiliar at first, but that is exactly where the value sits: no server to stand up, no create-table statements to write, just a clear description and you get a real app that persists data. Check the version:
# Check the CLI version against the v1.1.54 requirement
qoder --version
# Upgrade the CLI if the version is too low
qoder update
# Enter the build session and type /sites with your description
qoder chatUpgrade the desktop through its in-app update; labels follow the client. One account shares projects and quota across desktop, CLI and mobile, but a Sites site is an independently hosted app that does not need your machine on. For edition differences see the Qoder international vs CN review.
Write a good prompt: spell out the build intent
How well Sites serves you comes seven-tenths from the prompt. You feed a build spec, not a chat. Use five parts: goal, data model, interaction, style, deploy now. Goal states what the page does and for whom. Data model is the most skipped but vital part: list the fields and relations, because Sites builds the database from it; a vague model wrecks later checks. Interaction says what visitors can submit, view, edit or delete, and what an admin can do. Style covers color, layout and tone; specific beats half-finished. Deploy now tells it to ship and hand a link instead of asking.
Template one, a report board:
Use /sites to build a team weekly report board.
Data model: each record has four text fields: member, done, plan, risk.
Interaction: anyone can add, edit their own, delete their own; everyone sees all.
Style: clean light cards with a title and per-member summary on top.
Deploy live now and give me a share link.Template two reserves an agent entry:
Use /sites to build a campaign signup page.
Data model: each signup has name, phone, intended product, submit time.
Interaction: visitors submit and it is stored; an admin views and exports all.
Reserve an entry for later binding a shopping assistant agent that answers product questions with reasons.
Style: festival red and gold with a hero and signup button.
Deploy live now and give me a share link.A common miss is mixing data model with content. The official ocean example is explicit: each fish is saved, fed and grows, at most 80 per screen, which really defines a data model and a constraint. Write at that grain. If the first pass misses, iterate in the same chat by adding one correction line rather than rewriting the whole prompt. For the free-model background see the Qwen3.8-Flash free hotspot.
Generate and first publish: preview, share, set permissions
After submit, Sites generates the page, provisions the database and opens a preview. Do three things: look, publish, set permissions. Look: try submitting and refreshing to confirm the interaction; if off, add one correction line and Sites patches in place. Publish: deploy live and get a share link, your app address. Link shape and deploy domains are not public, so follow the client and announcements. Permissions are the easy miss: Sites can share with a specific organization or go public. Any page storing real visitor data should default to a specific group, not public, because public lets anyone with the link read and write, inviting spam or leaking phones. Switches follow the client. Spend two minutes on permissions before publishing; fixing a leak afterward is far harder than preventing it.
After publishing, run three more permission checks. Open the same share link on another device or in a private window, and confirm that what others see matches your preview. Send the link to a colleague and ask them to open it with their own account: if sharing is scoped, they should reach it exactly as your setting allows, and if it is public, it should not ask them to log in. Submit one test record and have them refresh, confirming that both of you read the same shared copy rather than two separate local ones. The exact switch location and how each setting behaves follow the client interface. Compare with the AI coding tool free-credits review.
Make the page alive: verify database persistence
The real point is a page with a backend database, so verify the data truly stored. Three checks. Same data across people: two identities each submit, then see each other's; if invisible, data stayed local, not one shared database. Survives refresh: submit then refresh; surviving means it landed in the database, vanishing means frontend-only state and you must fix the data-model prompt. Survives close: close the tab, return later, data intact. The official fish example shows exactly this. Clear all three and the page is alive.
Laying the persistence check out as a checklist makes it steadier. Write a record, then refresh the browser and confirm the record is still there. Close the browser completely, reopen the link, and confirm the data survives. Open the same link on another device or in a private window and confirm every device reads one shared copy rather than a local cache. Finally send the link to a second visitor, ask them to submit one entry, and confirm that a refresh on your side shows it. If any single check fails, go back to the data-model paragraph of your prompt and verify that it actually asks for persistence. Treat this check as a required pre-publish gate; do not share outward until it passes, or you risk sending a page that looks fine yet loses data on refresh. Database type, capacity and billing are not public; follow the client and announcements rather than assuming unlimited production use.
Wire up Cloud Agents: give the page an agent ability
Once the page stores data, make it think. Sites binds Cloud Agents with one sentence; after binding, page requests go to a cloud agent that understands, calls tools and returns, while the page only presents. A static page becomes an app with a brain. Bind when the page must understand natural language, when a visitor phrases a request in one sentence instead of clicking a menu; when it must call external tools or data, checking stock, comparing prices, or pulling orders; or when it needs multi-step reasoning, such as picking a phone suitable as a gift for an elder and explaining why. Pure display and form collection need no agent, which only adds cost and uncertainty. How requests hand off: bind with one sentence in build or config; the entry follows the client. After binding, visitor requests route to the agent, which runs per your role and tools and writes back, so you skip the backend router. Note that the agent ability sits on top of the database you already have: the page both stores data and reasons over it, and the two together form one intelligent app rather than separate islands. The clearest example is an e-commerce shopping assistant: a visitor asks for a gift under a budget and the agent returns a reasoned list the page shows. Reserve this in the prompt like template two. Pair with the Qoder free credits SOP to plan agent cost and quota.
Use cases and boundaries: where to use it, where not to
Sites fits medium complexity, real data, fast ship, and the official names three: prototypes, dashboards, campaign pages. Prototypes: turn an idea into a clickable, storable prototype that truly runs and records, better than drawings; think the data model through early and keep permissions small. Dashboards: gather scattered reports into one writable page with one shared summary; if many write often, confirm capacity first and keep sensitive data off public links. Campaign pages: signup and lead capture are the sweet spot, built fast with auto-collected data; lock permissions because they carry phones, and take down or tighten after the event. Avoid it for core production or high-concurrency services, for systems needing self-hosted backends or deep customization, for regulated data that must stay on-prem, and for very large traffic without small-scale validation. The common thread across all three is that Sites pays off where data must be collected and revisited quickly, not where a page must serve heavy traffic. These boundaries are not a rejection of Sites but a reminder to match it to the scenario: use it where it shines, at medium-light load and fast iteration, and leave heavy workloads to a more suitable base. See the comparison review and the Minimax Code CLI resource.
Pitfall quick check
Four pitfalls by frequency. Vague prompt: only "build a site" with no goal, model or interaction yields an empty shell; use the five-part structure and at least state model and interaction. Unclear data model: the root of persistence failure; without fields Sites may emit a front-end-only page that loses data on refresh; add a model paragraph and run the three checks. Wrongly public: a fast click exposes a data page to spam or leaks; default to small scope and never publicize pages with phones. Old version hides entry: below v0.3.3 or CLI v1.1.54 /sites is silent; run qoder --version, upgrade, and if still missing confirm rollout via the client and announcements. Most of these pitfalls are not feature defects but usage posture, so checking against this list up front saves you the round trips.
FAQ
question
What database type does Qoder Sites create automatically, and how large is the capacity? A1: The official side has not published the specific database product type that Sites uses, nor the per-database or per-table capacity ceiling and billing. Details such as database type, storage limits and whether it is charged follow the client interface and official announcements; this article does not invent specific numbers. Just write your data model clearly when building, and Sites manages the underlying layer for you.
question
Does Sites have a free quota, and are there regional restrictions? A2: The free quota, usage ceiling and whether Sites rolls out by region are not yet clearly announced. Related quota and region information follows official announcements. If you care about claiming and managing Qoder overall free credits, see the Qoder free credits SOP, but that is a separate benefit, and whether it connects to Sites build quota follows official announcements.
question
Where is the /sites entry command, and what if typing it does nothing?
A3: First confirm the version: desktop needs v0.3.3 or newer and CLI needs v1.1.54 or newer, both of which already fully support Sites. In older builds typing /sites will not wake the build flow, so upgrade and try again. If it still does not respond after upgrade, confirm through the client interface and official announcements whether your version and site have full rollout; the exact entry location and labels also follow the actual interface.
question
How is Cloud Agents billed after binding, and is the data handed off from the page safe? A4: The Cloud Agents billing rules, and the permission and data boundary between the page and the agent when requests are handed off, follow official announcements and the client interface. What you can actively control is the page access permission itself: data visitors submit is governed by the sharing permission you set, so keeping pages with personal information in small-scope sharing cuts risk at the source.
question
Can the generated page bind its own domain, and what are the deploy domain rules? A5: The share link shape Sites returns after deploy, whether custom domain binding is supported, and the full deploy domain rules are not yet public. Related rules follow the client interface and official announcements; this article does not write them in stone. You can distribute and use the share link once you have it, and watch later official announcements for advanced abilities such as custom domains.
References
- Alibaba Cloud official announcement dated 2026-09-20: Qoder launches Qoder Sites, building and publishing web apps in one sentence, provisioning a backend database, and supporting Cloud Agents binding
- ai-bot.cn daily brief and public search verification: capability wording, version requirement v0.3.3 and CLI v1.1.54, entry command
/sites, official ocean mini-game example - Qoder official site and docs: qoder.com, qoder.cn (exact menu paths, button labels, quotas and region rules follow the client interface)