Day 1: I Built a Secure Login With AI Agent and AppAmbit
Watch an AI agent build a full account system for a Flutter app on AppAmbit, prompt by prompt. Two Database tables, three Cloud Code functions, salted password hashes, and a real sign-up bug traced and fixed on camera.
Watch the full tutorial or read the summary below
Overview
Day 1 of the Move Well build: an app that nags you to fix your posture, built prompt by prompt on AppAmbit. Move Well is the app's working name; on Day 4 it becomes Unshrimp.
The video starts from a blank Move Well app that is already connected to AppAmbit. In one sitting, the AI agent builds a full account system: two Database tables (users and user_stats) and three Cloud Code functions (register, login and validate). Every check runs on the server. That covers email and password rules, duplicate accounts, salted password hashing, and a login that gives the same answer for a wrong email or a wrong password.
A real sign-up bug appears on camera, and the AI traces it end to end before fixing it. The episode ends with a first home screen and a full round of tests.
The rule for the whole series: the real checks live on the server, never on the phone.
In This Episode
- A blank Flutter app that's connected to AppAmbit from the very first line
- Two Database tables: users, and user_stats for streaks, breaks and the roast level
- Three Cloud Code functions: register, login and validate
- Register checks the email, the password strength and duplicate accounts, then creates the user and their stats in one step
- Login gives the same answer for a wrong email or a wrong password, so it never reveals which accounts exist
- Passwords hashed with a random salt on the server. Only the hash is ever stored.
- A real bug: sign up fails with an input error. The AI traces the whole path before changing a thing.
- A first home screen: spine streak, the Camarómetro and today's breaks
- Every case tested: wrong password, duplicate email, right credentials
Chapters
- 0:00 Why posture apps get ignored
- 0:18 The starting point: a blank Move Well
- 0:46 The goal: accounts that live on the server
- 1:49 Two tables: users and user_stats
- 2:33 Register, login and validate in Cloud Code
- 3:32 Under the hood: salted password hashes
- 4:27 Adding the Move Well mascot
- 5:07 A real bug: sign up fails
- 5:45 The first real account
- 6:14 A first home screen with stats
- 7:05 Testing every case
- 7:36 Zero to accounts in one sitting
Next in the Series
Links
Frequently Asked Questions
Q Where are passwords stored?
Only a salted hash is stored in the users table. The hashing happens inside the register Cloud Code function, never on the phone.
Q Why does login show the same error for a wrong email and a wrong password?
So nobody can find out which emails have an account.
Q What caused the sign-up bug?
Sign up failed with an input error, while the same call worked fine when run by hand. So the app was sending something different. The AI traced the whole path, found the cause and fixed it before changing anything else.
Q What is user_stats for?
It tracks streaks, breaks and the roast level. A row is created together with each new user, in one step.
Q Which AppAmbit services does this episode use?
Database (users, user_stats) and Cloud Code (register, login, validate). Analytics was already wired from the start.
Ready to get started with AppAmbit?
Monitor your mobile apps with real-time crash reporting, analytics, and app distribution.
Start Free Trial