[Blog](https://cohesivity.ai/blog)

Agent-native backend

Published Jun 28, 2026·Updated Aug 30, 2026

![](https://cohesivity.ai/authors/arag.webp)![](https://cohesivity.ai/authors/shouryamaan.webp)[Arag](https://www.linkedin.com/in/aragagrawal/) and [Shouryamaan](https://www.linkedin.com/in/shouryamaanjain/)

# How AI Coding Agents Provision Databases, Auth, Storage, and Hosting

[Read as Markdown](https://cohesivity.ai/blog/how-ai-coding-agents-provision-databases-auth-storage-hosting.md)

Provisioner

cohesivity

Database

Auth

Storage

Hosting

An AI coding agent can provision a Cohesivity backend by creating one project tenant, reading the live contract for each required service, provisioning resources one at a time, and verifying the returned endpoints. The agent should reuse an existing `.cohesivity` file and keep both Cohesivity credentials out of browser code.

This walkthrough covers the sequence rather than freezing every resource body into an article. The offering page is the source of truth when an agent runs the task.

## Start with the application's requirements

List the state and external effects the application needs:

- relational data may require `postgres`;
- Google sign-in may require `social-login`;
- uploads may require `object-storage`;
- a public server may require `railway-hosting` or `cloudflare-workers`;
- asynchronous email may require `inbox`;
- live fan-out may require `realtime`.

Do not provision a vector database because the application contains an AI feature. The [Postgres and vector database guide](https://cohesivity.ai/blog/postgres-vs-vector-databases-for-ai-agent-memory) explains when semantic retrieval needs a separate store.

## Bootstrap or reuse the project

First check for a valid `.cohesivity` file. If it exists, reuse that tenant. Creating another one would split related resources and make cleanup harder.

When no project exists, preview the bootstrap:

```bash
npx @cohesivity/init --dry-run

```

Then create the ephemeral project:

```bash
npx @cohesivity/init

```

The command writes project context with a management key, application key, tenant ID, lifecycle, runtime profile, and expiry. The initial tenant lasts 72 hours and needs no signup. Claiming it later is a separate human consent step.

## Read each live offering contract

Before provisioning, fetch the current page for the resource, such as the live [Postgres offering contract](https://cohesivity.ai/offerings/postgres). Cohesivity requires a non-default User-Agent on direct HTTP requests:

```bash
curl -sS -A "MyCodingAgent/1.0" \
  https://cohesivity.ai/offerings/postgres

```

Read the required body, accepted regions, current limits, auth method, destructive operations, and verification fields. Repeat this for every resource. The [agent-operable backend guide](https://cohesivity.ai/blog/build-a-backend-ai-coding-agents-can-operate) explains why status and cleanup are part of the contract.

## Provision the database first

The live Postgres contract currently uses a management-plane request like this:

```bash
curl -sS -A "MyCodingAgent/1.0" -X POST \
  https://cohesivity.ai/api/resources/postgres \
  -H "Authorization: Bearer <coh_management_key>" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: provision-postgres-v1" \
  -d '{"region":"apac"}'

```

Choose the region from the live offering page. A resource is ready when its response says so and returns the documented endpoint. Do not infer readiness merely because the request returned 200.

From server-side application code, Postgres accepts one SQL statement or an atomic batch. PostgreSQL uses `$1` placeholders:

```bash
curl -sS -A "MyAppServer/1.0" -X POST \
  "https://cohesivity.ai/edge/postgres?key=<coh_application_key>" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: create-signups-schema-v1" \
  -d '{"query":"CREATE TABLE IF NOT EXISTS signups (id BIGSERIAL PRIMARY KEY, email TEXT UNIQUE NOT NULL)"}'

```

The query-string credential is the documented fallback. A server can exchange the application key for a short-lived edge session token and use bearer auth instead. Neither credential belongs in client-side JavaScript.

## Add authentication with all callback URLs

Social login provisioning replaces the complete callback URL list. Include development and production URLs in the same request:

```bash
curl -sS -A "MyCodingAgent/1.0" -X POST \
  https://cohesivity.ai/api/resources/social-login \
  -H "Authorization: Bearer <coh_management_key>" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: provision-social-login-v1" \
  -d '{"callback_urls":["http://localhost:3000/auth/done","https://example.cohesivity.app/auth/done"]}'

```

Use the actual deployment hostname returned by the hosting flow. Replacing the list later with only one URL removes the omitted callback.

## Provision storage and hosting from their own contracts

Object storage profiles, upload behavior, hosting file formats, environment variables, domains, and readiness checks have separate offering pages. Fetch them immediately before use. Cohesivity's current primary hosting path uploads files through its Railway hosting API, without requiring a Railway CLI, GitHub connection, or tenant-held Railway credential.

Provision one service, verify it, then continue. A bulk request saves little time and makes it harder to identify which contract failed.

## Verify the full lifecycle

After setup:

1. Query resource status through the management plane.
2. Exercise one server-side application call.
3. Repeat one write with the same idempotency key and confirm one effect.
4. Confirm no `coh_*` value appears in browser assets, logs, or version control.
5. Record the tenant expiry and claim boundary.
6. Document how each disposable resource is removed.

The prompt below asks the coding agent for the smallest resource set and stops before it creates anything.

or send it to[Claude Code](https://claude.ai/new?q=Inspect+this+repository+and+identify+the+minimum+backend+resources+it+needs+now.+Reuse+a+valid+.cohesivity+file+if+present.+Otherwise+prepare+npx+%40cohesivity%2Finit.+Before+provisioning+any+resource%2C+fetch+its+current+https%3A%2F%2Fcohesivity.ai%2Fofferings%2F%3Cname%3E+page+with+a+non-default+User-Agent+and+summarize+its+request%2C+auth%2C+limits%2C+destructive+actions%2C+and+verification+step.+Do+not+claim+the+tenant%2C+spend+money%2C+upgrade+a+plan%2C+or+provision+until+I+approve+the+exact+resource+list.+After+approval%2C+provision+one+resource+at+a+time+with+stable+idempotency+keys%2C+keep+all+coh%5F%2A+credentials+server-side%2C+verify+each+returned+endpoint%2C+and+report+the+tenant%27s+72-hour+expiry. "Send to Claude")[Cursor](https://cursor.com/link/prompt?text=Inspect+this+repository+and+identify+the+minimum+backend+resources+it+needs+now.+Reuse+a+valid+.cohesivity+file+if+present.+Otherwise+prepare+npx+%40cohesivity%2Finit.+Before+provisioning+any+resource%2C+fetch+its+current+https%3A%2F%2Fcohesivity.ai%2Fofferings%2F%3Cname%3E+page+with+a+non-default+User-Agent+and+summarize+its+request%2C+auth%2C+limits%2C+destructive+actions%2C+and+verification+step.+Do+not+claim+the+tenant%2C+spend+money%2C+upgrade+a+plan%2C+or+provision+until+I+approve+the+exact+resource+list.+After+approval%2C+provision+one+resource+at+a+time+with+stable+idempotency+keys%2C+keep+all+coh%5F%2A+credentials+server-side%2C+verify+each+returned+endpoint%2C+and+report+the+tenant%27s+72-hour+expiry. "Send to Cursor")[Codex](https://chatgpt.com/codex?prompt=Inspect+this+repository+and+identify+the+minimum+backend+resources+it+needs+now.+Reuse+a+valid+.cohesivity+file+if+present.+Otherwise+prepare+npx+%40cohesivity%2Finit.+Before+provisioning+any+resource%2C+fetch+its+current+https%3A%2F%2Fcohesivity.ai%2Fofferings%2F%3Cname%3E+page+with+a+non-default+User-Agent+and+summarize+its+request%2C+auth%2C+limits%2C+destructive+actions%2C+and+verification+step.+Do+not+claim+the+tenant%2C+spend+money%2C+upgrade+a+plan%2C+or+provision+until+I+approve+the+exact+resource+list.+After+approval%2C+provision+one+resource+at+a+time+with+stable+idempotency+keys%2C+keep+all+coh%5F%2A+credentials+server-side%2C+verify+each+returned+endpoint%2C+and+report+the+tenant%27s+72-hour+expiry. "Send to Codex")[opencode](https://opencode.ai/?q=Inspect+this+repository+and+identify+the+minimum+backend+resources+it+needs+now.+Reuse+a+valid+.cohesivity+file+if+present.+Otherwise+prepare+npx+%40cohesivity%2Finit.+Before+provisioning+any+resource%2C+fetch+its+current+https%3A%2F%2Fcohesivity.ai%2Fofferings%2F%3Cname%3E+page+with+a+non-default+User-Agent+and+summarize+its+request%2C+auth%2C+limits%2C+destructive+actions%2C+and+verification+step.+Do+not+claim+the+tenant%2C+spend+money%2C+upgrade+a+plan%2C+or+provision+until+I+approve+the+exact+resource+list.+After+approval%2C+provision+one+resource+at+a+time+with+stable+idempotency+keys%2C+keep+all+coh%5F%2A+credentials+server-side%2C+verify+each+returned+endpoint%2C+and+report+the+tenant%27s+72-hour+expiry. "Send to OpenCode")