# Self-host / production

The official TabBot origin is **[https://tab-bot.rest](https://tab-bot.rest)**. Allowlist that origin in BridgeSwarm when you use the public studio.

You can also serve the Vite build yourself. Express (`npm start`) is still a **static origin**. It does not keep bots online, hold tokens, or replace BridgeSwarm.

```bash
npm run build
npm start
```

Local default: `http://127.0.0.1:2589`. That is **not** Vite dev (`http://127.0.0.1:5173`) and **not** `https://tab-bot.rest`. IndexedDB does not follow you across origins unless you [import a backup](/docs/guide/import-export).

| Env | Default | Meaning |
| --- | --- | --- |
| `HOST` | `127.0.0.1` | Bind address. `0.0.0.0` listens on all interfaces; allowlist the origin the **browser** actually uses. |
| `PORT` | `2589` | TCP port. |

Example: `HOST=127.0.0.1 PORT=4173 npm start` → allowlist `http://127.0.0.1:4173`.

You may instead copy `apps/web/dist` to any static host with SPA fallback to `index.html`. You own TLS and XSS for that origin unless it is HoneyPeer’s official site. See [Enable Discord](/docs/guide/enable-discord) and [Terms → Official website and self-hosting](/legal/self-host).