Build · publish · verify

Give your work
a public URL.

Publish a static browser app or share a finished document, image, audio file, or video. No account, API key, SDK, or payment is required.

Publish an app Share a file

Before you begin

Choose the right publishing mode.

Apps and finished files have different hosting and lifecycle rules.

Static browser apps

HTML, CSS, JavaScript, images, fonts, and other browser assets are hosted at https://apps.promptbox.cn/. Promptbox does not run PHP, Node.js, databases, or private backend code in a published app.

Documents and media

Finished files are hosted at https://www.promptbox.cn/publish/. They receive a public URL, but no management token, replacement operation, or extension operation.

Publishing creates public content. Check that the app or file contains no unintended private information before uploading it.

App mode

Publish a browser app.

Send one HTML file, a complete ZIP, or UTF-8 HTML text to the publishing endpoint.

Build the app first. Put index.html and every relative asset in one clean directory, then create a ZIP if the app contains more than one file. Keep the publication receipt outside that directory so its private token can never be uploaded with the app.

umask 077
PUBLISH_RECEIPT=$(mktemp)
curl --fail-with-body https://www.promptbox.cn/api/publish.php \
  -F 'mode=app' \
  -F 'directory=my-app' \
  -F 'file=@app.zip' \
  -o "$PUBLISH_RECEIPT"
jq '{ok, url, directory, expires_at, files_written, removed_files, sanitized_files}' "$PUBLISH_RECEIPT"

Accepted app inputs

One multipart HTML or HTM file, which becomes index.html.
One multipart ZIP containing the complete app.
UTF-8 HTML supplied in the JSON or form field text.

{"mode":"app","directory":"hello","text":"<!doctype html><title>Hello</title><h1>Hello</h1>"}

Do not pass a filename, URL, or base64 string as a JSON file value. Let curl or FormData set the multipart boundary. Directory names may contain 1–80 ASCII letters, digits, underscores, or hyphens and must start with a letter or digit. Name collisions receive _2, _3, and so on, so use the directory and URL returned by the service.

A ZIP may contain index.html at its root, or one enclosing folder containing index.html and all app files. Ambiguous layouts, multiple app roots, and deeper nesting are rejected. Use relative asset paths such as ./assets/app.js; a path beginning with / addresses the host root and is usually wrong.

Save the receipt privately

A new app returns HTTP 201 with its public URL, expiry, file results, and a private UUID token. Save the complete receipt privately because the response contains the only copy of that token. Do not place the token in the app, build directory, repository, public URL, browser storage, logs, or ordinary messages.

Open the returned URL and test the real app, its assets, and every helper integration. Browser calls to Promptbox helpers other than publish.php must be tested from the published Promptbox HTTPS origin—not localhost or an unrelated website.

Replacement

Every app update is complete.

Upload the full build again; updates are not partial file patches.

Send mode=app, the private token, and the complete HTML, ZIP, or text build. Explicit action=replace is also accepted. A successful replacement returns HTTP 200 with updated:true and renews the app for 30 days.

An HTML-only replacement deletes every previously uploaded asset. Omitted files appear in deleted_files; filtered upload paths appear in removed_files. Every replacement must include index.html. Validation failures leave the existing deployment unchanged because publishing uses private staging and rollback storage.

Do not blindly retry an uncertain new publication: it may have succeeded, and retrying can create a duplicate. Check the response and returned URL first.

App management

Inspect and manage an owned app.

Use the app token in an Authorization header whenever possible.

curl --fail-with-body \
  -H "Authorization: Bearer $PROMPTBOX_APP_TOKEN" \
  "https://www.promptbox.cn/api/publish.php?action=status&mode=app"

Action	Method	What it does
`status`	GET or POST	Returns the URL, files, size, timestamps, and expiry without revealing the token.
`files`	GET or POST	Returns file paths, sizes, hosted HTTP content types, URLs, and app expiry.
`replace`	POST	Replaces the complete app and renews it for 30 days.
`extend`	POST	Renews expiry to 30 days from the operation without changing files.
`delete`	POST	Immediately removes the hosted app and invalidates its token.
`rotate-token`	POST	Returns a new token and immediately invalidates the old one.

Never put a token in a query string. Send it as Authorization: Bearer UUID or as a POST field. Status, files, deletion, and token rotation do not consume publication quota. Extending an app consumes one publication use. Updates and extensions cannot revive an expired app.

File mode

Share a document or media file.

Published files have a public URL and expire after 30 days.

curl --fail-with-body https://www.promptbox.cn/api/publish.php \
  -F 'mode=file' \
  -F 'name=quarterly-report' \
  -F 'file=@report.pdf'

Binary files may be up to 10 MiB. UTF-8 TXT, MD, JSON, CSV, and TSV files may be up to 1 MiB. Supported documents are PDF, DOCX, XLSX, PPTX, ODT, ODS, and ODP. Supported media are JPG, JPEG, PNG, GIF, WEBP, MP3, WAV, OGG, M4A, FLAC, MP4, and WEBM.

Text may also be sent as JSON with name, text, and extension. The extension defaults to TXT. Duplicate filenames receive _02, _03, and so on. A successful response uses HTTP 201 and includes the filename, public URL, byte count, and expiry.

Office packages reject macros, embedded active objects, and external resources other than ordinary web or mail links. PDFs receive basic signature and active-content checks. Documents download as attachments. HTML always uses app mode; SVG, XML, web manifests, and WASM are supported only as app assets.

Validation and limits

Know what the host accepts.

Current capacity is checked at publication time and may change.

App size and file validation

Apps allow up to 25 MiB of uploaded and expanded content, up to 1,000 archive entries or files, and an HTTP body up to 26 MiB. Encrypted or corrupt ZIPs, unsafe expansion ratios, duplicate or case-conflicting paths, and unsafe paths are rejected or filtered.

Allowed app extensions are HTML, HTM, CSS, JS, MJS, JSON, TXT, MD, PNG, JPG, JPEG, GIF, WEBP, ICO, AVIF, WOFF, WOFF2, TTF, OTF, MP3, WAV, OGG, M4A, FLAC, MP4, WEBM, SVG, WEBMANIFEST, XML, and WASM. Dotfiles, links, server configuration, executable server code, and node_modules are discarded.

Browser storage and networking

All published apps share the origin https://apps.promptbox.cn, including its localStorage, IndexedDB, cookies, and same-origin access. Use app-specific storage names, but never treat names as a security boundary or store secrets there.

Use absolute https://www.promptbox.cn/api/...php helper URLs and credentials:'omit'. Frames, popups, and base tags are blocked by the publishing content-security policy.

Expiry and capacity

Apps use renewable 30-day periods. Replace or extend before expires_at. Files also expire after 30 days but cannot be extended. Current global limits are 60 publications per rolling hour, 300 per rolling day, 100 MiB of public storage, and 10,000 published documents. The service checks live availability when a request is made.

Errors

Correct HTTP 400, 401, 403, 405, 409, 413, 415, and 422 requests before retrying. HTTP 401 includes unknown or expired tokens. Honor Retry-After on HTTP 429. HTTP 507 means public storage is full. Investigate HTTP 500, 503, network failures, and uncertain timeouts before repeating a new publication.

Finish well

Publishing checklist.

Keep the source and private app receipt after the public URL is working.

Confirm the upload contains no unintended private information.
Inspect the HTTP status and response instead of assuming success.
Save the app token privately when app mode returns one.
Inspect removed_files, sanitized_files, deleted_files, and stripped_prefix.
Open the returned URL and test the page or file, assets, and actual interactions.
Keep the local source and record the public URL and expiry without exposing the token.