Limitations

What Hosted Apps supports and does not support

Private Preview: Hosted Apps is available to selected accounts during its Private Preview. To request access, contact your CARTO representative.

Area	Supported	Not supported
Access	Private to the owner, or shared with your organization, groups or users. Login with SSO when configured.	Public or anonymous access.
Application type	Static frontends: HTML, CSS, JavaScript and assets, including client-side routing.	Server-side code of any kind, server-side rendering, or a build step run by CARTO.
Connectivity	CARTO APIs and the origins allowed by the Content Security Policy.	Any other origin: external APIs, basemaps, images or fonts.
Address	A URL under /app/<slug>/ on your CARTO workspace.	Custom domains.
Embedding	Framing from the same origin.	Embedding in another site, because of X-Frame-Options: SAMEORIGIN.
Data access	Whatever the signed-in user can access in CARTO, including Named Sources declared in carto.json.	Permissions beyond the user's own. The app cannot grant access the user does not have.
Files	Up to 1000 files and 50 MB per bundle, served whole. See Limits.	HTTP range requests.
Availability	Versioned deploys and rollback.	An SLA during the Private Preview.

Related

• Hosting your application in CARTO: a step-by-step guide.

• Hosted Apps in Key concepts: how hosted applications compare with your other options.

• Bundle requirements and limits: the exact limits, headers and CSP.