[{"data":1,"prerenderedAt":1208},["ShallowReactive",2],{"/blog/mcp-server-authentication-api-keys-vs-oauth-2026/":3,"/blog/mcp-server-authentication-api-keys-vs-oauth-2026/-related":390,"/blog/mcp-server-authentication-api-keys-vs-oauth-2026/-resources":1184},{"id":4,"title":5,"author":6,"body":10,"category":370,"createdAt":371,"description":372,"extension":373,"location":374,"meta":375,"navigation":381,"ogImage":382,"path":383,"readingTime":384,"seo":385,"stem":386,"tags":387,"updatedAt":371,"url":388,"__hash__":389},"blog/blog/mcp-server-authentication-api-keys-vs-oauth-2026.md","MCP Server Authentication for SaaS: API Keys vs OAuth (2026)",{"name":7,"social":8},"Simon Dziak",{"twitter":9},"@SzymonDziak",{"type":11,"value":12,"toc":352},"minimark",[13,21,35,40,49,63,67,70,140,143,147,150,170,173,176,202,206,209,229,244,247,251,254,299,303,309,313,318,321,325,328,332,338,342,345,349],[14,15,16,20],"p",{},[17,18,19],"strong",{},"If your MCP server runs on your own machine, you probably don't need OAuth; if it is a remote server that your customers connect to from Claude or ChatGPT, you almost certainly do."," The choice depends on who connects, where the server runs, and whether the assistant has to act as one specific user. This guide covers what the MCP specification requires, where API keys or personal access tokens are still a sensible choice, and what Claude and ChatGPT say they expect today.",[14,22,23,24,29,30,34],{},"If you want the server built for you, App369 offers a fixed-price ",[25,26,28],"a",{"href":27},"/fixed-price/mcp-server-for-saas/","MCP Connector for your SaaS",". If you are still deciding whether to build one at all, start with ",[25,31,33],{"href":32},"/blog/how-to-add-an-mcp-server-to-your-saas-2026/","how to add an MCP server to your SaaS",".",[36,37,39],"h2",{"id":38},"local-vs-remote-servers","Local vs remote servers",[14,41,42,43,34],{},"MCP defines two standard transports: stdio and Streamable HTTP. With stdio, the client launches your server as a local subprocess. With Streamable HTTP, the server is a web endpoint that clients reach over the network, which is how a SaaS product normally offers one to many customers. Both are described in the ",[25,44,48],{"href":45,"rel":46},"https://modelcontextprotocol.io/specification/2026-07-28/basic/transports",[47],"nofollow","MCP transports specification",[14,50,51,52,57,58,62],{},"The ",[25,53,56],{"href":54,"rel":55},"https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",[47],"MCP authorization specification"," is explicit about the split. Authorization is optional. HTTP-based servers that support it should follow the spec. Servers on stdio \"SHOULD NOT\" follow it and should instead retrieve credentials from the environment. So a local server that reads ",[59,60,61],"code",{},"MYAPP_API_KEY"," from an environment variable is normal and spec-aligned. A remote server is a different problem, because the person connecting is a customer you can't hand an environment variable to.",[36,64,66],{"id":65},"what-the-spec-requires-for-remote-servers","What the spec requires for remote servers",[14,68,69],{},"The latest published revision at the time of writing is dated 2026-07-28. The authorization section builds on OAuth 2.1, which is still an IETF draft, not a finished standard. In practice, a remote MCP server that wants to be reachable by standard clients does the following:",[71,72,73,84,96,106,118,124,134],"ul",{},[74,75,76,79,80,83],"li",{},[17,77,78],{},"Acts as an OAuth resource server."," It accepts bearer tokens in the ",[59,81,82],{},"Authorization"," header on every request, never in the URL query string.",[74,85,86,89,90,95],{},[17,87,88],{},"Publishes protected resource metadata."," The spec says MCP servers MUST implement ",[25,91,94],{"href":92,"rel":93},"https://datatracker.ietf.org/doc/html/rfc9728",[47],"RFC 9728",", and the metadata must name at least one authorization server.",[74,97,98,101,102,105],{},[17,99,100],{},"Answers unauthenticated requests with a 401"," whose ",[59,103,104],{},"WWW-Authenticate"," header points at that metadata. That is how a client discovers where to sign in.",[74,107,108,111,112,117],{},[17,109,110],{},"Has an authorization server with discovery metadata."," It must provide either ",[25,113,116],{"href":114,"rel":115},"https://datatracker.ietf.org/doc/html/rfc8414",[47],"RFC 8414"," metadata or OpenID Connect Discovery. This can be your existing identity provider, or one you host with the server.",[74,119,120,123],{},[17,121,122],{},"Supports a way for the client to get a client ID."," The 2026-07-28 revision says authorization servers and clients SHOULD support Client ID Metadata Documents, MAY support Dynamic Client Registration, and marks Dynamic Client Registration as deprecated and kept for backwards compatibility. The earlier 2025-06-18 revision listed Dynamic Client Registration as a SHOULD. If you support both, you are covered either way.",[74,125,126,129,130,133],{},[17,127,128],{},"Uses PKCE"," on the authorization code flow, and clients send a ",[59,131,132],{},"resource"," parameter (RFC 8707) that names your server.",[74,135,136,139],{},[17,137,138],{},"Validates the token's audience."," The server must only accept tokens issued for it, and must not pass the token it received on to other APIs. If your MCP server calls your REST API, it should use a credential meant for that API.",[14,141,142],{},"That is a lot of moving parts, but most of them are standard features of an identity provider. The part teams underestimate is the first sign-in: the user lands on a consent screen, approves a connection, and your authorization server issues a token tied to that user.",[36,144,146],{"id":145},"when-api-keys-or-personal-access-tokens-are-enough","When API keys or personal access tokens are enough",[14,148,149],{},"OAuth is the right default for a public, multi-customer remote server. But a key or token is a reasonable choice in some situations:",[71,151,152,158,164],{},[74,153,154,157],{},[17,155,156],{},"Local or internal use."," A developer runs your stdio server on their laptop with their own key. This is the case the spec describes for stdio.",[74,159,160,163],{},[17,161,162],{},"A private connector for one team."," An admin connects a custom server for their organization, and everyone shares access to the same data.",[74,165,166,169],{},[17,167,168],{},"A first version."," Your API already issues keys, and you want customers to try the connector before you invest in an OAuth server.",[14,171,172],{},"Claude's connector documentation describes a static credential option too: an organization Owner enters an API key or bearer token once, and Claude sends it as a request header on every call. Anthropic marks this as beta and available only to a limited set of organizations. It also says to treat the key as the organization's credential rather than a person's, because every member's requests carry the same key, and to use OAuth if your tools must act as the individual user.",[14,174,175],{},"The trade-offs are real:",[71,177,178,184,190,196],{},[74,179,180,183],{},[17,181,182],{},"Users have to copy secrets."," Pasting a key into a settings box is friction, and a pasted key can end up in chat logs, screenshots or notes.",[74,185,186,189],{},[17,187,188],{},"Scoping is on you."," An OAuth token carries scopes the user approved. A key is whatever your key system says it is, so a key that can delete data should not be the same one used for reading reports.",[74,191,192,195],{},[17,193,194],{},"Rotation is manual."," OAuth access tokens are short-lived by design, and the spec recommends short-lived access tokens. Keys tend to live for years unless you build expiry.",[74,197,198,201],{},[17,199,200],{},"Per-user identity is weaker."," If one key serves a whole workspace, your audit log can't say which person asked the assistant to do something.",[36,203,205],{"id":204},"what-claude-and-chatgpt-say-they-expect","What Claude and ChatGPT say they expect",[14,207,208],{},"Both vendors publish requirements. Check them again before you build, because they change.",[14,210,211,214,215,220,221,224,225,228],{},[17,212,213],{},"Claude."," The ",[25,216,219],{"href":217,"rel":218},"https://claude.com/docs/connectors/building/authentication",[47],"authentication guide for Claude connectors"," lists OAuth 2.0 with Dynamic Client Registration and OAuth with Client ID Metadata Documents as supported by default, along with no-auth servers and the beta static-credential option above. It requires a 401 with a ",[59,222,223],{},"resource_metadata"," pointer, S256 PKCE, and a fixed callback URL for the hosted apps. It says a machine-to-machine ",[59,226,227],{},"client_credentials"," grant isn't supported, and that Claude gives your discovery and token endpoints 10 seconds to respond.",[14,230,231,234,235,240,241,243],{},[17,232,233],{},"ChatGPT."," OpenAI's ",[25,236,239],{"href":237,"rel":238},"https://developers.openai.com/apps-sdk/build/auth",[47],"Apps SDK authentication documentation"," says servers that need sign-in should implement an OAuth 2.1 flow that follows the MCP authorization spec, with protected resource metadata, PKCE with S256, and the ",[59,242,132],{}," parameter. It names Client ID Metadata Documents as the preferred registration method, with Dynamic Client Registration still supported. It also lets individual tools be declared callable without authentication, and tells servers to verify every token themselves: signature, issuer, audience, expiry and scopes.",[14,245,246],{},"The pattern is the same in both: if a user's own account is involved, plan on OAuth.",[36,248,250],{"id":249},"practices-that-hold-either-way","Practices that hold either way",[14,252,253],{},"Whatever you pick, these apply:",[255,256,257,263,269,275,281,287,293],"ol",{},[74,258,259,262],{},[17,260,261],{},"One credential per user, never one shared key."," A shared key can't be revoked for one person and hides who did what.",[74,264,265,268],{},[17,266,267],{},"Least-privilege scopes."," Start with read access. Put destructive tools behind a separate scope so a user can approve reading without approving deleting. The spec's scope guidance tells clients to request only what they need, and lets your server say which scope a request requires.",[74,270,271,274],{},[17,272,273],{},"Don't forward tokens."," Your MCP server should authenticate to your API as itself or with a token issued for that API, not with a copy of the one it was handed.",[74,276,277,280],{},[17,278,279],{},"Return the right errors."," 401 for a missing or invalid token, 403 for insufficient scope.",[74,282,283,286],{},[17,284,285],{},"Log every tool call"," with the user, the tool, a timestamp and the outcome, but never log token values.",[74,288,289,292],{},[17,290,291],{},"Make revocation easy."," Users should be able to disconnect an assistant from your settings page, and an admin should be able to cut off a user at once. Short-lived access tokens limit how long a leaked one is useful.",[74,294,295,298],{},[17,296,297],{},"Keep secrets out of URLs."," Both the spec and Claude's documentation say no tokens in query strings.",[36,300,302],{"id":301},"when-to-get-help","When to get help",[14,304,305,306,308],{},"If you have a documented REST API and want an MCP server over it, App369 builds one at a fixed price: the ",[25,307,28],{"href":27}," is $2,500 for up to 8 tools over your existing API, with API-key or personal-access-token auth, deployed to your own cloud account, tested in Claude and ChatGPT, with a directory-submission packet. OAuth sign-in is a +$1,000 add-on. Delivery is 10 business days after your API docs and a test key arrive. Directory approval is up to each directory and isn't guaranteed. Simon builds and runs the MCP server for Workspace369, a production Flutter and Firebase SaaS.",[36,310,312],{"id":311},"frequently-asked-questions","Frequently Asked Questions",[314,315,317],"h3",{"id":316},"does-an-mcp-server-need-oauth","Does an MCP server need OAuth?",[14,319,320],{},"No. The MCP specification says authorization is optional. But if a remote HTTP server wants to work with standard clients that sign users in, the spec's authorization flow is OAuth-based. Local stdio servers are expected to read credentials from the environment instead.",[314,322,324],{"id":323},"can-i-use-an-api-key-for-a-remote-mcp-server","Can I use an API key for a remote MCP server?",[14,326,327],{},"Yes, technically. A server can read a key from a request header. Claude documents a beta option where an organization Owner enters a key once, but it treats that key as the organization's credential. For per-user access, use OAuth.",[314,329,331],{"id":330},"what-is-protected-resource-metadata","What is protected resource metadata?",[14,333,334,335,337],{},"It is a JSON document, defined in RFC 9728, that tells a client which authorization server protects your MCP server. The MCP spec requires servers to publish it, and to point to it in the ",[59,336,104],{}," header of a 401 response.",[314,339,341],{"id":340},"do-i-need-dynamic-client-registration","Do I need Dynamic Client Registration?",[14,343,344],{},"It depends on the revision. The 2025-06-18 spec recommended it; the 2026-07-28 revision prefers Client ID Metadata Documents and marks Dynamic Client Registration as deprecated, kept for compatibility. Claude supports both, and ChatGPT prefers Client ID Metadata Documents but still supports registration.",[314,346,348],{"id":347},"how-should-i-revoke-access","How should I revoke access?",[14,350,351],{},"Issue per-user tokens, keep access tokens short-lived, and let users and admins disconnect a client from your settings. Revoking one user's grant should not affect anyone else.",{"title":353,"searchDepth":354,"depth":354,"links":355},"",2,[356,357,358,359,360,361,362],{"id":38,"depth":354,"text":39},{"id":65,"depth":354,"text":66},{"id":145,"depth":354,"text":146},{"id":204,"depth":354,"text":205},{"id":249,"depth":354,"text":250},{"id":301,"depth":354,"text":302},{"id":311,"depth":354,"text":312,"children":363},[364,366,367,368,369],{"id":316,"depth":365,"text":317},3,{"id":323,"depth":365,"text":324},{"id":330,"depth":365,"text":331},{"id":340,"depth":365,"text":341},{"id":347,"depth":365,"text":348},"AI & Technology","2026-10-12T18:00:00.000Z","How should users sign in to your remote MCP server? What the MCP spec requires, when API keys are enough, and what Claude and ChatGPT expect today.","md","Boynton Beach, FL",{"readingTimeStats":376},{"text":377,"minutes":378,"time":379,"words":380},"8 min read",7.705,462300,1541,true,null,"/blog/mcp-server-authentication-api-keys-vs-oauth-2026","8 min",{"title":5,"description":372},"blog/mcp-server-authentication-api-keys-vs-oauth-2026","mcp server authentication, mcp oauth, remote mcp server, mcp api key, protected resource metadata, claude connectors, chatgpt apps","https://app369.com/blog/mcp-server-authentication-api-keys-vs-oauth-2026/","IUWagOejysg8XkqPw9Y1iIakncU-7zbBhUGMm06ATy8",[391,718],{"id":392,"title":393,"author":394,"body":396,"category":370,"createdAt":704,"description":705,"extension":373,"location":374,"meta":706,"navigation":381,"ogImage":382,"path":712,"readingTime":384,"seo":713,"stem":714,"tags":715,"updatedAt":704,"url":716,"__hash__":717},"blog/blog/business-application-modernization-guide-2026.md","Business Application Modernization for Small Businesses (2026)",{"name":7,"social":395},{"twitter":9},{"type":11,"value":397,"toc":696},[398,404,408,411,443,446,450,459,547,550,554,557,574,580,583,609,613,616,642,650,654,674,678],[14,399,400,403],{},[17,401,402],{},"Application modernization means updating software your business already depends on so it is cheaper to run, safer, and easier to change, without throwing away what works."," Most guides on the topic are written for large enterprises with mainframes and hundred-person IT teams. This one is for smaller companies: a custom app built a few years ago, an internal tool on an old framework, or a mobile app nobody wants to touch anymore.",[36,405,407],{"id":406},"signs-your-app-needs-modernizing","Signs your app needs modernizing",[14,409,410],{},"You don't modernize because the code is old. You modernize because the age is starting to cost you. Common signs:",[71,412,413,419,425,431,437],{},[74,414,415,418],{},[17,416,417],{},"Updates are risky."," Small changes break unrelated parts, so every release needs days of manual testing, or releases simply stop.",[74,420,421,424],{},[17,422,423],{},"The platform is moving on without you."," The framework, language version or hosting is out of support, so security patches have stopped. App stores also raise their minimum requirements over time, and an app that can't be rebuilt with current tools eventually can't ship updates.",[74,426,427,430],{},[17,428,429],{},"Only one person understands it."," If the original developer leaves, nobody can safely change it.",[74,432,433,436],{},[17,434,435],{},"It doesn't fit how you work now."," Staff work around the app with spreadsheets, copy data between systems by hand, or can't use it on a phone.",[74,438,439,442],{},[17,440,441],{},"Hosting or licence costs keep rising"," for a system that isn't doing more than it used to.",[14,444,445],{},"One sign alone is not a reason to rebuild. Two or three together usually are a reason to plan.",[36,447,449],{"id":448},"the-options-from-lightest-to-heaviest","The options, from lightest to heaviest",[14,451,452,453,458],{},"Modernization is a range of choices, not a single project. A common way to describe them, adapted from the \"R\" models cloud providers use (",[25,454,457],{"href":455,"rel":456},"https://docs.aws.amazon.com/prescriptive-guidance/latest/large-migration-guide/migration-strategies.html",[47],"AWS: migration strategies","):",[460,461,462,478],"table",{},[463,464,465],"thead",{},[466,467,468,472,475],"tr",{},[469,470,471],"th",{},"Option",[469,473,474],{},"What changes",[469,476,477],{},"When it fits",[479,480,481,495,508,521,534],"tbody",{},[466,482,483,489,492],{},[484,485,486],"td",{},[17,487,488],{},"Rehost",[484,490,491],{},"The same app moves to new hosting, for example from an old server to a managed cloud service.",[484,493,494],{},"The code is fine; the server is the problem.",[466,496,497,502,505],{},[484,498,499],{},[17,500,501],{},"Replatform",[484,503,504],{},"Small changes to use managed services: a managed database, managed auth, file storage.",[484,506,507],{},"You want less server upkeep without touching features.",[466,509,510,515,518],{},[484,511,512],{},[17,513,514],{},"Refactor",[484,516,517],{},"The code is restructured and upgraded in place: framework upgrades, tests added, modules split.",[484,519,520],{},"The app's design is sound, but the code has decayed.",[466,522,523,528,531],{},[484,524,525],{},[17,526,527],{},"Rebuild",[484,529,530],{},"A new app replaces the old one, usually feature by feature.",[484,532,533],{},"The design no longer fits the business, or the stack is a dead end.",[466,535,536,541,544],{},[484,537,538],{},[17,539,540],{},"Replace",[484,542,543],{},"An off-the-shelf product replaces the custom app.",[484,545,546],{},"What the app does is no longer unique to your business.",[14,548,549],{},"The honest answer is often a mix: rehost now to stop the bleeding, refactor the parts that still fit, and rebuild only the parts that don't. Replacing with an off-the-shelf product is worth a serious look before any rebuild, because a custom app you don't need is the most expensive kind.",[36,551,553],{"id":552},"how-to-modernize-without-stopping-the-business","How to modernize without stopping the business",[14,555,556],{},"The biggest risk in modernization is the \"big bang\" rewrite: a year of building a new system while the old one freezes, then a risky switch-over. Two habits avoid most of that risk.",[14,558,559,562,563,567,568,573],{},[17,560,561],{},"Replace it in slices."," The usual pattern is often called the ",[564,565,566],"em",{},"strangler fig",": put the new system alongside the old one and move one feature at a time, routing users to the new version as each piece is ready, until nothing is left in the old system (",[25,569,572],{"href":570,"rel":571},"https://martinfowler.com/bliki/StranglerFigApplication.html",[47],"Martin Fowler: Strangler Fig Application","). Each slice ships on its own, so value arrives early and a problem only affects one slice.",[14,575,576,579],{},[17,577,578],{},"Treat the data as the real project."," Screens are easy to rebuild; years of customer records, orders and history are not. Map the old data model before writing new code, plan how records move (once, or synced during the transition), and test the migration on a copy of real data, not samples.",[14,581,582],{},"A few more habits that pay off:",[71,584,585,591,597,603],{},[74,586,587,590],{},[17,588,589],{},"Write down what the old app actually does,"," including the odd rules nobody remembers until they break.",[74,592,593,596],{},[17,594,595],{},"Add tests around the old behavior first,"," so you can prove the new version matches.",[74,598,599,602],{},[17,600,601],{},"Keep both systems running"," until the new one has handled real use for a while.",[74,604,605,608],{},[17,606,607],{},"Change the business process only when you mean to."," A modernization that also changes how people work needs training time and buy-in, so plan for both.",[36,610,612],{"id":611},"what-a-modernized-stack-often-looks-like-for-a-small-business","What a modernized stack often looks like for a small business",[14,614,615],{},"There is no single right stack, but for a typical small-business app a modern setup tends to share these traits:",[71,617,618,624,630,636],{},[74,619,620,623],{},[17,621,622],{},"Managed services instead of servers you patch yourself:"," for example Firebase or Google Cloud for authentication, the database, file storage and server functions.",[74,625,626,629],{},[17,627,628],{},"One codebase for mobile and web where it makes sense."," Flutter, for instance, builds iOS, Android and web apps from one Dart codebase, which cuts the number of apps to maintain.",[74,631,632,635],{},[17,633,634],{},"Automated tests and a repeatable deploy,"," so updates stop being events.",[74,637,638,641],{},[17,639,640],{},"Integrations through APIs"," (payments, email, calendars, accounting) instead of manual exports.",[14,643,644,645,649],{},"This is the stack we use for our own product, ",[25,646,648],{"href":647},"/case-studies/workspace369/","Workspace369",", and the case study explains the trade-offs we made, including splitting a large backend into smaller, separately deployed parts.",[36,651,653],{"id":652},"a-short-checklist-before-you-start","A short checklist before you start",[255,655,656,659,662,665,668,671],{},[74,657,658],{},"List what the app does today and who uses each part.",[74,660,661],{},"Decide what must not change (data, integrations, URLs, compliance needs).",[74,663,664],{},"Choose an option per part: rehost, replatform, refactor, rebuild or replace.",[74,666,667],{},"Pick the first slice: small, valuable and low-risk.",[74,669,670],{},"Plan the data migration and test it on a copy of real data.",[74,672,673],{},"Set a date to switch off the old system, and keep it once the new one has proven itself.",[36,675,677],{"id":676},"getting-help","Getting help",[14,679,680,681,685,686,690,691,695],{},"App369 helps small and mid-size businesses in Palm Beach County and beyond modernize apps they already rely on: upgrades, rebuilds in Flutter, and moving backends to managed cloud services. For ongoing upkeep after the work, see ",[25,682,684],{"href":683},"/service/ongoing-maintenance/","software maintenance and support",". For a rough budget, try the ",[25,687,689],{"href":688},"/tools/app-cost-calculator/","app cost calculator",", or ",[25,692,694],{"href":693},"/contact/","send us your brief"," and we'll reply by email, usually within one business day.",{"title":353,"searchDepth":354,"depth":354,"links":697},[698,699,700,701,702,703],{"id":406,"depth":354,"text":407},{"id":448,"depth":354,"text":449},{"id":552,"depth":354,"text":553},{"id":611,"depth":354,"text":612},{"id":652,"depth":354,"text":653},{"id":676,"depth":354,"text":677},"2026-10-12T19:00:00.000Z","Business application modernization for small and mid-size companies: how to tell an app needs it, the options from rehosting to a full rebuild, and how to modernize without stopping the business.",{"readingTimeStats":707},{"text":708,"minutes":709,"time":710,"words":711},"5 min read",4.59,275400,918,"/blog/business-application-modernization-guide-2026",{"title":393,"description":705},"blog/business-application-modernization-guide-2026","business application modernization, application modernization, legacy app modernization, app rebuild, refactor vs rebuild, software modernization","https://app369.com/blog/business-application-modernization-guide-2026/","KbwefmOfD_7L9xAKnESgFEWwa42dJhu7cQQdFs5BxH8",{"id":719,"title":720,"author":721,"body":723,"category":370,"createdAt":371,"description":1170,"extension":373,"location":374,"meta":1171,"navigation":381,"ogImage":382,"path":1177,"readingTime":1178,"seo":1179,"stem":1180,"tags":1181,"updatedAt":371,"url":1182,"__hash__":1183},"blog/blog/apps-built-with-flutter-examples-2026.md","Apps Built with Flutter: Real Examples by Industry (2026)",{"name":7,"social":722},{"twitter":9},{"type":11,"value":724,"toc":1159},[725,737,740,744,805,808,812,864,867,871,930,934,976,980,1032,1036,1095,1099,1105,1109,1140,1144],[14,726,727,730,731,736],{},[17,728,729],{},"Flutter is behind apps from Google, BMW, Toyota, Nubank, Headspace, eBay and MGM Resorts, along with many smaller products."," Below are real examples grouped by industry. Every one is taken from the official ",[25,732,735],{"href":733,"rel":734},"https://flutter.dev/showcase",[47],"Flutter showcase",", and each name links to the company's own case study there, so you can read what they built and why.",[14,738,739],{},"We are a Flutter agency, so we have an obvious interest here. That's why this list sticks to examples you can check yourself instead of our own claims.",[36,741,743],{"id":742},"finance-and-payments","Finance and payments",[71,745,746,757,767,777,787],{},[74,747,748,756],{},[17,749,750,755],{},[25,751,754],{"href":752,"rel":753},"https://flutter.dev/showcase/google-pay",[47],"Google Pay",":"," Google's payments app, which the showcase describes as \"going global\" with Flutter.",[74,758,759,766],{},[17,760,761,755],{},[25,762,765],{"href":763,"rel":764},"https://flutter.dev/showcase/nubank",[47],"Nubank"," the Brazilian digital bank, scaling its mobile app with Flutter.",[74,768,769,776],{},[17,770,771,755],{},[25,772,775],{"href":773,"rel":774},"https://flutter.dev/showcase/sofi",[47],"SoFi"," a finance \"superapp\" experience built with Flutter.",[74,778,779,786],{},[17,780,781,755],{},[25,782,785],{"href":783,"rel":784},"https://flutter.dev/showcase/betterment",[47],"Betterment"," the investing app, scaling its development team on Flutter.",[74,788,789,796,797,804],{},[17,790,791],{},[25,792,795],{"href":793,"rel":794},"https://flutter.dev/showcase/virgin-money",[47],"Virgin Money"," and ",[17,798,799,755],{},[25,800,803],{"href":801,"rel":802},"https://flutter.dev/showcase/credit-agricole",[47],"Crédit Agricole"," banks that unified their app development on Flutter.",[14,806,807],{},"Finance apps are a good stress test: they need security reviews, accessibility and the same behavior on iOS and Android. That is the kind of work a single shared codebase makes easier to keep consistent.",[36,809,811],{"id":810},"automotive-and-devices","Automotive and devices",[71,813,814,824,834,844,854],{},[74,815,816,823],{},[17,817,818,755],{},[25,819,822],{"href":820,"rel":821},"https://flutter.dev/showcase/bmw",[47],"BMW"," which the showcase describes as scaling customer-centric product development at BMW Group with Flutter.",[74,825,826,833],{},[17,827,828,755],{},[25,829,832],{"href":830,"rel":831},"https://flutter.dev/showcase/toyota",[47],"Toyota"," infotainment systems in Toyota vehicles.",[74,835,836,843],{},[17,837,838,755],{},[25,839,842],{"href":840,"rel":841},"https://flutter.dev/showcase/lucid-motors",[47],"Lucid Motors"," a small team shipping a multiplatform app from one codebase.",[74,845,846,853],{},[17,847,848,755],{},[25,849,852],{"href":850,"rel":851},"https://flutter.dev/showcase/lg-electronics",[47],"LG Electronics"," building parts of its next-generation webOS.",[74,855,856,863],{},[17,857,858,755],{},[25,859,862],{"href":860,"rel":861},"https://flutter.dev/showcase/whirlpool",[47],"Whirlpool"," connected-appliance apps.",[14,865,866],{},"These show Flutter outside phones too: car screens, TVs and embedded devices.",[36,868,870],{"id":869},"retail-food-and-marketplaces","Retail, food and marketplaces",[71,872,873,883,893,910,920],{},[74,874,875,882],{},[17,876,877,755],{},[25,878,881],{"href":879,"rel":880},"https://flutter.dev/showcase/ebay",[47],"eBay"," eBay engineering teams building with Flutter.",[74,884,885,892],{},[17,886,887,755],{},[25,888,891],{"href":889,"rel":890},"https://flutter.dev/showcase/alibaba-group",[47],"Alibaba Group"," scaling China's largest second-hand marketplace with Flutter.",[74,894,895,796,902,909],{},[17,896,897],{},[25,898,901],{"href":899,"rel":900},"https://flutter.dev/showcase/wolt",[47],"Wolt",[17,903,904,755],{},[25,905,908],{"href":906,"rel":907},"https://flutter.dev/showcase/talabat",[47],"talabat"," food and grocery delivery apps.",[74,911,912,919],{},[17,913,914,755],{},[25,915,918],{"href":916,"rel":917},"https://flutter.dev/showcase/caribou-coffee",[47],"Caribou Coffee"," migrated its ordering app to a single Flutter codebase.",[74,921,922,929],{},[17,923,924,755],{},[25,925,928],{"href":926,"rel":927},"https://flutter.dev/showcase/kijiji1",[47],"Kijiji"," the Canadian classifieds marketplace.",[36,931,933],{"id":932},"health-fitness-and-wellbeing","Health, fitness and wellbeing",[71,935,936,946,956,966],{},[74,937,938,945],{},[17,939,940,755],{},[25,941,944],{"href":942,"rel":943},"https://flutter.dev/showcase/headspace",[47],"Headspace"," the meditation and mental health app.",[74,947,948,955],{},[17,949,950,755],{},[25,951,954],{"href":952,"rel":953},"https://flutter.dev/showcase/tonal",[47],"Tonal"," the connected strength-training system, using Flutter for feature parity across platforms.",[74,957,958,965],{},[17,959,960,755],{},[25,961,964],{"href":962,"rel":963},"https://flutter.dev/showcase/cz-zorgverzekeringen",[47],"CZ Zorgverzekeringen"," a Dutch health insurer's member app.",[74,967,968,975],{},[17,969,970,755],{},[25,971,974],{"href":972,"rel":973},"https://flutter.dev/showcase/us-department-of-veterans-affairs",[47],"US Department of Veterans Affairs"," STAIR, an app that helps veterans adjust to civilian life.",[36,977,979],{"id":978},"travel-entertainment-and-hospitality","Travel, entertainment and hospitality",[71,981,982,992,1002,1012,1022],{},[74,983,984,991],{},[17,985,986,755],{},[25,987,990],{"href":988,"rel":989},"https://flutter.dev/showcase/mgm-resorts",[47],"MGM Resorts"," the guest app for MGM's resorts.",[74,993,994,1001],{},[17,995,996,755],{},[25,997,1000],{"href":998,"rel":999},"https://flutter.dev/showcase/universal-studios",[47],"Universal Studios"," theme park guest experiences.",[74,1003,1004,1011],{},[17,1005,1006,755],{},[25,1007,1010],{"href":1008,"rel":1009},"https://flutter.dev/showcase/sncf-connect",[47],"SNCF Connect"," France's rail booking app.",[74,1013,1014,1021],{},[17,1015,1016,755],{},[25,1017,1020],{"href":1018,"rel":1019},"https://flutter.dev/showcase/hamilton",[47],"Hamilton"," the official app for the musical.",[74,1023,1024,1031],{},[17,1025,1026,755],{},[25,1027,1030],{"href":1028,"rel":1029},"https://flutter.dev/showcase/pubg-mobile",[47],"PUBG MOBILE"," which the showcase describes as connecting players with Flutter.",[36,1033,1035],{"id":1034},"productivity-education-and-software","Productivity, education and software",[71,1037,1038,1048,1058,1068,1085],{},[74,1039,1040,1047],{},[17,1041,1042,755],{},[25,1043,1046],{"href":1044,"rel":1045},"https://flutter.dev/showcase/notebooklm",[47],"NotebookLM"," Google's AI research and note-taking app.",[74,1049,1050,1057],{},[17,1051,1052,755],{},[25,1053,1056],{"href":1054,"rel":1055},"https://flutter.dev/showcase/google-classroom",[47],"Google Classroom"," listed in the showcase among Google's own Flutter apps.",[74,1059,1060,1067],{},[17,1061,1062,755],{},[25,1063,1066],{"href":1064,"rel":1065},"https://flutter.dev/showcase/zoho-tables",[47],"Zoho Tables"," a spreadsheet-database hybrid.",[74,1069,1070,796,1077,1084],{},[17,1071,1072],{},[25,1073,1076],{"href":1074,"rel":1075},"https://flutter.dev/showcase/superlist",[47],"Superlist",[17,1078,1079,755],{},[25,1080,1083],{"href":1081,"rel":1082},"https://flutter.dev/showcase/rows",[47],"Rows"," a task manager and a spreadsheet tool built for desktop, web and mobile.",[74,1086,1087,1094],{},[17,1088,1089,755],{},[25,1090,1093],{"href":1091,"rel":1092},"https://flutter.dev/showcase/rive",[47],"Rive"," an animation tool rewritten entirely in Flutter.",[36,1096,1098],{"id":1097},"our-own-example-workspace369","Our own example: Workspace369",[14,1100,1101,1102,1104],{},"App369's own product, ",[25,1103,648],{"href":647},", is a Flutter app for freelancers and small service businesses: CRM, proposals, invoicing, scheduling and a shared inbox. One Flutter codebase serves both the iOS app and the web app. The case study covers the architecture and what we learned building it.",[36,1106,1108],{"id":1107},"what-these-examples-tell-you","What these examples tell you",[71,1110,1111,1117,1123,1129],{},[74,1112,1113,1116],{},[17,1114,1115],{},"Flutter is not just for prototypes."," Banks, carmakers and large consumer apps run it in production.",[74,1118,1119,1122],{},[17,1120,1121],{},"The common reason is one codebase."," Most of these case studies come back to the same point: shipping the same features to iOS, Android and often the web without maintaining separate apps.",[74,1124,1125,1128],{},[17,1126,1127],{},"It reaches beyond phones."," Car infotainment, TVs, desktop tools and the web all appear above.",[74,1130,1131,1134,1135,1139],{},[17,1132,1133],{},"It is not the right tool for everything."," Apps built around platform extensions like widgets, watch apps or brand-new OS features can still be simpler to build natively. See ",[25,1136,1138],{"href":1137},"/blog/flutter-vs-native-app-development-2026/","Flutter vs native"," for how to decide.",[36,1141,1143],{"id":1142},"planning-a-flutter-app","Planning a Flutter app?",[14,1145,1146,1147,1151,1152,1154,1155,34],{},"App369 builds Flutter apps for startups and small businesses from Boynton Beach, Florida. See ",[25,1148,1150],{"href":1149},"/service/flutter-development/","Flutter app development",", get a ballpark with the ",[25,1153,689],{"href":688},", or compare ",[25,1156,1158],{"href":1157},"/compare/flutter-vs-react-native/","Flutter vs React Native",{"title":353,"searchDepth":354,"depth":354,"links":1160},[1161,1162,1163,1164,1165,1166,1167,1168,1169],{"id":742,"depth":354,"text":743},{"id":810,"depth":354,"text":811},{"id":869,"depth":354,"text":870},{"id":932,"depth":354,"text":933},{"id":978,"depth":354,"text":979},{"id":1034,"depth":354,"text":1035},{"id":1097,"depth":354,"text":1098},{"id":1107,"depth":354,"text":1108},{"id":1142,"depth":354,"text":1143},"Real apps built with Flutter in 2026, grouped by industry: Google Pay, BMW, Toyota, Nubank, Headspace, eBay, MGM Resorts and more, each linked to its case study on flutter.dev.",{"readingTimeStats":1172},{"text":1173,"minutes":1174,"time":1175,"words":1176},"3 min read",2.805,168300,561,"/blog/apps-built-with-flutter-examples-2026","7 min",{"title":720,"description":1170},"blog/apps-built-with-flutter-examples-2026","apps built with flutter, flutter app examples, flutter apps, companies using flutter, flutter showcase, flutter app development","https://app369.com/blog/apps-built-with-flutter-examples-2026/","AU1--kJ_S65saMe5bArn7py-kDABmlXLw23e5Ap4Am4",[1185,1187,1191,1196,1200,1204],{"keyword":5,"url":388,"title":5,"relevance":1186},59,{"keyword":1188,"url":1189,"title":1188,"relevance":1190},"How to Add an MCP Server to Your SaaS: A Practical Guide (2026)","https://app369.com/blog/how-to-add-an-mcp-server-to-your-saas-2026/",18,{"keyword":1192,"url":1193,"title":1194,"relevance":1195},"SaaS","/glossary/what-is-saas/","What is SaaS?",9,{"keyword":1197,"url":1198,"title":1197,"relevance":1199},"Hiring Claude AI Experts for Your App (2026)","https://app369.com/blog/hiring-claude-ai-experts-2026/",8,{"keyword":1201,"url":1202,"title":1201,"relevance":1203},"How to Find Remote App Developers Who Use AI Agents (2026)","https://app369.com/blog/find-remote-app-developers-ai-agents-2026/",7,{"keyword":1205,"url":1206,"title":1205,"relevance":1207},"YouTube Shorts Ideas for SaaS: 30 Ideas From Your Own Docs (2026)","https://app369.com/blog/youtube-shorts-ideas-for-saas-2026/",6,1791849341198]