One prompt built this AI photo app,
and this page is the prompt
I had a pixel-art generator that nobody used. So I pivoted: same bones, new job — upload one photo, get it back as anime, claymation, caricature, storybook. That app is Photo Maker, and in my latest video I promised to put the build prompt in the description. Claude built the app from that prompt, and here it is. Below is the whole thing — the prompt, the three API keys you need, and what it costs to run. Paste it into Claude Code (or any coding agent) and you have your own AI SaaS boilerplate by dinner.
The one-sentence version
A complete AI photo app — sign-in, credits, payments, image generation — fits in one prompt and one PHP file; you supply three API keys.
The short recipe: copy the prompt below, create accounts at Replicate (image generation), Resend (sign-in emails) and Polar (payments), put the keys in a .env file, and let the agent build.
What the prompt builds
One index.php, no framework, no build step, SQLite for storage. Users sign in with a magic link (no passwords to store, no passwords to leak), get 10 free credits, upload a photo, tick the styles they want — each style costs one credit and produces one image through Replicate. When the free credits run out, Polar sells a 500-image pack for $5. I demoed it in the video: five styles selected, five credits deducted, five images back.
The prompt below describes 12 styles. The live app has since grown to 60 — that part is just an array of style prompts, and adding to it is the most fun you can have in this codebase.
The prompt
This is the one to copy. It is long on purpose: every decision an agent would otherwise guess at — token hashing, webhook idempotence, credit refunds — is written down, because those are the parts that hurt when guessed wrong. Claude knows; Claude is the agent.
Read the rest — it's free
The full build prompt is below. Drop your email and I'll send a one-click link that unlocks it — and every other gated resource on the site. No password, no newsletter, no spam.
Already unlocked on this device? The link signs you in automatically.
The three API keys
The app is one file, but it stands on three services. All three have free tiers or near-zero entry cost; the whole setup is maybe twenty minutes of clicking.
Sign up at replicate.com, add a payment method (pay-per-use, no subscription), and create a token under Account → API tokens. The default model, black-forest-labs/flux-2-klein-4b, costs about a tenth of a cent per image — my whole demo cost half a cent. Swap models any time via REPLICATE_MODEL.
Sign up at resend.com (free tier: 100 emails/day, plenty for magic links), verify your sending domain under Domains, create an API key, and set MAIL_FROM to an address on that domain. No domain yet? Leave the key empty — dev mode prints the magic link on the login page instead of emailing it.
Sign up at polar.sh (it handles checkout, taxes and invoices as merchant of record). Create one product — "500 credits, $5" — and copy its product ID. Make an access token under Settings → Developers. Then add a webhook pointing at https://your-domain/webhook, subscribe it to paid orders, and copy the webhook secret. That secret is what lets the app trust that "this order is paid" really came from Polar.
What it costs to run
I asked Claude to check the math before I set the price, so these are the real numbers behind the $5 pack:
| Line | Amount |
|---|---|
| Price of the pack (500 images) | $5.00 |
| Replicate cost (~$0.001/image) | −$0.50 |
| Payment fees (~2.9% + $0.30) | −$0.45 |
| Kept, per pack | ~$4.05 (~81%) |
And the honest trade-offs, so you know what you are pasting: a single-file app means trivial deploys and a codebase you can read in an hour, but no tests, SQLite's single-writer ceiling, and a generation call that blocks the request for one to two minutes. Fine at this scale; a job queue is the first upgrade when it stops being fine.
Three things worth stealing
No password column, no reset flow, no breach to apologize for. Store only the SHA-256 hash of the token, make it one-shot with a 15-minute expiry, and the worst a database leak can reveal is who signed up.
Payment providers redeliver events; that is a promise, not a bug. A UNIQUE index on the order ID means the second delivery fails its INSERT and no one gets 1,000 credits for $5. One line of schema replaces a page of careful code.
An agent will happily invent a style grid on its own. What it cannot invent is which rules must hold — hash the token, refund failed generations, dedupe by canonical email. Write those down and the rest is decoration.