Frequently Asked Questions

ShipSite is an instant static site hosting service. Send a list of files to the API, upload them directly to S3 via presigned URLs, call finalize — and your site is live at a vanity URL like bright-canvas-a7k2.shipsite.co.

No account is required for temporary hosting. No config files, no CLI to install, no build pipeline. Create, upload, and finalize to get a live URL.

Anything that can be served as static files: HTML pages, single-page apps, documentation sites, dashboards, data visualizations, portfolios, prototypes, reports, presentations, image galleries, game demos, generated articles — anything a browser can render.

Markdown files (.md) are automatically converted to clean, styled HTML during publishing — both via the API and the web UI. Just upload your README.md and it becomes a beautifully formatted web page with GitHub-style typography, code highlighting, and table support.

If your AI agent is generating output that needs a URL, ShipSite is the fastest way to get it online.

No. You can publish immediately without any account. Anonymous sites expire no later than 24 hours after creation.

Signing in and obtaining an API key are free. An API key unlocks management features such as password protection, analytics, and email sharing. Free sites expire 24 hours after creation. When available, US$3.99/month unlocks permanent hosting with 500 MB shared storage and 5 GB monthly transfer. Signing in alone does not upgrade an existing temporary site; publish a new site after subscribing.

Two API calls:

POST /api/auth/agent/request-code
{"email": "you@example.com"}

POST /api/auth/agent/verify-code
{"email": "you@example.com", "code": "ABCD-EFGH"}

The second call returns your sk_... API key. Save it — it's only shown once and can't be recovered.

Any agent or tool that can make HTTP requests. The API is simple JSON over HTTPS — no SDKs required.

For Claude Code users, a ready-to-use skill is available at shipsite.co/skill. Drop it into .claude/skills/ and your agent will know exactly how to publish.

mkdir -p .claude/skills
curl -s https://shipsite.co/skill -o .claude/skills/shipsite.md

Permanent sites have no fixed 24-hour expiry. They remain available while your paid subscription or administrator sponsorship is active, within usage limits and our content rules. Permanent does not mean lifetime hosting or guaranteed availability.

When permanent hosting is available, subscribe from your account, then publish using your normal API key. Existing temporary sites keep their original deadline; publish a new site to use permanent hosting. Paid and sponsored accounts can still request temporary hosting with "permanent": false.

Choose Manage billing on the account page to open Stripe’s billing portal. Subscriptions renew monthly until canceled. Cancellation takes effect at the end of the paid period. Deleting sites or stopping use of ShipSite does not cancel billing.

When hosting access ends, permanent sites go offline and enter a seven-day retention period before cleanup. Renewing during retention can restore access if deletion has not begun. Payment failures can interrupt hosting. Keep your own backups.

An administrator can grant permanent hosting without a subscription. Use your normal account API key; storage and monthly limits still apply. Sponsorship can be revoked and does not automatically cancel an existing paid subscription. Payment or sponsorship does not exempt anyone from the content rules, and does not by itself remove the hosting banner from your sites.

ShipSite blocks the affected operation instead of charging overage fees. Running out of storage prevents new deployments; reaching transfer or request limits can take sites offline until the next UTC month. Delete unused versions to free storage after cleanup. Uploads reserve space for staging and published copies, so leave room for updates. Monthly allowances reset independently of your subscription renewal date.

Three steps:

• Create — POST your file list to /api/v1/publish. Get back presigned S3 upload URLs.
• Upload — PUT each file directly to its presigned URL. Files go straight to S3; the server never proxies bytes.
• Finalize — POST to the finalize URL. Your site is immediately live.

The whole process typically takes under a second for small sites. See the API docs for full details.

Temporary file limits use binary MiB/GiB (1 MiB = 1,048,576 bytes). Permanent-plan MB and GB are decimal (1 MB = 1,000,000 bytes). Storage includes retained versions, metadata, generated HTML, and upload reservations. Monthly allowances reset on the first day of each UTC calendar month, independently of your billing date. There are no automatic overage charges.

Yes. Each publish creates a new site with its own unique slug and URL. There's no cap on the number of sites per account. Storage, traffic, and publishing limits apply. See plans and account usage.

Every temporary site stops serving at its expiry deadline. Requests return 410 Gone while the site record still exists, then 404 Not Found after cleanup. Storage cleanup runs asynchronously, so files and metadata may be deleted later.

Every temporary site has a fixed expiry deadline. Linking a site to an account, updating it, or rolling it back cannot extend its lifetime. Duplicates keep the source site's expiry time. Keep your own copy of anything you upload.

No. ShipSite is provided “as is” and “as available”. The 24-hour limit is a maximum lifetime, not a guarantee of availability. Content may be removed, lost, or become inaccessible at any time, so always keep your own backups.

To the maximum extent permitted by applicable law, we disclaim warranties and are not liable for content removal, loss, unavailability, or resulting loss or damage. Rights and liabilities that cannot legally be excluded are preserved. See the Terms of Service.

When you update a site, include a hash (SHA-256) for each file. ShipSite compares hashes against the previous version — files that haven't changed are skipped from the upload list and copied server-side in S3. For permanent hosting, copied files and retained versions still count toward your storage allowance.

For a large site where only one file changed, only that one file needs to be uploaded. Everything else is handled server-side in milliseconds.

Every publish or update creates an immutable version. You can list all versions, see when they were created and how many files they contain, and instantly roll back to any of them:

GET  /api/v1/publish/:slug/versions
POST /api/v1/publish/:slug/rollback  {"versionId": "01ABC..."}

Rollback is instant — the files are already in S3. No re-upload needed.

Yes. Set a password on any authenticated site via the metadata endpoint:

PATCH /api/v1/publish/:slug/metadata
{"password": "my-secret-code"}

Visitors see a password prompt before any content is served. The browser remembers the password for 24 hours. Passwords are hashed with scrypt — never stored in plain text. Set "password": null to remove protection.

API clients and agents can pass the password in the x-site-password request header to bypass the browser prompt.

ShipSite records page views, unique visitors, top paths, and top referrers for every authenticated site. Data is available for the last 90 days:

GET /api/v1/publish/:slug/analytics?days=30

Hosted-site analytics store SHA-256 IP hashes rather than raw IP addresses. These analytics records are scheduled for deletion after 90 days; physical deletion is asynchronous.

Yes. The download endpoint streams the current version as a ZIP archive:

GET /api/v1/publish/:slug/download

Useful for backups, audits, or migrating content to another host.

Sites owned by accounts an administrator has separately exempted load directly without the banner or sandboxed frame. For all other accounts, including paid and sponsored ones, and for anonymous sites, browser visits display a small hosting banner with agent instructions and an abuse-report link. Your content runs in a sandboxed frame on a separate origin, so its scripts cannot edit the banner. Popups, fullscreen, and top-level navigation are blocked; some third-party integrations may not work in a frame. The banner identifies the host; it is not an endorsement or a guarantee that uploaded content is safe.

Sites are publicly accessible by default at their slug URL. Random slugs are not an access control: anyone who has or discovers the URL can view an unprotected site.

For genuinely private content, enable password protection. Only visitors with the correct password can view the site.

ShipSite is for legitimate static content only. The following are prohibited:

• Illegal content of any kind
• Malware, phishing pages, or credential harvesting
• Content that exploits or harms minors
• Spam or unsolicited bulk messaging
• Content that violates third-party intellectual property rights
• Anything designed to deceive or defraud

If we detect malicious content, we may remove the site immediately, without prior notice, regardless of payment or sponsorship.

See the Terms of Service for the full policy. Report abuse to hello@shipsite.co.

No. Hosted sites send a noindex header and a robots.txt instruction asking crawlers not to crawl them. Compliant search engines should respect those instructions, but they do not prevent access, control all crawlers, or remove previously indexed copies.

ShipSite’s application and hosting storage run on AWS in the ap-southeast-2 (Sydney) region. Stripe processes billing separately. Files are stored in S3, site metadata in DynamoDB. Free sites stop serving no later than 24 hours after creation. Permanent sites require an active paid or sponsored account and available usage allowance. Temporary files expire through S3 lifecycle rules; permanent files are removed by scheduled cleanup after deletion or loss of access. Physical deletion can happen later. Analytics data is deleted after 90 days.

We store your email address for sign-in and account management, plus account, usage, and billing records. For subscribers, we send your email address and account identifier to Stripe and store Stripe customer/subscription identifiers and payment status. Card details are entered on Stripe-hosted pages; ShipSite does not receive your full card number. The main ShipSite pages also use Google Analytics when configured.