Short answer
To test a Base44 app, run Base44's Security Scan and Testing Agent, then test sign-up and sign-in on the published base44.app URL, because Base44's Testing Agent cannot test login, codes or email verification. TestOptim AI tests the published app signed in, including flows behind the login, and reports each bug with steps and a screenshot.
- Base44's full sign-up and sign-in flow can only be tested on the published URL.
- New email sign-ups get a six-digit code that expires in ten minutes; verify the test account once yourself.
- The Security Scan warns but does not block publishing, so read its findings before launch.
On this page
How a Base44 app is built and hosted
Base44, owned by Wix, builds web apps from chat with a built-in database, backend functions, sign-in and hosting. The generated app is a React and Vite app using the Base44 SDK, and the backend is Base44's own, not Supabase.
Published apps live at your-app.base44.app or a custom domain. Visibility is public, private (invited people, paid plans) or workspace. TestOptim needs the public setting, because a private app asks for a Base44 invitation before it loads.
Sign-in is built in: email and password with a six-digit verification code for new sign-ups, plus Google, Microsoft, Facebook, Apple and SSO. Password reset links always go to /reset-password.
What Base44 already tests in your app
- Testing Agent (all plans, uses credits) runs AI-written or hand-written browser tests on key flows and reports critical issues and warnings. It runs as a fresh user and signs in on its own, but it cannot test login, one-time code or email verification flows, and it has no schedule yet.
- Security Scan checks data permissions, profile fields users can edit that also control access, exposed secrets, backend functions callable without sign-in, endpoints that can burn your AI or email credits, vulnerable dependencies and security headers. It warns but does not block publishing.
- Test Data (Builder plan and up) gives the preview and a testing link their own test database; the published app always uses production data.
TestOptim covers what the Testing Agent leaves out: the sign-in flow itself on the published app, the flows behind it, and scheduled runs after every change.
Bugs to check in a Base44 app
- Access that depends on a field users can edit. If an access rule reads a profile field such as company, a user can change it and see another company's data. The Security Scan flags this; test it from two accounts as well.
- Backend functions that work without sign-in, including AI, email or image features someone outside your app could call to burn your credits.
- Duplicate accounts from Apple's Hide My Email, which can create a second account for the same person.
- Sign-in that was never tested end to end, because it only works on the published URL. TestOptim tries wrong passwords, empty fields and pages opened while logged out.
How to test a Base44 app with TestOptim AI
- Publish with public visibility and use the
base44.appaddress or your custom domain. - Sign up a test account with email and password, and enter the six-digit code yourself within ten minutes. After that the account signs in with its password alone.
- Create a TestOptim project with the URL and add the account as a credential profile. Add a second profile for an admin role if your app has one.
- Explore, generate and run. Paste an issue's steps into Base44's chat to fix it, publish, and mark the issue fixed to re-run its test.
- Schedule runs so the next change cannot quietly break sign-in. See schedule test runs.
The published Base44 app always uses production data, so the agent's test records land there. Use a dedicated test account.
Frequently asked questions
Does Base44 test my app automatically?
Base44 has a Testing Agent that runs browser tests on key flows and a Security Scan for permissions, secrets and exposed functions. The Testing Agent cannot test login, one-time codes or email verification, and it does not run on a schedule, so test sign-in on the published app separately.
How do I test sign-in on a Base44 app?
Publish the app, because Base44's full sign-up and sign-in flow only works on the published URL. Sign up a test account, enter the verification code yourself, then give the email and password to TestOptim, which tests sign-in and every flow behind it.
Can TestOptim handle Base44's six-digit verification code?
During exploration TestOptim can pause and email you to enter a live code. The simpler route for Base44 is to verify the test account once yourself; after that it signs in with email and password and no code, so scheduled runs keep working.
Does Base44's Security Scan block publishing?
No. It warns about issues such as open data permissions, exposed secrets and backend functions callable without sign-in, but you can still publish. Read and fix its critical findings before you share the app.
Does testing a Base44 app use my Base44 credits?
Base44's own Testing Agent uses Base44 credits. An outside tool like TestOptim uses the app like a visitor does, so it only spends credits if the flows it tests call paid features in your app, such as AI generation.
Can TestOptim test a private Base44 app?
Not while it is private, because a private Base44 app asks for an invitation before it loads. Publish a copy with public visibility and test data for testing, or switch the app to public before launch and test it then.
Sources
Platform facts were checked against these pages on 22 October 2026. Builders change quickly, so check them again before relying on a detail.
More Vibe-coded apps guides
- How to test a vibe-coded app before you launchHow to test a vibe-coded app from Lovable, Bolt, Replit, Base44 or v0: the bugs AI app builders leave, what their own checks miss, and a launch checklist.
- How to test a Lovable app before you launchHow to test a Lovable app: what Lovable's security scan and browser testing cover, the Supabase RLS and sign-in bugs to check, and how to QA lovable.app.
- How to test a Bolt.new app before you launchHow to test a Bolt.new app: the localhost redirect, open database policies and missing env vars to check, and how to QA bolt.host.
- How to test a Replit app before you publishHow to test a Replit app: secrets and databases that differ in production, Replit Auth sign-in, what Replit App Testing covers, and how to QA replit.app.
- How to test a v0 app before it reaches productionHow to test a v0 app on Vercel: protected preview deployments, NEXT_PUBLIC_ secrets, env vars that differ by environment, and how to QA production.