Configure your organization to use apps
Configure your organization to enable your users to create apps.
An organization admin must complete the steps in the following sections to make sure their organization is ready to use the AI app builder.
- Free
- Team
- Business
- Enterprise
Enable the app builder
To ensure that builders in your organization can build apps, navigate to Settings > AI. Toggle on the AI App Builder.
- Cloud
Configure firewall
If your organization makes use of firewall rules, you must include retool.app in its allowlist. This allows your instance to connect to Retool's user authentication and usage reporting services.
This step is required because published apps are served at retool.app, using the following URL structure: <orgSubdomain>--<app-name-slug>.retool.app. For example, an example app URL could be exampleOrg--overtime-requests.retool.app.
Configure support for npm packages
Public third-party npm packages are enabled by default. To disable this setting, navigate to Settings > Advanced settings and toggle off Allow third-party npm packages in apps.
Track AI credit usage
Retool's AI-powered features use organization-level monthly AI credits. Your organization's plan determines how many credits you receive each month. Credits renew on the first day of each calendar month and do not roll over.Credits renew on the first day of your plan’s billing cycle and do not roll over.
Organization admins can monitor AI credit usage in the Plans & Billing settings under the AI Credits tab. The tab shows your usage against your allocation, along with any purchased credits and when they expire.
Enterprise organizations also have access to the AI monitoringAI visibility settings page, which provides a granular view of Retool-managed key usage and BYOK usage. You can filter AI usage by model, user, and feature.
For more information about usage and billing, refer to the AI credits documentation.
Enable the app builder
To ensure that builders in your organization can build apps, navigate to Settings > AI. Toggle on the AI App Builder.
Configure AI resources
Admins configure their AI model provider through AI resources. A selection of models created by OpenAI and Anthropic are provided for use with a Retool-managed key.
Admins must ensure that all user groups that will be building have access to the relevant AI resources. Learn more about permission configuration.
Team organizations on cloud instances can also use Retool-provided models with no configuration required.
Custom AI providers are not supported in apps. Use one of the dedicated provider resources instead.
Configure resource permissions
For users to be able to prompt AI to create apps using the AI resources you set up, they need Use access to each resource.
Add all builders to an existing or new permission group, and configure the permission group to have Use access to each relevant AI resource.
Set preferred AI resource and model
Once you configure the supported AI resources that are available for building apps, you can configure your preferred resource and model. While builders have the ability to choose from any of the providers you configured, your selection will be the default for new threads.
- Navigate to Settings > AI.
- In the Apps section, configure the Preferred resource and Preferred model.
- Cloud
Configure firewall
If your organization makes use of firewall rules, you must include retool.app in its allowlist. This allows your instance to connect to Retool's user authentication and usage reporting services.
This step is required because published apps are served at retool.app, using the following URL structure: <orgSubdomain>--<app-name-slug>.retool.app. For example, an example app URL could be exampleOrg--overtime-requests.retool.app.
Configure support for npm packages
Public third-party npm packages are enabled by default. To disable this setting, navigate to Settings > Advanced settings and toggle off Allow third-party npm packages in apps.
Track AI credit usage
Retool's AI-powered features use organization-level monthly AI credits. Your organization's plan determines how many credits you receive each month. Credits renew on the first day of each calendar month and do not roll over.Credits renew on the first day of your plan’s billing cycle and do not roll over.
Organization admins can monitor AI credit usage in the Plans & Billing settings under the AI Credits tab. The tab shows your usage against your allocation, along with any purchased credits and when they expire.
Enterprise organizations also have access to the AI monitoringAI visibility settings page, which provides a granular view of Retool-managed key usage and BYOK usage. You can filter AI usage by model, user, and feature.
For more information about usage and billing, refer to the AI credits documentation.
Enable the app builder
To ensure that builders in your organization can build apps, navigate to Settings > AI. Toggle on the AI App Builder.
Configure access to the app builder
Organization admins on the Business and Enterprise plans can use Retool's role-based access controls to configure access to the app builder.
By default, when AI App Builder is enabled, all users are added to a role that gives them access to the app builder. Admins can update this role to restrict access to a particular group or individual using the following steps:
- Navigate to Settings > Roles.
- Select the App Builder Role. This role was created for you automatically, and includes the Build apps in the AI-powered app builder permission. You can add or edit permissions here as necessary.
- Switch to the Assignment tab. The role was automatically assigned to the All Users group. To restrict access, remove the All Users group and click Add group assignment to provide access ot another user group or individual user.
- Click Save changes.
You can also create new roles or update existing roles in order to grant Build apps in the AI-powered app builder permission to different groups of users.
Configure AI resources
Admins configure their AI model provider through AI resources. A selection of models from OpenAI and Anthropic are provided for use with a Retool-managed key.
Admins must ensure that all user groups that will be building have access to the relevant AI resources. Learn more about permission configuration.
Business organizations on cloud instances can also use Retool-provided models with no configuration required.
Custom AI providers are not supported in apps. Use one of the dedicated provider resources instead.
Configure resource permissions
For users to be able to prompt AI to create apps using the AI resources you set up, they need Use access to each resource.
Add all builders to an existing or new permission group, and configure the permission group to have Use access to each relevant AI resource.
Set preferred AI resource and model
Once you configure the supported AI resources that are available for building apps, you can configure your preferred resource and model. While builders have the ability to choose from any of the providers you configured, your selection will be the default for new threads.
- Navigate to Settings > AI.
- In the Apps section, configure the Preferred resource and Preferred model.
- Cloud
Configure firewall
If your organization makes use of firewall rules, you must include retool.app in its allowlist. This allows your instance to connect to Retool's user authentication and usage reporting services.
This step is required because published apps are served at retool.app, using the following URL structure: <orgSubdomain>--<app-name-slug>.retool.app. For example, an example app URL could be exampleOrg--overtime-requests.retool.app.
Configure support for npm packages
Public third-party npm packages are enabled by default. To disable this setting, navigate to Settings > Advanced settings and toggle off Allow third-party npm packages in apps.
Track AI credit usage
Retool's AI-powered features use organization-level monthly AI credits. Your organization's plan determines how many credits you receive each month. Credits renew on the first day of each calendar month and do not roll over.Credits renew on the first day of your plan’s billing cycle and do not roll over.
Organization admins can monitor AI credit usage in the Plans & Billing settings under the AI Credits tab. The tab shows your usage against your allocation, along with any purchased credits and when they expire.
Enterprise organizations also have access to the AI monitoringAI visibility settings page, which provides a granular view of Retool-managed key usage and BYOK usage. You can filter AI usage by model, user, and feature.
For more information about usage and billing, refer to the AI credits documentation.
- Self-hosted
Configure self-hosted instance
The app builder was first released to self-hosted instances on version 4.0 stable and is available on all subsequent versions.
- For new deployments: Retool recommends using a Terraform blueprint to automatically provision all required infrastructure (VPC, EKS cluster, RDS, S3, load balancer, ACM certificate) and deploy Retool via Helm.
- For existing deployments: Upgrade to version 4.0. New services are disabled by default, so you can upgrade the Helm chart first and enable them when ready. Some deployment configurations require migration before upgrading.
Enable the app builder
To ensure that builders in your organization can build apps, navigate to Settings > AI. Toggle on the AI App Builder.
Configure access to the app builder
Organization admins on the Business and Enterprise plans can use Retool's role-based access controls to configure access to the app builder.
By default, when AI App Builder is enabled, all users are added to a role that gives them access to the app builder. Admins can update this role to restrict access to a particular group or individual using the following steps:
- Navigate to Settings > Roles.
- Select the App Builder Role. This role was created for you automatically, and includes the Build apps in the AI-powered app builder permission. You can add or edit permissions here as necessary.
- Switch to the Assignment tab. The role was automatically assigned to the All Users group. To restrict access, remove the All Users group and click Add group assignment to provide access ot another user group or individual user.
- Click Save changes.
You can also create new roles or update existing roles in order to grant Build apps in the AI-powered app builder permission to different groups of users.
Configure AI resources
- Admins configure their AI model provider through AI resources.
- A selection of models created by OpenAI, Anthropic, and Google Gemini are supported.
- You can also access these models through Google Vertex AI, Amazon Bedrock, and Azure OpenAI platforms if you host one of the models there.
- Admins must ensure that all user groups that will be building have access to the relevant AI resources. Learn more about permission configuration.
- You can choose to use Retool-managed keys for OpenAI or Anthropic, or use your own keys for any model.
- If you bring your own key for OpenAI, Anthropic, or Google Gemini, you can route requests through an AI proxy instead of calling the provider directly.
The following diagram outlines your different options for configuring AI resources.
Custom AI providers are not supported in apps. Use one of the dedicated provider resources instead.
Configure resource permissions
For users to be able to prompt AI to create apps using the AI resources you set up, they need Use access to each resource.
Add all builders to an existing or new permission group, and configure the permission group to have Use access to each relevant AI resource.
(Optional) Configure AI proxy
The following section is required only if you bring your own key and utilize an AI proxy service.
Configure a proxy
If you use a proxy to make calls to LLM providers (such as LiteLLM or LLM Proxy Server), you must configure the proxy to support models that you want to be available to your builders.
- In your proxy, configure the LLM provider that you want builders to be able to use.
- Ensure the proxy is configured to support each model that you want builders to be able to use.
- In Retool, navigate to the Resources page and open the resource corresponding to your model provider. Update the Base URL setting to point to your proxy endpoint. Repeat for any additional model providers.
Set preferred AI resource and model
Once you configure the supported AI resources that are available for building apps, you can configure your preferred resource and model. While builders have the ability to choose from any of the providers you configured, your selection will be the default for new threads.
- Navigate to Settings > AI.
- In the Apps section, configure the Preferred resource and Preferred model.
- Cloud
Configure firewall
If your organization makes use of firewall rules, you must include retool.app in its allowlist. This allows your instance to connect to Retool's user authentication and usage reporting services.
This step is required because published apps are served at retool.app, using the following URL structure: <orgSubdomain>--<app-name-slug>.retool.app. For example, an example app URL could be exampleOrg--overtime-requests.retool.app.
Configure support for npm packages
Public third-party npm packages are enabled by default. To disable this setting, navigate to Settings > Advanced settings and toggle off Allow third-party npm packages in apps.
Enterprise organizations can also configure private registries from which builders can install packages. Refer to the Configure support for private registries for more information.
- Self-hosted
Configure environment variables for Retool-managed keys
The following section is required only if you use Retool-managed keys.
To enable AI app building on self-hosted deployments using a Retool-managed key, set the following environment variables.
| Environment variable | Value |
|---|---|
LICENSE_KEY | Your self-hosted Retool license key. |
OPENAI_PROXY_HOST | Set to https://ai-proxy.retool.com. |
OPENAI_PROXY_API_TOKEN | Contact your Retool account manager (or support@retool.com if you don't have an account manager) to generate a Retool-provided token. |
OPENAI_SECRET_KEY | Set to an empty string. |
For OPENAI_PROXY_API_TOKEN, contact your Retool account manager (or support@retool.com if you don't have an account manager) to generate a Retool-provided token. Keys provided by Retool are subject to restrictive rate limits and are not suitable for production use cases. If the rate limiting is an issue, bring your own key and set it from the Settings > AI resource page.
While this environment variable includes OPENAI in the title, you can use it for any available provider.
Track AI credit usage
Retool's AI-powered features use organization-level monthly AI credits. Your organization's plan determines how many credits you receive each month. Credits renew on the first day of each calendar month and do not roll over.Credits renew on the first day of your plan’s billing cycle and do not roll over.
Organization admins can monitor AI credit usage in the Plans & Billing settings under the AI Credits tab. The tab shows your usage against your allocation, along with any purchased credits and when they expire.
Enterprise organizations also have access to the AI monitoringAI visibility settings page, which provides a granular view of Retool-managed key usage and BYOK usage. You can filter AI usage by model, user, and feature.
For more information about usage and billing, refer to the AI credits documentation.