Why not build this myself?

Certificates, archive validation, Safe Browsing and CSAM screening, per-user quotas, a withholding ladder that survives a failed payment, signed webhook retries, and a moderation desk.

Your AI writes the site. We keep it online.

Publishing infrastructure for AI builders. Three calls, one live link, no TLS of your own.

Three calls. One live link.

# 1. Register the end-user once, idempotent on your own externalId
curl -X POST https://upload.tf/api/platform/v1/subjects \
  -H "x-api-key: $UPLOADTF_KEY" \
  -H "Content-Type: application/json" \
  -d '{"externalId":"user_42"}'
 
# 2. Host what their AI just generated
curl -X POST https://upload.tf/api/platform/v1/subjects/ext:user_42/sites \
  -H "x-api-key: $UPLOADTF_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"acme-preview","files":[{"path":"index.html","contentBase64":"PGgxPkhlbGxvPC9oMT4="}]}'
 
# 3. Mint a token their own browser can use to keep editing
curl -X POST https://upload.tf/api/platform/v1/subjects/ext:user_42/tokens \
  -H "x-api-key: $UPLOADTF_KEY" \
  -H "Content-Type: application/json" \
  -d '{"cap":["site:write"]}'

It runs on Corporate

Its own entitlement, separate from API access. Business has the full v1 REST API and still cannot create a subject.

Platform tier

Corporate

$61/mo

Billed annually at $732 a year

Or $79 a month, billed monthly

20 seats

Get Corporate

Included

Platform API: subjects, sites, per-file patches, scoped tokens, usage, webhooks
Users dashboard: stats, file inspector, edit history, abuse reports
A moderator seat scoped to your users and nothing else
Host your users’ sites

What you stop building

TLS and subdomains: Every site gets its own https://name.upload.tf at creation. No certificates, no wildcard DNS.
Edits, not redeploys: Patch two files by path. The link, the analytics and any connected domain all survive.
Per-user caps: Cap storage per end-user, read usage back per subject, rebill on your own terms.
Signed webhooks: Publish, update, expiry and moderation events. Retried with backoff, replayable from a log.

How it works

Register the end-user
POST /subjects, idempotent on your own externalId.
Host the output
POST /sites takes a ZIP or a JSON file map and returns a live link.
Hand over a scoped token
POST /tokens mints a short-lived token pinned to that one subject.

Abuse and content screening

Strangers publish. Someone owns the fallout.

Every upload is unpacked and screened before it serves, and you keep your own suspend and delete levers.

422: Publish refused on a Safe Browsing hit
451: Withheld on legal grounds, RFC 7725
0.5 / 2 / 5%: Advisory, probation, suspension

The detail

Screened before it serves

Archives are unpacked before publish; path traversal and decompression bombs are rejected. The page URL and every link in its HTML and SVG are checked against Google Safe Browsing, and a hit refuses the publish with a 422. Raster images and sampled video frames are classified for explicit content by OpenAI. That classifier is advisory: it flags for review, it never blocks a publish.

CSAM detection, then immediate suspension

Questions platforms ask

Which plan do I need?

Corporate. Platform tenancy is separate from API access: Business has the full v1 REST API and still gets 403 on the platform endpoints.

Do my end-users get their own account?

No. Each one is a subject of your account. Billing, quota and plan stay on your side.

Can my end-users bring a custom domain?

Not through the API today. Domain checkout and DNS verification are session-authenticated, with no API-key equivalent. Platform sites serve on their own upload.tf name.

Who gets billed, me or my end-users?

You, on one plan. The usage endpoint splits consumption per subject, so you can rebill.