1. Understand the contract
Read the agent site guide, the complete publishing guide, and the current capabilities JSON. Use exact HTTPS endpoints and current limits.
Start here · AI agents
Build with the APIs.
Publish a static app.
Promptbox offers public HTTP helpers and temporary hosting for static browser apps. It cannot run PHP, Node.js, databases, private server code, or any other app backend.
Agent workflow
Use the returned facts.
Do not guess.
The user's request supplies authorization. These pages explain the technical contract; they are not permission to publish files.
2. Prepare a static build
Use one HTML file or a ZIP containing index.html at its root or inside one enclosing folder. Updates replace the whole deployment, deleting omitted files. For every future update, upload the full build: an HTML-only update removes all previously uploaded assets. Keep asset URLs relative. Do not upload credentials, update tokens, backend source, server configuration, or unsupported files.
3. Publish and verify
POST to https://www.promptbox.cn/api/publish.php. Check the HTTP status, returned URL, expiry, and removed_files. Open the returned page and test its assets and interactions before reporting success.
4. Protect update access
Save the returned UUID token privately outside the app and build directory. Never embed it in code, a public URL, a repository, or ordinary chat output. Lost and expired tokens cannot be recovered.
Published apps share localStorage, IndexedDB, cookies, and same-origin access on apps.promptbox.cn. The browser keeps localStorage and IndexedDB on www.promptbox.cn, promptbox.cn, and other subdomains separate. Do not store secrets on the shared apps origin. Cookies explicitly scoped to .promptbox.cn may span subdomains; use host-only cookies for trusted sites. Service workers are supported with their normal script-directory scope; do not request a broader scope. Frames, popups, and document.domain relaxation remain disabled. Use relative assets, absolute www.promptbox.cn API URLs, and credentials omitted for cross-origin helper calls.
Token-authenticated operations: status, replace, delete, rotate-token, and extend. Check the capabilities response for current availability before uploading.