Skip to content

Large files and upload tickets

An AI can send a small site inline: up to 20 files and 512 KB in total. That budget is for a site written in the conversation.

Anything bigger — a real folder, an exported build, a .zip on somebody’s disk — goes through an upload ticket.

How it works

  1. The AI calls create_upload_ticket and gets back a URL.
  2. Whoever holds the bytes sends the archive to that URL.
  3. The publish proceeds exactly as it would have inline.

The ticket is the credential

Redeeming carries no other authentication. There is no token on the request, no session, no header. That is the entire point: it lets the URL be handed to a shell, a script, or a person who holds no credentials of yours at all.

Which means the URL is worth the same care as a token while it lives. Anyone who has it can publish one thing to your account.

It is bounded to keep that window small:

  • single use — redeemed once, then dead
  • 10 minutes — then dead whether used or not
  • one publish — it authorises exactly one, to one site

An expired or spent ticket is simply gone. Ask for another; they are free.

It is a POST, and the link is not clickable

Opening the ticket URL in a browser does not work. The endpoint accepts POST only, so a browser’s ordinary GET gets 405 Method Not Allowed — no upload form, no explanation, and the clock is still running on a ticket that can only be used once.

Send the archive with a tool that can POST:

curl -X POST --data-binary @site.zip "<the ticket URL>"

No Authorization header. Adding one is harmless but pointless — the ticket in the URL is what authorises it.

Size

Up to 30 MB for the archive, and the extracted site still has to fit the ordinary per-site limits. A .zip that fits the upload cap can still be rejected for unpacking to something too large — that is the zip-bomb guard, and it is not negotiable.