Leave Replit for a production host without losing the MVP (2026)

Citation-ready definition: Leaving Replit for a production host in 2026 means you can shut the Repl and the product still answers on a domain you own. The code lives in a company Git repo. Secrets live on the new host, not only in the Replit pane. A second person can ship a change without opening the editor. Always On and a `.replit.app` preview are a lab, not that proof.

The expensive 2026 miss is rarely “we picked the wrong builder.” It is “we bought ads on a warm Repl.” A founder can click Publish. A customer can finish signup. The bill still sits on Replit cycles. The keys still sit where every editor can open them. The public name still points at a host the company does not run. A converting preview hides that gap. A locked laptop, a paused Deployment, or a teammate who never got the Repl invite will not.

This article is the host cutover playbook after Replit. It expands get off Replit and Replit to production. It is not the org-Git proof on GitHub handoff after an AI builder, not the Postgres evidence on Supabase hardening after an AI builder, not the founder calendar on AI-builder exit plan for founders, and not the stay/harden/rewrite mark on rewrite vs harden. Those pages stay Git, rows, weeks, and layer verdicts. This page is whether the process lives off Replit. Soft CTA: when the host or DNS is still fuzzy, book.

Short landers stay punchy: migrate from Replit for extract, get off Replit for the runtime exit, Replit to production for preview-is-not-prod, Replit MVP hardening if you stay one more week, transition from Replit while the editor stays open, GitHub handoff for the org remote, and production-ready for the shared contract. The vibe coding hub maps other tool exits. This page stays the host move.

Always On is a lab, not a host you own

Replit is paid to make the preview work tonight. A production host is paid to keep answering when the founder closes the tab. Those jobs collide. A green Publish click feels finished. The company is unfinished because nobody can start the same process on a machine Replit does not rent.

Replit’s own docs draw the line. Publish your app is four clicks and a `.replit.app` URL. Deployment types then split the lab: Autoscale can drop to zero when idle. Reserved VM is the always-on box — one machine that never sleeps, billed as a fixed month. Static serves files with no backend. Scheduled runs a command and stops. Agent apps are not Static. A warm Reserved VM is still Replit’s machine.

Replit Deployments say the quiet part: Publish saves a snapshot and runs it on Replit cloud, apart from the editor. Do not store real data on that filesystem. You cannot change region in place later. Deployment and publishing adds the trap: the editor preview can work while the published app fails, because development Secrets and deployment Secrets are separate stores. Shut the Deployment and the custom domain ties on it go with it. The files stay. The public name does not.

Five lab patterns show up when a Repl starts taking money:

1. Always On is the uptime story. Reserved VM never sleeps. That is a bill and a blast radius, not proof you can start the process on Fly, Render, Vercel, or AWS.
2. The public URL is still `.replit.app`. A custom domain on Replit is still Replit DNS. Custom domains need an `A` record and a lasting `replit-verify` `TXT` record. Leave those pointed at Replit and you have not left.
3. Keys live in the Secrets pane. Secrets encrypt values. Multiplayer editors with access can still see names and values. Org members who are not owners can print environment variables. That is a shared drawer, not a vault you rotate without the room.
4. The database only answers through Replit. A zip does not move it. Projects and files is blunt: projects cannot transfer. After a copy you re-enter secrets, rebuild the database, and redo deploy settings.
5. Only the founder can publish. If a second person must open the Repl to ship, you do not have a host. You have a chat with a URL.

None of that is a reason to throw away the screens. Users already accepted those flows. It is a reason to stop buying ads until you can name the host, the vault, and the person who ships while the Repl is closed. If you cannot name those three, mark the host layer on rewrite vs harden. If the gap is Git seats rather than the host, leave this page and open GitHub handoff after an AI builder.

Ownership map: name the host, not the preview

The founder calendar seats Git, billing, and restore. This page seats the runtime. Exit of the host is complete when a second person, using a company account on a host you pay, can ship a change that answers on your domain while the original Repl is stopped. Until then you are renting a lab.

Write the proof next to the name. “We published” is false until a clean machine starts the app from Git. “We have secrets” is false until the old pane values fail and the new ones live only on the host. “We have a domain” is false until the `A` record no longer aims at Replit and the `replit-verify` `TXT` is gone or replaced by the new host’s check. “We left” is false until you shut the Deployment and the public origin still answers.

Export the tree. Do not export the hostage.

You cannot move a Replit project to another account as one object. Projects and files says to share and fork, or download a zip and upload it again. After the copy you set up secrets, the database, and deploy settings from scratch. Those pieces are not in the zip. Git sync can keep the tree two-way. It does not move the vault or the rows. Treat the export as files you can compile. Treat everything else as a list you must reseat.

This page does not repeat the org-Git gates. If the remote is still a personal repo, or only the founder can merge, stop here and finish GitHub handoff after an AI builder first. A host that deploys from a hostage remote is a second hostage. About organizations is the shared account. Transferring a repository moves the tree and the things stuck to it. It does not move Replit Deployments. Put the company remote in place, then point the new host at that remote. Soft CTA: if you cannot name the org owner and the host owner as two seats, book.

What to take, and what to leave:

• Take source, lockfiles (or make them), the start command you can name, and a written map of Nix or system packages the Repl hid.
• Take secret *names* into an env template. Mint new values on the destination. Never commit the Repl `.env`.
• Leave `.replit` caches, editor-only junk, and local secret files out of the remote.
• Leave the database dump on a separate path. CI should not invent schema.
• Decide each multiplayer scratch file: keep it or drop it. Do not discover a missing screen after DNS moves.

The extract list on migrate from Replit is the short form. Here the test is simpler: a clean runner installs, builds, and starts with the Repl closed. If start only works inside Replit’s shell, you exported a lab, not a host.

Secrets leave the Repl before DNS does

Keys are the first thing that follows you off the island — and the first thing that leaks if you copy them wrong. Replit’s Secrets tool encrypts values and injects them as environment variables. That is good hygiene inside the editor. It is not a company vault. Multiplayer editors can see names and values. Organization members who are not owners still cannot view values in the pane, but they can print the environment. Anyone who can run the app can dump the drawer.

Editor secrets and published secrets are not the same list. Projects and files and deployment help both say it: the development Secrets pane is only for the editor. The published app reads deployment secrets. Change one store and the other stays old until you Publish again. That split is why a preview can pass and the live URL can fail. When you leave, keep the split — but move both lists off Replit. Names go in a template in Git. Values go in the new host’s secret store. Then rotate. Old pane copies should fail.

Replit also injects its own variables: `REPLIT_DOMAINS`, `REPLIT_USER`, `REPLIT_DEPLOYMENT`, `REPLIT_DEV_DOMAIN`. Code that branches on those names will break on Fly or Render. Search the tree for them before the first deploy. `DATABASE_URL` from Replit’s database add-on is a connection you must replace, not a souvenir you paste into the next host.

Pick a host from the app, not from an ad

There is no default “best” host in 2026. There is a match between how the Repl actually runs and how the new host starts a process. Replit already told you the shapes: Autoscale (busy then sleep), Reserved VM (never sleeps), Static (files only), Scheduled (run then stop). Copy that shape. Do not copy the brand.

Score a host on three proofs: Git in, secrets in, DNS in. Fly secrets become environment variables; you can list names, not values. Fly’s GitHub Actions guide deploys with an app token stored as an Actions secret. Render’s Git provider rebuilds on a push. Render environment variables say not to commit `.env`. Render custom domains keep `onrender.com` and add yours. Vercel environment variables split Production, Preview, and Development; a change applies only to the next deploy. AWS App Runner can read GitHub or Bitbucket and inject runtime secrets from Secrets Manager or SSM. Those pages score a host. They do not pick a logo.

Two founder rules keep the list honest. First: if the Repl needed a process that never sleeps, do not move it onto a platform that scales to zero unless you have measured the cold start on the real signup path. Replit Autoscale already warned you the first request after zero can take a few seconds. Second: if the app is a marketing page with no server, do not rent a reserved box. Match the shape. Then write the account owner, the region, and the rollback click on one card.

Env and CI: the Publish tab is not a pipeline

A pipeline is a file in the repo that a runner you do not sit at can execute. The Replit Publish button is a snapshot you trigger by hand. Both can put bits on the internet. Only one survives a founder on a plane.

Land three jobs, in order. Install and build on a clean runner. Deploy only after that job is green. Smoke the live origin after deploy. Put secret names in the workflow. Put values in the host or in Actions secrets — not in the YAML. Fly stores `FLY_API_TOKEN` as a repository secret. Render can wait until checks pass. Vercel and App Runner both take Git as input and env as a side store. Pick one path. The production-ready contract still applies: no cutover without a tested rollback. GitHub handoff asks whether a second person may merge. This page asks whether that merge lands off Replit.

Do not let the first CI job be “deploy.” The first job is “this tree builds without Nix, without the Secrets pane, and without an open Repl.” If that job is red, you are not ready to point DNS. You are still extracting. Stay on migrate from Replit until the runner is green.

Domain and DNS: move the name last

Move DNS last, after the new origin already passes smoke tests. Replit’s custom domains page is the map of what you must undo. A `.replit.app` name is instant. Your own domain can take up to 48 hours. Replit wants an `A` record and a `replit-verify=…` `TXT` record that stays so the certificate can renew. `www` is a separate hostname. Unpublish removes the domain ties on that Deployment. If you bought the name through Replit, plan how you will point it somewhere else — or transfer it to a registrar you admin.

Cutover is a swap, not a prayer. Lower the TTL a day before if you can. Stand the new host on a side name first. Smoke-test there. Then change the apex `A` or `CNAME`. Remove the Replit `A` and the `replit-verify` `TXT` so the old certificate path cannot fight the new one. Keep `.replit.app` for a few days as a rollback door — but stop linking it in ads, OAuth, and email. Update login callbacks, webhooks, and CORS in the same hour you flip DNS. Those allowlists do not update themselves.

If Auth still allows `*.replit.app`, you have not left. If sitemap and canonical tags still print the Repl hostname, search will keep sending people to a lab you plan to shut. Transition from Replit is the overlap week: editor open, host live, DNS not flipped yet. Use that week. Do not skip it to “look live.”

Smoke tests, then kill criteria

A smoke test is a short path a stranger can finish. It is not a screenshot of the home page. On the new origin, with production secrets, complete signup, get a session, and write one durable record. Then sign out and sign back in. Then hit a URL that used to live on `.replit.app`. If any of those fail, DNS stays on Replit. You have a staging host, not a cutover.

Read the chart as a reservation, not a promise. Week 0 is cheap: if you cannot list secret names and the start command, later weeks thrash. Week 1 is the first boot on a host you pay. Weeks 1–2 land CI and a side-name smoke. Week 3 is the first week the Repl can go dark. The last bar is the silent kill: more Agent prompts on Always On while ads already run. Ranges are studio-observed operator weeks — not a bid and not a vendor SLA.

Overlap the bars when you have two humans. Do not overlap them with a paid feature that only ships from the Repl. A prompt that adds payments or a new login vendor waits until the side-name smoke is green. Replit MVP hardening can wrap a dangerous path for one more week. It is not a substitute for the kill date.

Kill criteria: pause features, not the product

A cutover without a kill date is a wish. Write the date you will stop shipping from the Repl, the date you will flip DNS, and the evidence that sends you back to a bound rewrite of the host.

Pause feature work when any of these are true:

• Paid traffic or a partner demo is inside two weeks and the public origin still needs Always On or Autoscale on Replit.
• A live key still exists only in the Secrets pane, a chat, or a committed `.env`.
• CI cannot install and build with the Repl closed.
• A new prompt would add payments, a new OAuth app, or a second hostname while DNS still aims at Replit.
• Two people disagree about who can shut the Deployment.

Hire (or book a partner for a named gate) when the founder cannot be the second host admin and cannot land a workflow file; when the database has no restore you have actually run; or when week-0 inventory slipped past the kill date. Hire for host + vault + DNS — not for a new set of screens. Austin app development company is the studio brief if you want that conversation. Austin mobile app development if the next door is a store binary that still points at this Repl.

Stop this cutover and reopen [rewrite vs harden](https://www.codecross.com/articles/rewrite-vs-harden-after-ai-builder-2026) only when the host layer is irreparable: the tree cannot start outside Replit’s shell; secrets cannot be reproduced; or the only way to “make it work” is to keep Reserved VM as the compiler. That is a verdict on the extract. Write it down. Do not “leave Replit” by putting a prettier domain on the same Deployment.

If none of those have fired, keep the screens. Sequence the gates. The cheapest honest path in 2026 is a host you can name, on DNA users already accepted — not a second codebase, and not another month of Always On as the company.

FAQ

Is Replit Always On or a Reserved VM production?

No. Reserved VM is Replit’s always-on box: one machine that never sleeps, billed as a fixed month. Autoscale can drop to zero. Both run a snapshot on Replit cloud. Production on this page means a host you admin, secrets you can rotate without the pane, and a public name that still answers when that Deployment is shut. A warm VM is a lab with a better bill.

Does a custom domain on Replit finish the exit?

No. A custom domain on Replit still uses Replit’s `A` record and a `replit-verify` `TXT` record that must stay for certificate renewal. Unpublish drops those ties. You finish the exit when the apex points at a host you pay and the Replit records are gone. Custom domains is the map of what you must undo.

Can I copy the Repl Secrets pane onto the new host?

Copy the *names*. Mint new *values*. Editor secrets and deployment secrets are already separate on Replit. A zip does not include them. After cutover, rotate the old pane values so a leaked screenshot dies. If a key was ever in chat or a committed file, rotate it now — not after ads.

Which host should a founder pick — Fly, Render, Vercel, or AWS?

Pick from how the Repl runs, not from a homepage. Files only can go to a static host. A web app that can sleep can go to Fly, Render, Vercel, or App Runner. A process that must never sleep needs a resident machine. Score each option on Git deploy, a secret store, and DNS you can edit. Soft CTA: if two options still look equal and traffic is close, book.

Does GitHub sync mean I already left Replit?

No. Sync moves files. It does not move secrets, the database, or the Deployment. Org Git is a gate on the GitHub handoff page. This page asks a different question: can you shut the Repl and still serve customers? A synced repo with Always On in front is still a lab.

What smoke tests are enough before I flip DNS?

On the new origin, with production secrets: create an account, keep a session, write one record, sign back in, and open an old `.replit.app` path that should now redirect or resolve. If login callbacks still list Replit hostnames, you are not ready. If only the founder can run the test, you are not ready.

When do I pause new prompts versus rewrite the host?

Pause prompts when Always On is still the uptime story, a live key is still only in the pane, or CI cannot build with the Repl closed and traffic is close. Bound-rewrite the host when the tree cannot start outside Replit’s shell, or when secrets have no supported vault. Closable gaps — missing env, a domain still on Replit, a workflow you can land — are cutover work on this calendar.

Is there a short CodeCross lander I should use instead?

Yes. Use get off Replit for the runtime exit list, migrate from Replit for extract and parity, and Replit to production for the preview-is-not-prod clipboard. This essay stays the host cutover playbook. Use what production-ready means after vibe coding for the operating contract around the flip.

Next steps

Walk the gates in order. Inventory the tree, the secret names, the database, and the domain. Export to a company Git remote. Mint new secrets on a host that matches how the Repl runs. Land a runner that builds with the Repl closed. Smoke signup, session, and one write on a side name. Flip DNS. Shut the Deployment. Confirm the public URL. Pause any prompt that only ships from Always On while a gate is red.

CodeCross LLC is an Austin-registered product studio (1606 Headway Cir STE 9212, Austin, TX). We help operators turn a converting Repl into a host they can staff: export first, vault second, DNS last, a rewrite of the host only when the tree cannot start outside Replit. The Austin app development company page is the studio brief. Austin mobile app development is the store-binary engagement. Company-level evidence lives on proof. When you want a second pair of hands on the cutover, book a conversation.

The goal is not to punish vibe coding. It is to stop treating a warm Reserved VM as proof that a stranger on your team can keep customers online. Ownership of the host is evidence. Exit is a vault plus a named process plus a domain that survives a dark Repl. Get those three right and most teams never need a second codebase.