Frequently Asked Questions

ShipSite is an instant static site hosting service. Send a list of files to the API, upload them directly to S3 via presigned URLs, call finalize — and your site is live at a vanity URL like bright-canvas-a7k2.shipsite.co.

No account is required. No config files, no CLI to install, no build pipeline. One API call and you have a live URL.

Anything that can be served as static files: HTML pages, single-page apps, documentation sites, dashboards, data visualizations, portfolios, prototypes, reports, presentations, image galleries, game demos, generated articles — anything a browser can render.

Markdown files (.md) are automatically converted to clean, styled HTML during publishing — both via the API and the web UI. Just upload your README.md and it becomes a beautifully formatted web page with GitHub-style typography, code highlighting, and table support.

If your AI agent is generating output that needs a URL, ShipSite is the fastest way to get it online.

No. You can publish immediately without any account. Anonymous sites are live within seconds and stay online for 24 hours.

To keep a site permanently, get an API key via email — no passwords, just a one-time code sent to your inbox. Authenticated sites never expire unless you choose to delete or expire them yourself.

Two API calls:

POST /api/auth/agent/request-code
{"email": "you@example.com"}

POST /api/auth/agent/verify-code
{"email": "you@example.com", "code": "ABCD-EFGH"}

The second call returns your sk_... API key. Save it — it's only shown once and can't be recovered.

Any agent or tool that can make HTTP requests. The API is simple JSON over HTTPS — no SDKs required.

For Claude Code users, a ready-to-use skill is available at shipsite.co/skill. Drop it into .claude/skills/ and your agent will know exactly how to publish.

mkdir -p .claude/skills
curl -s https://shipsite.co/skill -o .claude/skills/shipsite.md

Three steps:

• Create — POST your file list to /api/v1/publish. Get back presigned S3 upload URLs.
• Upload — PUT each file directly to its presigned URL. Files go straight to S3; the server never proxies bytes.
• Finalize — POST to the finalize URL. Your site is immediately live.

The whole process typically takes under a second for small sites. See the API docs for full details.

Yes. Each publish creates a new site with its own unique slug and URL. There's no cap on the number of sites per account. Rate limits apply per hour to prevent abuse, but a normal agent workflow will never come close to them.

The site metadata is removed from the database and the files are deleted from S3. The URL returns a 410 Gone response immediately once the TTL is detected, even if S3 cleanup hasn't run yet.

To keep a site, claim it before it expires using the claimToken returned when the site was created:

POST /api/v1/publish/:slug/claim
Authorization: Bearer sk_...
{"claimToken": "abc123..."}

Claiming removes the expiry and permanently associates the site with your account.

When you update a site, include a hash (SHA-256) for each file. ShipSite compares hashes against the previous version — files that haven't changed are skipped from the upload list and copied server-side in S3 at no cost to you.

For a large site where only one file changed, only that one file needs to be uploaded. Everything else is handled server-side in milliseconds.

Every publish or update creates an immutable version. You can list all versions, see when they were created and how many files they contain, and instantly roll back to any of them:

GET  /api/v1/publish/:slug/versions
POST /api/v1/publish/:slug/rollback  {"versionId": "01ABC..."}

Rollback is instant — the files are already in S3. No re-upload needed.

Yes. Set a password on any authenticated site via the metadata endpoint:

PATCH /api/v1/publish/:slug/metadata
{"password": "my-secret-code"}

Visitors see a password prompt before any content is served. The browser remembers the password for 24 hours. Passwords are hashed with scrypt — never stored in plain text. Set "password": null to remove protection.

API clients and agents can pass the password in the x-site-password request header to bypass the browser prompt.

ShipSite records page views, unique visitors, top paths, and top referrers for every authenticated site. Data is available for the last 90 days:

GET /api/v1/publish/:slug/analytics?days=30

Privacy: IP addresses are SHA-256 hashed before storage and are never stored in plain text. Raw IPs are not retained. Analytics data auto-deletes after 90 days.

Yes. The download endpoint streams the current version as a ZIP archive:

GET /api/v1/publish/:slug/download

Useful for backups, audits, or migrating content to another host.

Sites are publicly accessible by default at their slug URL. Slugs are randomly generated and non-guessable, so they won't be stumbled upon — but they are not secret by design.

For genuinely private content, enable password protection. Only visitors with the correct password can view the site.

ShipSite is for legitimate static content only. The following are prohibited and will result in immediate removal:

• Illegal content of any kind
• Malware, phishing pages, or credential harvesting
• Content that exploits or harms minors
• Spam or unsolicited bulk messaging
• Content that violates third-party intellectual property rights
• Anything designed to deceive or defraud

See the Terms of Service for the full policy. Report abuse to hello@shipsite.co.

No. User-hosted sites at *.shipsite.co are not submitted to search engines by ShipSite. Whether your content appears in search results depends on whether external crawlers independently discover and index your URL.

ShipSite runs entirely on AWS in the ap-southeast-2 (Sydney) region. Files are stored in S3, site metadata in DynamoDB. Anonymous content is automatically deleted from S3 after 24 hours via S3 lifecycle rules. Analytics data is deleted after 90 days.

No personal data beyond your email address is collected. Email addresses are used only for sending your one-time authentication code.