ChatGPT Sites hosts prompt-built games with auth, API keys, and budget limits

• A nontechnical creator shipped a hosted GeoGuessr-style game, and omooretweets' demo says ChatGPT Sites handled Auth with ChatGPT, secure key storage, and hosting.
• The build crossed from toy prototype into live app plumbing: omooretweets described Google Maps and Street View keys plus five OpenRouter model opponents, while omooretweets' follow-up said GPT-5.6 helped set an API-usage budget.
• The playable WorldModel site turns model eval into a game ladder, and omooretweets' public-link post says the live app may stop working if the budget taps out.
• The second creator example was a family math game: petergyang's Safari Math demo used ChatGPT Images for UI and characters, added music, and included a timed boss level.
• Sites is already app-shaped: OpenAI's Sites docs cover production deployments, sign-in headers, runtime secrets, durable storage, domains, and limits, while omooretweets' build shows creators using that surface in public.

OpenAI's launch post frames Sites as part of ChatGPT Work, with Codex technology built into the main ChatGPT experience. The Sites docs say every deployment URL is a production deployment, expose /signin-with-chatgpt and /signout-with-chatgpt, and let builders add hosted environment variables and secrets from Site settings. The Rundown tutorial already packages the feature as a 10-minute mini-SaaS workflow.

OpenAI introduced ChatGPT Sites in public beta as a way to turn work or ideas into interactive websites and lightweight apps, according to the company's ChatGPT release notes. The same notes say users can create a Site from ChatGPT Work on the web, or from Work or Codex in the ChatGPT desktop app.

The important shift in the creator demos was not code generation quality. It was the hosted handoff: public URLs, identity, secrets, storage, and usage controls showed up in the same prompt-built workflow.

OpenAI's developer docs describe two publishing stages:

1. Save a version, which creates a reviewable deployment candidate.
2. Deploy a version, which publishes the saved version and returns the production URL.

That split explains why a Sites build can behave less like a canvas export and more like a tiny product release.

The GeoGuessr-style app is the cleanest demo because the boring parts are the story. omooretweets said Sites built and hosted the game, added Auth with ChatGPT, and handled secure key storage.

The stack described across the original demo and the follow-up included:

• Google Maps and Street View API keys.
• OpenRouter access for five LLM opponents.
• Secure key storage.
• Usage limiting for API spend.
• One-click public publishing.
• Optional custom domain support.

The creator called public publishing "the missing piece in vibe coding" in the same thread. That line lands because the demo is not a landing page. It is a hosted game with external APIs and a budget ceiling.

The playable WorldModel site uses a 60-second city-spotting challenge, then turns the opponents into a model ladder. The evidence summary lists Qwen 3.5 122B, Gemini 3.1 Pro, Claude Sonnet 5, GPT-5.6 Sol, and a final boss round.

That format is a creator-native eval. The player is not reading benchmark rows; they are trying to beat models at road signs, vegetation, driving side, camera artifacts, and city-level visual clues.

The second build went in a different direction: a multiplication-table game made with an 8-year-old. petergyang said the build used ChatGPT Images for the UI and characters, added music, and included a timed boss level.

The linked Serena's Safari Math page presents the experience as a 12-question quiz with multiplication tables from 2 through 12, multiple-choice answers, animal-themed visuals, and a boss-level mechanic.

The workflow detail worth saving is the asset loop:

• Child-friendly theme first: safari animals.
• ChatGPT Images for UI and characters.
• Music for atmosphere.
• Timed boss level for pressure.
• Public link for sharing the finished game.

OpenAI's release notes say Sites is available to Pro, Pro Lite, and Edu users, with Plus rolling out later, and unavailable on Free or Go. The same notes say public publishing and the broader beta were not available in the EEA, Switzerland, or the United Kingdom at launch.

OpenAI's Sites docs put the operational surface in six buckets:

• Access: new Sites start limited to the owner and workspace admins.
• Sharing: options can include selected users or groups, anyone in the workspace, or anyone on the internet when public publishing is enabled.
• Enterprise default: public publishing is off by default in Enterprise workspaces.
• Secrets: hosted environment variables and secrets live in Site settings, not prompts, attached files, Site content, or .openai/hosting.json.
• Domains: custom domains can use an owned apex domain or subdomain, but Enterprise workspaces did not have custom domains at launch.
• Analytics: non-Enterprise Sites can show unique visitors, page views, and both metrics over time.

The same docs say plan-specific usage limits apply across Sites during the beta. Hitting a limit can block new Site creation, added storage, or keeping a high-usage Site public, while existing Sites remain editable.

OpenAI's ChatGPT Sites terms draw a line around public creativity: site owners are responsible for their Sites, end users, login implementations, legal compliance, and support. OpenAI says it does not review or endorse Site content.

The cutest demo also sits near the sharpest policy edge. petergyang's math-game post describes a multiplication site built with an 8-year-old, while OpenAI's terms say Sites must not target or be designed for children under 13, or the applicable age of digital consent.

The docs and terms also rule out several app categories:

• Payment-card data and Protected Health Information, according to OpenAI's Sites docs.
• Money transfers, cryptocurrency transfers, and other financial transactions, according to the Sites terms.
• Malware, phishing, impersonation, and deceptive or fraudulent activity, according to the Sites terms.
• Data residency and inference residency at launch, according to the Sites docs.