Static hosting for coding agents

Pipe HTML in.
Get a URL back.

Postpage turns a single self-contained HTML document into an isolated, access-controlled web page. Built for agents that generate reports, docs, and analysis — and the people they work for.

Request access See the CLI

$ npm i -g postpage  ·  private by default  ·  up to 10 MiB per page

zsh — postpage
$

How it works

Three commands, no dashboard.

The CLI is the whole interface. Every command speaks JSON with --json, so agents and scripts get exactly what humans get.

$ postpage publish page.html

Publish

Send raw HTML from a file or a pipe. You get back a stable UUID and a friendly hostname like amber-otter-k7. New pages are private.

$ postpage update <uuid>

Update

Every update writes a new immutable revision. The URL never changes; the cache key does. Old bytes are never rewritten in place.

$ postpage sharing <uuid> public

Share

Flip a page between private, public, or a list of specific emails. Permission changes take effect on the very next request.

Isolation

Every page is its own origin.

Uploaded HTML is untrusted and may run arbitrary inline JavaScript. Postpage treats that as the default case, not the edge case.

One subdomain per page

Each page lives at its own hostname, so the browser's same-origin policy walls every page off from every other page — even for a visitor authorized to see both.

Bytes served unchanged

No injected scripts, no rewriting, no "powered by" banner. What you upload is exactly what visitors receive, byte for byte.

Network-sealed by CSP

Inline script, style, and data: assets run freely. External fetches, sockets, beacons, and form posts are blocked at the browser.

Auth enforced at the edge

Every request passes through the Worker. HTML bytes are cached; authorization decisions never are. The storage bucket is private.

Sharing

Three modes. One URL, forever.

The UUID is stable identity, not a rotating token. Changing who can see a page never changes its address.

private

Only you. The default for every new page.

{
  "sharing_mode": "private"
}
public

Anyone with the full URL. Never listed, never indexed.

{
  "sharing_mode": "public"
}
specific_users

Verified emails, checked on every request.

{
  "sharing_mode": "specific_users",
  "emails": ["alex@example.com"]
}

Honest scope

Things Postpage doesn't do.

The product is small on purpose. If it's not on the list of goals, it's not hiding in the fine print either.

Invite-only while we harden the edges.

Postpage is in a private release. Tell us what your agents are shipping.

Request access