E:LAB
WEBVIEW:LAB · Features

Everything that's in the box

Built so you can compare it line-for-line against any other "webview app builder" without guessing.

Build
Android + iOS — Codemagic cloud

Both platforms dispatch to codemagic.io workers. elabhub only triggers, polls, and proxies the artifact — no JDK, no Android SDK, no macOS host of your own. Builds typically finish in 4–8 minutes, and failed builds don't burn a credit.

  • ·Capacitor 8 template + AGP 8 + JDK 21 (on Codemagic)
  • ·One pipeline, both platforms
  • ·No build toolchain on the elabhub host
  • ·3-second polling against Codemagic build status
Push
FCM + APNs implemented from scratch

No external SDK. Node's built-in crypto + http2 modules talk to FCM HTTP v1 and APNs HTTP/2 directly. Device tokens auto-register on first launch; you fan out from the dashboard with android/ios/all segmenting.

  • ·RS256 JWT → FCM OAuth in-process
  • ·ES256 JWT (raw r||s) → APNs HTTP/2 direct
  • ·Per-device delivery results in the dashboard
  • ·APNs sandbox / production split
Preflight
Apple-4.2 risk score, 0–100

We fetch the URL once and score 9 signals (viewport, manifest, service worker, login form, commerce keywords, etc.) before you ever spend a build credit. Apple 4.2 "Minimum Functionality" is the clause that nukes most wrapper apps, so we put it in front of the build queue, not behind it.

  • ·low / medium / high tiers
  • ·Concrete reason list (ko + en)
  • ·Runs automatically before each build
  • ·Pre-flight runs never spend a build credit
Security
AES-256-GCM vault + HMAC gating

FCM service-account JSON and APNs .p8 keys are encrypted before they hit the database. They're decrypted briefly inside a per-build worktree, then the worktree is wiped. Every request between elabhub and the runner is HMAC-signed.

  • ·AES-256-GCM (96-bit IV, 128-bit tag)
  • ·HMAC-SHA256 request signing (5-min replay window)
  • ·Each artifact under an 8-byte random id
  • ·Plaintext keys never touch disk persistently
Ship
Store-submission kit

Templates for the parts that usually trip first-time submitters: screenshot specs, Apple Privacy Manifest, App Store Privacy declarations, Apple 4.2 reviewer responses. Built so you can either submit yourself or hand the whole kit to your existing agency.

  • ·Screenshot spec sheet (per form factor)
  • ·App Store Privacy declarations checklist
  • ·Apple 4.2 response template (ko + en)
  • ·Play Console Data Safety guide

Android vs iOS, side-by-side

Same site, same shell, same pipeline. But store policies, push delivery, and review handling differ — worth knowing up front.

Android
iOS
Store review
Hours to a day, mostly automated
1–3 days, human reviewer
Rejection risk
Low (policy violations only)
Real — 4.2 Minimum Functionality dominates
Push delivery
FCM HTTP v1 (Google service account)
APNs HTTP/2 (.p8 Auth Key + Team ID)
Registration fee
Google Play $25 one-time
Apple Developer Program $99/yr
Artifact
APK · AAB
IPA (App Store Connect upload)
Sideload for testing
APK installs directly
TestFlight or Ad Hoc provisioning required

Where it's actually used

Patterns we see from neighborhood shops, hagwons, clinics, and online stores who already had a working site and just wanted an app icon on regulars' phones.

  • 01

    Restaurant menu + order app

    Existing online-ordering page; push regulars about new menu items, today's special, holiday closures.

  • 02

    Pharmacy refill alert app

    One push the moment a prescription is ready — customers stop making wasted trips.

  • 03

    Hagwon / lesson studio app

    Class cancellations, exam dates, attendance — out as app push instead of buried in a KakaoTalk room.

  • 04

    Clinic booking app

    Appointment confirmations, pre-visit reminders, recheck nudges — all in one channel.

  • 05

    Local online store

    Cart-abandon nudges and sale-drop push lift re-visit and checkout conversion together.

  • 06

    Content / magazine site

    Every new article hits subscribers' phones — a direct channel beyond search traffic.