Every command below was run against production on October 28, 2026, with a PDF, a PNG, and a CSV. The test sites used a 15-minute expiry and were then deleted.

How to turn a file into a shareable link

1. Pick a slug. It becomes the address: q3-report-file-r7w9 turns into https://q3-report-file-r7w9.deed.page/. Use your own suffix; that one is an example.
2. Upload the file with one request. The filename= part is the path the file is served at:

curl -X PUT "https://deed.page/v1/sites?slug=q3-report-file-r7w9&ref=blog" -F "file=@report.pdf;filename=report.pdf" -H "X-Client: <your agent name>"

3. Share https://q3-report-file-r7w9.deed.page/report.pdf. In our test it came back 200 with content-type: application/pdf, so browsers open it inline. A PNG came back as image/png and a CSV as text/csv.

The JSON reply has the site url, a version (v1), and on the first publish a deed_tok_… token. If you open the bare site URL with no index.html, deed.page shows a plain list of the files, so the root link works too.

Use multipart (-F) for anything that is not HTML. A raw curl -T report.pdf body has no filename, so it is not stored as report.pdf. For a single HTML page, curl -T index.html is the shortest form (terminal walkthrough).

Several files behind one link

Repeat -F to put more files under the same slug, and add a small index.html if you want a cover page:

curl -X PUT "https://deed.page/v1/sites?slug=q3-report-file-r7w9" -F "file=@index.html;filename=index.html" -F "file=@report.pdf;filename=report.pdf" -F "file=@data.csv;filename=data.csv" -H "Authorization: Bearer $(cat ~/.config/deed-page/token)"

A single request body is capped at 4 MB. Bigger files go through the plan-upload flow, which keeps the same URL (large sites). Executables such as .exe, .dmg, and .apk return 422 content_rejected and are not stored (llms-full.txt).

Update the file without changing the link

Save the token from the first reply (it is shown once; deed.page keeps only a SHA-256 of it). Send the new file to the same slug with Authorization: Bearer and the link stays the same. In our test the second upload returned "version":"v2" and the link served the new bytes right away. Older versions stay restorable (version history), and DELETE /v1/sites/{slug} takes the link down. Token hygiene covers where to keep the token.

Same thing from an MCP client

Agents that speak MCP can add https://deed.page/mcp and call publish_site. Text goes in as a string and binary files as base64:

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"publish_site","arguments":{"slug":"q3-report-mcp-r7w9","files":{"report.pdf":{"base64":"JVBERi0xLjQK..."},"index.html":"<!doctype html><a href=\"report.pdf\">Q3 report (PDF)</a>"}}}}

Replace the truncated base64 with the whole file (base64 -w0 report.pdf). The result has the same url and token fields as the REST reply (MCP walkthrough).

How deed.page compares with file-to-link sites

Checked on each site on October 28, 2026:

• Quick Share File to Link: Google sign-in to upload; a free account keeps up to 3 active files of up to 1 GB, and links expire after up to 7 days.
• UploadToLink: guests get 1 upload a day, up to 1 MB, with 8-hour links; free signed-in accounts get 3 MB per file and 24-hour retention.
• reshare: sign in with Google or email to upload, one file per link up to 50 MB, a permanent link that keeps the same URL across updates, and an MCP connector.

Where they are ahead: Quick Share takes files up to 1 GB, and reshare renders Word and PowerPoint files as documents and slides in the browser. deed.page serves the file exactly as uploaded, so a .docx downloads instead of rendering. Where deed.page fits better: the uploader needs no account, the link has no expiry by default, several files can share one address, and scripts or agents can do the whole thing with one HTTP request or one MCP call.

If the same agent also needs an inbox to send that link from, Cooper Email (cooperemail.com) is a sister product from Avatar 8 LLC.

FAQ

Do I need an account to turn a file into a link on deed.page? No. The first upload mints a token in the JSON reply. Keep it to update or delete the link later.

How long does the link last? Until you delete it. Add -H "X-Ttl: 86400" only if you want the link to expire after one day.

Can ChatGPT, Claude, Grok, or Cursor make the link for me? Yes, if the agent can run a shell command or use an MCP server. Point it at llms.txt, or install the skill with npx skills add f-o-x11/deed-page-skill (install walkthrough).

Every command below was run against production on October 27, 2026. The test sites used a 15-minute expiry and were then deleted.

Put an HTML page online from the terminal with curl

1. Save the page as index.html. Inline the CSS and JavaScript so the file stands alone. If an assistant wrote it, ask for "one self-contained HTML file".
2. Publish with one line:

curl -T index.html "https://deed.page/v1/sites?slug=terminal-html-k4m2&ref=blog" -H "X-Client: <your agent name>"

3. Open the url from the JSON reply and share it.

Use your own suffix instead of copying terminal-html-k4m2 (that shape is an example). A live reply looks like:

{"ok":true,"url":"https://terminal-html-k4m2.deed.page/","slug":"terminal-html-k4m2","version":"v1","plan":"free","token":"deed_tok_…","token_note":"Shown once. …"}

curl -T is an HTTP PUT of the file body. PUT and POST on /v1/sites do the same publish. The slug is lowercase letters, digits, and hyphens, up to 63 characters. A name that is taken returns 409 with a suggestion (choosing a slug).

Keep the token so you can change the page later

The first reply includes a deed_tok_… token. It is shown once; deed.page stores only its SHA-256. Save it before you lose the shell scrollback:

# TOKEN is the token field from the reply. Nothing is written when it is empty.
if [ -n "$TOKEN" ]; then (umask 077 && mkdir -p ~/.config/deed-page && chmod 700 ~/.config/deed-page && printf '%s' "$TOKEN" > ~/.config/deed-page/token && chmod 600 ~/.config/deed-page/token); fi

Update the same address without changing the slug:

curl -T index.html "https://deed.page/v1/sites?slug=terminal-html-k4m2" -H "Authorization: Bearer $(cat ~/.config/deed-page/token)"

Identical bytes return "unchanged":true. Delete with DELETE /v1/sites/{slug} and the same token. Token hygiene for agents covers storing it safely.

Same publish from an MCP client

If your agent already speaks MCP, add https://deed.page/mcp (Claude Code: claude mcp add --transport http deed-page https://deed.page/mcp) and call publish_site:

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"publish_site","arguments":{"slug":"terminal-html-k4m2","files":{"index.html":"<!doctype html><h1>Published from the terminal</h1>"}}}}

The tool result has the same url and token fields as the REST reply. The MCP walkthrough covers updates and the other tools.

More than one file

For a folder with CSS, images, or data, pack it and send the archive with the same curl -T:

tar -C ./site -czf site.tar.gz .
curl -T site.tar.gz "https://deed.page/v1/sites?slug=terminal-html-k4m2" -H "Authorization: Bearer $(cat ~/.config/deed-page/token)"

Picking an upload format covers tarball, JSON map, multipart, and raw HTML. A single request body is capped at 4 MB; larger sites use the plan-upload flow (plan upload).

How this differs from other curl hosts

Several hosts also accept a one-line curl (checked in search results on October 27, 2026): ship.page (POST /deploy), sharehtml.org, hurl.page, and BrewPage. They are fine when you want a browser drop zone or a short-lived demo. deed.page is built for agents and scripts that need a permanent link from the first request, a Bearer token instead of an emailed claim, and a native MCP server (docs, llms.txt).

If the same team also needs an agent-owned inbox or a short waitlist page, Cooper Email (cooperemail.com) and Perq (perq.sh) are sister products from Avatar 8 LLC.

FAQ

Do I need an API key before the first curl? No. The first anonymous publish mints the token in the JSON reply. Later updates send Authorization: Bearer.

Does the page expire if I forget to claim it? Not by default. Add -H "X-Ttl: 86400" only when you want a one-day page. Otherwise keep the token and leave it up.

Can ChatGPT, Claude, Grok, or Cursor run this for me? Yes, if the agent has a shell or the MCP server. Point it at llms.txt or install the skill with npx skills add f-o-x11/deed-page-skill (install walkthrough).

Every command below was run against production on October 26, 2026. The test sites were published with a 15-minute expiry and then deleted.

The free way to put a webpage online without signing up

• 1. Save the page as one HTML file. Put the CSS in a <style> tag and any JavaScript in a <script> tag, and name it index.html. If the page was written by ChatGPT, Claude, Grok, or another assistant, ask it for "one self-contained HTML file".
• 2. Send it with one command (or ask your agent to run it):

curl -T index.html "https://deed.page/v1/sites?slug=no-signup-page-<random>&ref=blog" -H "X-Client: <your agent name>"

• 3. Open the url from the reply and share it.

Replace <random> with a few characters of your own, for example no-signup-page-cde958. The reply is JSON:

{"ok":true,"url":"https://no-signup-page-cde958.deed.page/","slug":"no-signup-page-cde958","version":"v1","plan":"free","token":"deed_tok_…","token_note":"Shown once. …"}

That url works right away over HTTPS on any phone or laptop. The slug is the part of the address you pick: lowercase letters, digits, and hyphens, up to 63 characters. A name someone else already owns returns 409 with a suggestion (choosing a slug).

deed.page has no upload form in the browser. It is built for curl and for AI agents, so the person asking can be you in a terminal or an assistant with a shell, such as Claude Code, Codex, Cursor, or Grok Bot.

Keep the token so you can change the page later

There is no account, so the first reply carries a deed_tok_… token instead. It is shown once and deed.page stores only its SHA-256, so save it:

# TOKEN is the token field from the reply. Nothing is written when it is empty.
if [ -n "$TOKEN" ]; then (umask 077 && mkdir -p ~/.config/deed-page && chmod 700 ~/.config/deed-page && printf '%s' "$TOKEN" > ~/.config/deed-page/token && chmod 600 ~/.config/deed-page/token); fi

To change the page, send the new file to the same slug with the token. The address stays the same and the version number goes up:

curl -T index.html "https://deed.page/v1/sites?slug=no-signup-page-cde958" -H "Authorization: Bearer $(cat ~/.config/deed-page/token)"

Sending identical bytes again returns "unchanged":true. To take the page down, send DELETE /v1/sites/{slug} with the same token. Token hygiene for agents covers storing it safely.

Put the page online from an MCP client

Agents that speak MCP can skip curl. Add https://deed.page/mcp as a server (in Claude Code: claude mcp add --transport http deed-page https://deed.page/mcp) and call publish_site:

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"publish_site","arguments":{"slug":"no-signup-page-<random>","files":{"index.html":"<!doctype html><h1>My page is online</h1>"}}}}

The result has the same url and token fields as the REST reply. The MCP walkthrough covers updates and the other tools.

How long no-signup pages last on other hosts

Most no-signup hosts keep an anonymous page for a limited time, then ask you to sign in or claim it. These are the defaults each service states on its own page, checked on October 26, 2026:

Several of them have a drag-and-drop page in the browser, which deed.page does not. If you have no terminal and no agent, one of those is the quicker path. If you want the link to stay up without coming back to claim it, deed.page is built for that (here.now comparison for one more dated example).

What the Free plan includes

Free is $0 for 25 sites, 25 MB per site, 60 publishes per hour, and the last 10 versions of each site (docs). Pages are public to anyone with the link and are not listed in the Explore gallery unless you opt in. Free pages show a small "Published with deed.page" link in the corner. Hobby ($3/month) and Pro ($15/month) remove it and add a site password.

FAQ

Is it really free, with no card and no email? Yes. The first upload needs no account, no card, and no email address. A recovery email is optional, and without one a lost token cannot be restored.

Does the page expire? Not by default. Add -H "X-Ttl: 86400" (seconds) only if you want it gone after a day, and delete it any time with the token.

Can the page have images or more than one file? Yes. Pack the folder as a tarball (tar -C ./site -czf site.tar.gz .) and send it with the same curl -T command. Picking an upload format shows every option.

Every command below was run against production on October 25, 2026. The test sites were published with a 15-minute expiry and then deleted.

How to share an AI-generated report as a web page

• 1. Ask for one self-contained HTML file. A prompt like "Put this report in a single HTML file with the CSS in a <style> tag and the JavaScript in a <script> tag" keeps the page from pointing at files that only exist on the model's side.
• 2. Save it as report.html. Any file name works; a single file is served as the home page.
• 3. Publish it with one command and send the link.

curl -T report.html "https://deed.page/v1/sites?slug=ai-report-<random>&ref=blog" -H "X-Client: <your agent name>"

Replace <random> with a few random characters (for example ai-report-e58a20). The reply is JSON:

{"ok":true,"url":"https://ai-report-e58a20.deed.page/","slug":"ai-report-e58a20","version":"v1","plan":"free","token":"deed_tok_…", "token_note":"Shown once. …"}

url is the link to share. There is no account, no email code, and no claim link, and the site does not expire unless you ask for that with an X-Ttl header (docs). The slug rules are strict (lowercase letters, digits, and hyphens), and a name someone else owns returns 409 with a suggestion; Choosing a slug has the details.

Keep the token so the link stays yours

The first publish returns a deed_tok_… Bearer token once. deed.page keeps only its SHA-256, so save it right away:

mkdir -p ~/.config/deed-page && printf '%s' "$TOKEN" > ~/.config/deed-page/token && chmod 600 ~/.config/deed-page/token

When next week's report is ready, publish to the same slug with the token. The link stays the same and the site gets a new version:

curl -T report.html "https://deed.page/v1/sites?slug=ai-report-e58a20" -H "Authorization: Bearer $(cat ~/.config/deed-page/token)"

Sending identical bytes again returns "unchanged":true instead of a new version. Free keeps the last 10 versions, and each one has its own permalink such as https://v1--ai-report-e58a20.deed.page/ (rollback guide). Token hygiene for agents covers storing it, and POST /v1/tokens/rotate replaces a leaked one (docs).

Reports with charts, images, or data files

If the report loads a chart image or a JSON file next to it, publish the folder as a tarball. Paths are kept exactly:

tar -C ./report -czf report.tar.gz . && curl -T report.tar.gz "https://deed.page/v1/sites?slug=ai-report-<random>&ref=blog" -H "X-Client: <your agent name>"

In our test, data/q3.json inside the tarball was served at https://<slug>.deed.page/data/q3.json. Picking an upload format compares tarballs, JSON maps, multipart, and raw HTML.

Publish the report from an MCP client

Agents that speak MCP can skip curl. Add https://deed.page/mcp as a server (in Claude it is a custom connector with no sign-in step), then call publish_site:

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"publish_site","arguments":{"slug":"ai-report-<random>","files":{"index.html":"<!doctype html><h1>Q3 summary</h1><p>Revenue table here.</p>"}}}}

The result has the same url and token fields as the REST reply. Claude Code users can add the server with claude mcp add --transport http deed-page https://deed.page/mcp. The MCP walkthrough goes through update_site and the other tools.

Who can see the report

Anyone with the link can open it. The site is not listed in the Explore gallery unless you opt in (the publish reply shows "listed":false). A password gate is available on Hobby ($3/month) and Pro ($15/month), not on Free, so leave secrets and personal data out of Free reports. Free pages also show a small "Published with deed.page" link in the corner, which the token can turn off with PUT /v1/sites/{slug}/badge (docs).

If the report also needs to go out by email, the same team runs Cooper Email, which gives agents their own inboxes.

FAQ

Do charts and scripts in the report still work? Yes. CSS and JavaScript inside the HTML file are served with the page, and libraries loaded from a public CDN load as usual. Files referenced by a relative path must be in the tarball.

How long does the link last? It is permanent by default. Add -H "X-Ttl: 86400" (or ttl_seconds over MCP) only if you want it to expire, and delete it any time with DELETE /v1/sites/{slug} and the token.

Can I update the report without changing the link? Yes. Publish to the same slug with the token from the first reply. The URL stays the same, and older versions stay available until they fall out of the plan's version limit.

Every response below was captured against production on October 24, 2026. The test site, webhooks, and token were deleted or revoked afterwards.

Register a webhook

curl -s -X POST "https://deed.page/v1/webhooks" \
  -H "Authorization: Bearer $DEEDPAGE_TOKEN" \
  -H "content-type: application/json" \
  -d '{"url":"https://hooks.example.com/deed"}'
# {"ok":true,"id":"whk_…","url":"https://hooks.example.com/deed",
#  "events":["site.published","site.version_restored","site.deleted",
#            "site.taken_down","domain.active","report.received"],
#  "secret":"whsec_…",
#  "secret_note":"Shown once. We store it to sign deliveries and do not return it again."}

Store secret right away, next to the token. GET /v1/webhooks lists endpoints and the plan limit, never the secret. Omit events to get all six, or pass a subset.

An identical republish returns "unchanged": true and sends nothing. In our test, publishing v2 produced one site.published delivery, the same bytes again produced none, and restoring v1 produced site.version_restored with "version":"v3".

The same thing over MCP

https://deed.page/mcp has create_webhook, list_webhooks, and delete_webhook. Pass the token as a Bearer header or a token argument.

curl -s https://deed.page/mcp \
  -H "content-type: application/json" \
  -H "accept: application/json, text/event-stream" \
  -H "Authorization: Bearer $DEEDPAGE_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"create_webhook",
       "arguments":{"url":"https://hooks.example.com/deed","events":["site.published","site.deleted"]}}}'
# structuredContent: {"ok":true,"id":"whk_…","events":["site.published","site.deleted"],"secret":"whsec_…",…}

Without a token it returns isError: true.

What a delivery looks like

POST /deed HTTP/1.1
Content-Type: application/json
User-Agent: deed.page-webhooks
Deed-Signature: t=1792848217,v1=fd6836…

{"id":"evt_…","type":"site.published","created":"2026-10-24T13:23:37.000Z",
 "data":{"slug":"rain-log-7f3k","url":"https://rain-log-7f3k.deed.page/","version":"v2"}}

v1 is the hex HMAC-SHA256 of <t>.<raw body>, keyed with your whsec_ secret. Verify the raw bytes before parsing. Reject a timestamp more than 5 minutes from your clock, either direction; deed.page doesn't check this for you.

Verify the signature

Node, no dependencies:

import { createServer } from "node:http";
import { createHmac, timingSafeEqual } from "node:crypto";

const SECRET = process.env.DEED_WEBHOOK_SECRET; // the whsec_… value, shown once
const seen = new Set(); // use a real store in production

function verify(raw, header) {
  const parts = Object.fromEntries(
    (header || "").split(",").map((p) => p.split("=", 2)),
  );
  const t = Number(parts.t);
  if (!t || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > 300) return false; // 5-minute window
  const want = createHmac("sha256", SECRET).update(`${t}.${raw}`).digest();
  const got = Buffer.from(parts.v1, "hex");
  return got.length === want.length && timingSafeEqual(got, want);
}

createServer((req, res) => {
  let raw = "";
  req.setEncoding("utf8");
  req.on("data", (c) => (raw += c));
  req.on("end", () => {
    if (!verify(raw, req.headers["deed-signature"])) {
      res.writeHead(401).end();
      return;
    }
    const event = JSON.parse(raw);
    res.writeHead(204).end(); // answer fast, work after
    if (seen.has(event.id)) return; // a retry can repeat an id
    seen.add(event.id);
    console.log(event.type, event.data.slug, event.data.version ?? "");
  });
}).listen(8787);

The same check in Python:

import hashlib, hmac, time

def verify(secret: str, raw: bytes, header: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    t, v1 = parts.get("t", ""), parts.get("v1", "")
    if not t.isdigit() or not v1 or abs(time.time() - int(t)) > 300:
        return False
    want = hmac.new(secret.encode(), t.encode() + b"." + raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(want, v1)

We tested both against deed.page's own signing function: a valid header passed; a changed body, a 10-minute-old timestamp, and the wrong secret failed; a repeated event id was logged once.

Test it, then read the delivery log

curl -s -X POST "https://deed.page/v1/webhooks/$HOOK_ID/test" -H "Authorization: Bearer $DEEDPAGE_TOKEN"
# {"ok":true,"id":"whk_…","note":"…","delivery":{"type":"webhook.test","ok":true,"status":204,"attempts":1,"error":null,…}}

curl -s "https://deed.page/v1/webhooks/$HOOK_ID/deliveries" -H "Authorization: Bearer $DEEDPAGE_TOKEN"

Delivery is best-effort, not a queue. deed.page tries up to 3 times: right away, then after 0.5 seconds, then after 2 seconds. Any 2xx counts as success. Redirects are not followed. Against an endpoint that always returns 500, both the test and the site.deleted event were logged as "ok":false,"status":500,"attempts":3,"error":"HTTP 500", and then the event is gone. If a missed event matters, answer 2xx fast and reconcile with GET /v1/sites or list_versions on a schedule. The log keeps the 30 most recent deliveries across your webhooks.

Limits and errors

Free allows 1 webhook, Hobby 5, and Pro 20 (pricing). Targets must be public http or https on port 80 or 443. Private and local addresses are refused.

To rotate a secret, delete the webhook (DELETE /v1/webhooks/{id} or delete_webhook) and create it again. The new secret comes back once.

Full reference: deed.page/docs. Related: version history and rollback and custom domains via API.

Every example below was run against production on October 23, 2026. The test sites used X-Ttl: 900 and were deleted afterwards.

What every publish already tells you

A normal publish response carries the listing state:

curl -s -X PUT "https://deed.page/v1/sites/rain-log-<random>" \
  -H "X-Ttl: 900" -H "content-type: text/html" \
  --data-binary @index.html
# {"slug":"rain-log-…","version":"v1","listing":{"listed":false}, "token":"deed_tok_…", ...}

Keep the token from the first publish (for example as DEEDPAGE_TOKEN). Changing the listing is an owner action.

Opt in with one PATCH

curl -s -X PATCH "https://deed.page/v1/sites/rain-log-<random>" \
  -H "Authorization: Bearer $DEEDPAGE_TOKEN" \
  -H "content-type: application/json" \
  -d '{"listed":true,"category":"Other","title":"Rain gauge log",
       "description":"Daily rainfall readings for one backyard gauge, with a weekly total.",
       "tags":["weather","garden"]}'

{"ok":true,"slug":"rain-log-…","listing":{"listed":true,"status":"approved",
 "title":"Rain gauge log","description":"Daily rainfall readings for one backyard gauge, with a weekly total.",
 "category":"Other","tags":["weather","garden"],"reason":null}}

The rules:

• category is required and must be one of: Apps & tools, Games, Business, Portfolio, Docs & guides, Education, Events, Other.
• title is required, at most 80 characters. description is required, at most 300.
• tags is optional, at most 5. Each tag is lowercase letters, digits and hyphens, at most 32 characters.

Each of these breaks one rule and returns 400 listing_invalid with a message that names the problem:

{"listed":true}                       → category must be one of: Apps & tools, Games, ...
"category":"Tools"                    → category must be one of: ...
"tags":["Weather"]                    → Tag "Weather" must be lowercase letters, digits, and hyphens (max 32).
six tags                              → At most 5 tags.

With no token you get 401 unauthorized. With a token that doesn't own the slug you get 403 forbidden ("This token does not own that slug.").

Or set it on the publish itself

The same fields can travel with the upload as JSON body fields, query parameters (listed, category, tags, title, description), or headers:

curl -s -X PUT "https://deed.page/v1/sites/rain-log-<random>" \
  -H "Authorization: Bearer $DEEDPAGE_TOKEN" \
  -H "content-type: text/html" \
  -H "X-Listed: true" \
  -H "X-Listing-Category: Docs & guides" \
  -H "X-Listing-Title: Rain gauge log" \
  -H "X-Listing-Description: Daily rainfall readings for one backyard gauge, with a weekly total." \
  -H "X-Listing-Tags: weather,garden" \
  --data-binary @index.html
# {"version":"v2","listing":{"listed":true,"status":"approved","category":"Docs & guides",...}}

Or over MCP

At https://deed.page/mcp, the set_listing tool takes the same fields. publish_site and update_site accept them too.

curl -s https://deed.page/mcp \
  -H "content-type: application/json" \
  -H "accept: application/json, text/event-stream" \
  -H "Authorization: Bearer $DEEDPAGE_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"set_listing",
       "arguments":{"slug":"rain-log-<random>","listed":true,"category":"Other",
       "title":"Rain gauge log","description":"Daily rainfall readings for one backyard gauge, with a weekly total.",
       "tags":["weather"]}}}'

structuredContent holds the same listing object as the REST reply. Without a token, the tool returns isError: true with "set_listing needs your token."

Why a listing comes back "pending"

Every new listing gets three checks: the upload screening already applied to the files, a text check, and a quality check. If all three pass, the listing is approved on the spot. Otherwise it is pending and waits for an operator. The owner sees the reason in reason. The public site record shows the listing without it. Reasons we triggered in testing:

• title_slug: the title looked like a slug ("rain-gauge-log") or a hex string. Use words.
• description_short: the description was under 20 characters ("Rain log.").
• trivial: the page itself was a stub. We republished <h1>Coming soon</h1>.

That last one matters for agents that publish on a schedule. Every new version runs the checks again, even when the publish leaves out the listing fields. Our v2 stub flipped the listing from approved to pending (reason: "trivial"). Republishing the real page as v3 brought it straight back to approved. Test, draft and redirect pages are held for the same reason.

Password-protected sites (Hobby and Pro) cannot be listed. Trying returns 400 listing_private.

Where the listing shows up

Approved listings appear on /explore, on category pages like /explore/c/docs-and-guides, on tag pages like /explore/t/weather, and in the machine-readable index:

curl -s https://deed.page/explore/index.json | jq '.listings[] | {slug, category_slug, tags, url, card_url}'

The index is cached (cache-control: public, max-age=180), so a change can take about three minutes to appear there. Each entry has a generated card image at /explore/card/{slug}. There are no screenshots. The gallery and its category pages are in /sitemap.xml, and cards link out with rel="ugc noopener".

Taking a site back out

curl -s -X PATCH "https://deed.page/v1/sites/rain-log-<random>" \
  -H "Authorization: Bearer $DEEDPAGE_TOKEN" \
  -H "content-type: application/json" -d '{"listed":false}'
# {"ok":true,"slug":"rain-log-…","listing":{"listed":false}}

Unlisting removes the slug from the gallery in the same request. Deleting the site (DELETE /v1/sites/{slug}) removes it as well, and its card returns 404. A TTL site that expires drops out too.

A good default for agents

Leave listed off for throwaway pages, reports and previews. Opt in for pages meant to be found, like a tool, a doc set or an event page. Give the listing a real title, a one-sentence description and two or three tags. After each scheduled republish, read listing.status in the response. If it says pending, the reason field tells you what to fix.

The full field reference is in the docs under "Gallery". The deed.page agent skill covers set_listing as well.

Every response below was captured against production on October 22, 2026. The test site used X-Ttl: 900, the test hostname was removed, and the site was deleted afterwards.

Limits per plan

Domain calls (add, status, remove) are also capped at 60 an hour per token and 60 an hour per network. The cap is there to stop polling loops, and normal use stays well under it.

Attach a hostname

You need a site the token owns. Then one POST with the hostname as JSON attaches it:

curl -sS -X POST "https://deed.page/v1/sites/$SLUG/domains" \
  -H "Authorization: Bearer $DEEDPAGE_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"domain":"docs.example.com"}'

The answer is 201 with the records to create (values shortened here):

{"ok":true,"domain":"docs.example.com","slug":"my-docs","apex":false,
 "status":"pending_dns",
 "status_reason":"Create the CNAME and every TXT record. Then check status again.",
 "dns_records":[
   {"type":"CNAME","name":"docs","host":"docs.example.com",
    "value":"9f5677dd5e4f32ed.vercel-dns-016.com","purpose":"routing",
    "note":"Create this CNAME. Do not also create an A record for this name."},
   {"type":"TXT","name":"_vercel","host":"_vercel.example.com",
    "value":"vc-domain-verify=docs.example.com,9b71...","purpose":"verification",
    "note":"Ownership verification required by the hosting project. Create this record exactly."}],
 "url":"https://docs.example.com/"}

Treat dns_records as the source of truth and don't hard-code values. name is relative to the zone, so it is ready to paste into most DNS panels, and host is the fully qualified name. The routing target is specific to each hostname. Here is what the list holds:

• A subdomain (docs.example.com) gets one CNAME.
• An apex (example.com, "apex":true) gets an A record and an ALIAS record. Create one of the two, not both. Use ALIAS (sometimes called ANAME) if your DNS host supports it.
• TXT records prove ownership. The hosting layer sometimes asks for its own _vercel TXT record. When it doesn't, deed.page asks for a _deed-page.<hostname> TXT record with a deed-verify=... value instead. Create every TXT record in the list.

Calling the same POST again for the same slug and hostname is safe. It returns 200 with a fresh status instead of creating a duplicate.

Poll until active

After the records exist, check status. This call also re-runs verification, re-reads the DNS config, and checks the certificate:

curl -sS "https://deed.page/v1/sites/$SLUG/domains/docs.example.com" \
  -H "Authorization: Bearer $DEEDPAGE_TOKEN"

status moves through these values:

• pending_dns: routing records are missing or wrong. status_reason says which ones to create.
• verifying: DNS is in place, but ownership verification hasn't finished.
• issuing_cert: ownership is confirmed, and the TLS certificate isn't ready yet.
• active: "Serving this site." The hostname now serves the same site as https://{slug}.deed.page/.
• error: a hard failure, with the reason in status_reason.

DNS can take anywhere from minutes to hours to propagate. Poll every few minutes, not every second, so the agent stays under the 60-calls-an-hour cap. An agent with a webhook registered gets a domain.active event when the hostname goes live, so it doesn't need to poll at all.

To see every hostname on a site, along with your quota, call GET /v1/sites/$SLUG/domains:

{"ok":true,"domains":[{"domain":"docs.example.com","status":"pending_dns",...}],
 "domain_limit":1,"domains_used":1}

Remove a hostname

curl -sS -X DELETE "https://deed.page/v1/sites/$SLUG/domains/docs.example.com" \
  -H "Authorization: Bearer $DEEDPAGE_TOKEN"

That call returned {"ok":true,"removed":"docs.example.com","slug":"my-docs"}. Requests to that host stop serving the site, and the slot frees up. Repeating the call returns 404 not_found. Deleting the whole site also detaches every hostname on it. You can delete the DNS records afterwards.

The same thing over MCP

The MCP server at https://deed.page/mcp has four domain tools: add_domain, domain_status, list_domains, and remove_domain. They return the same JSON as REST, in structuredContent:

curl -sS https://deed.page/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -H "Authorization: Bearer $DEEDPAGE_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"add_domain",
       "arguments":{"slug":"'"$SLUG"'","domain":"docs.example.com"}}}'

In a chat client that already has deed.page connected (see the MCP walkthrough), the agent just calls add_domain, shows the person the records, and calls domain_status later. If the client can't send headers, pass the token as a token argument. Without any token, the tools return isError: true with unauthorized.

Errors an agent should handle

On Free, a second hostname returns quota_domains with "Free allows 1 custom domain. Hobby ($3/mo) includes 3 custom domains." plus the checkout call. POST /api/v1/billing/checkout with {"plan":"hobby"}, or the MCP tool get_upgrade_link, returns a Stripe Checkout link for a person to pay. Upgrading keeps the same token, sites, and domains. Plans are listed at deed.page/pricing.

A short checklist for agents

1. Publish the site and keep the token.
2. add_domain, then show the person dns_records exactly as returned.
3. Poll domain_status every few minutes, or wait for the domain.active webhook.
4. Report https://<hostname>/ only once status is active. Until then, the {slug}.deed.page URL keeps working.

The skill is MIT-licensed and public at github.com/f-o-x11/deed-page-skill. Every command below was run on October 21, 2026, against production. The test sites were deleted afterwards.

Install with one command

The skills.sh installer reads the repo and copies the skill into the folder your agent loads skills from. Run it from your project directory:

npx skills add f-o-x11/deed-page-skill -a claude-code

That writes ./.claude/skills/deed-page/SKILL.md. Choose a different agent with -a:

npx skills add f-o-x11/deed-page-skill -a cursor      # ./.agents/skills/deed-page
npx skills add f-o-x11/deed-page-skill -a codex -g    # ~/.agents/skills/deed-page

-g installs it for every project instead of just the current one. -a hermes-agent targets Hermes Agent. Leave out -a and the installer asks which agents you use. Before it copies anything, the installer prints a security summary for the skill. The file it installs is the same one that lives in the repo.

Install without npx

If you would rather not run an installer, the skill is just one file. Copying it by hand works the same way:

git clone --depth 1 https://github.com/f-o-x11/deed-page-skill /tmp/deed-page-skill
mkdir -p ~/.claude/skills && cp -r /tmp/deed-page-skill/skills/deed-page ~/.claude/skills/

deed.page also serves a longer version of the skill at https://deed.page/skill.md. It covers the full API, including versions, merge uploads, and domains. The install command for it is listed in https://deed.page/.well-known/skills/index.json:

mkdir -p ~/.claude/skills/deed-page && curl -fsSL https://deed.page/skill.md -o ~/.claude/skills/deed-page/SKILL.md

Pick one of the two. The repo version is short and covers publishing. The served version is the full reference.

What the agent runs

Once the skill is installed, asking the agent to "put this report online" makes it pick a slug with a random suffix and send one request:

SLUG="report-$(head -c4 /dev/urandom | od -An -tx1 | tr -d ' \n')"
curl -sS -T report.html "https://deed.page/v1/sites?slug=$SLUG&ref=skill-gh" \
  -H "X-Client: Claude Code"

The response holds the live URL and, on that first publish only, a token:

{"ok":true,"url":"https://report-4fcfd126.deed.page/","slug":"report-4fcfd126",
 "version":"v1","permanent":true,"plan":"free","token":"deed_tok_..."}

The skill tells the agent to answer with url and keep the token in DEEDPAGE_TOKEN for the session. deed.page stores only a SHA-256 of that token, so it is the one key that can update or delete the site. ?ref=skill-gh records that the publish came from the skill and does not change the result. X-Client names the agent.

For a folder, the skill sends a tarball with the same token:

tar -C ./site -czf /tmp/site.tar.gz .
curl -sS -T /tmp/site.tar.gz "https://deed.page/v1/sites?slug=$SLUG&ref=skill-gh" \
  -H "X-Client: Claude Code" -H "Authorization: Bearer $DEEDPAGE_TOKEN"

That returned "version":"v2" with both files live. When the user asks for a delete, the agent sends curl -sS -X DELETE "https://deed.page/v1/sites/$SLUG" -H "Authorization: Bearer $DEEDPAGE_TOKEN", which returns {"ok":true,"deleted":"<slug>"}.

The same token works over MCP

Skill and MCP aren't an either/or choice. The skill's token also works on the MCP server, so an agent can publish with curl and later manage that site through tools. Here is a raw MCP call that publishes v3 of the same slug:

curl -sS https://deed.page/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -H "Authorization: Bearer $DEEDPAGE_TOKEN" \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"publish_site",
       "arguments":{"slug":"'"$SLUG"'","files":{"index.html":"<h1>v3 via MCP</h1>"}}}}'

The result came back with "version": "v3", and the site served the new page. tools/list currently returns 24 tools. Besides publishing, they cover versions and restore, custom domains, analytics, passwords, webhooks, token rotation, and set_listing for the opt-in gallery at deed.page/explore. Every publish response carries "listing":{"listed":false} until the agent opts in with listed: true plus a category, title, and description.

Skill or MCP?

• Use the skill when the agent has a shell and you want zero setup: no connector to register and no config file. It also fits agents that support skills but not remote MCP servers.
• Use MCP when the agent has no shell, as with many chat clients, or when you want typed tools for versions, domains, and analytics without the agent having to compose curl calls. The MCP walkthrough shows how to connect it.
• Use both with one token. Publishing works the same way over either path.

Limits

The skill uses the same Free plan as any other client: 25 sites, 25 MB per site, 60 publishes an hour, and 4 MB per request. There's no signup. Free sites are public, so the skill tells the agent never to publish secrets. If your agent also needs an email address of its own, Cooper Email (cooperemail.com) comes from the same team at Avatar 8 LLC.

Originally published on deed.page.