API

Deploy sites with code

The Supadrop API lets you deploy and manage static sites programmatically. Upload a file, get a live URL. Perfect for CI/CD pipelines, scripts, and automation.

Base URL https://app.supadrop.host/api/v1

Use with your AI coding tool

Download a ready-to-use skill file containing the full Supadrop API reference. Drop it into your project and your AI assistant will know every endpoint, parameter, and error code.

Works with Claude Code Cursor Codex Windsurf Copilot Open-code

Download skill.md

Or point your tool directly at https://supadrop.host/supadrop-skill/skill.md

Overview

The API gives you full control over your Supadrop sites. List, create, update, and delete sites with simple HTTP requests. Every response is JSON. Authentication uses Bearer tokens.

API access is available on Pro and Large plans. The Free and Starter plans do not include API access.

Authentication

All /api/v1/* endpoints require a Bearer token in the Authorization header:

Authorization: Bearer sk_live_a1b2c3d4...

Getting an API key

Go to Account Settings in your dashboard
Under API Access, click Generate API key
Copy the key immediately. It is shown only once.

Each account can have one active API key. To get a new one, revoke the existing key first.

Key format

Keys follow the pattern sk_live_ followed by 64 hex characters (72 characters total):

sk_live_a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef12345678

The dashboard shows a masked prefix like sk_live_a1b2c3d4... for identification.

Authentication errors

Status	Message	Cause
`401`	Missing or invalid Authorization header	Header absent or not `Bearer ...`
`401`	Invalid API key format	Key doesn't match expected pattern
`401`	Invalid API key	Key not found in database
`403`	API access requires a paid plan	Account is on Free tier
`403`	Account suspended	Account banned by admin
`403`	Account deleted	Account marked for deletion
`422`	Your subscription has expired	Subscription status is EXPIRED

Rate limiting

Requests are limited to 60 per minute per API key.

Every authenticated response includes rate limit headers:

Header	Description
`X-RateLimit-Limit`	Maximum requests per window (60)
`X-RateLimit-Remaining`	Requests remaining in current window
`X-RateLimit-Reset`	Unix timestamp (seconds) when the window resets

When the limit is exceeded, the API returns 429 Too Many Requests.

Response format

All endpoints return JSON. Site objects use this shape:

{
  "id": "uuid",
  "slug": "my-site",
  "name": "My Site",
  "file_name": "site.zip",
  "file_size": 102400,
  "status": "DEPLOYED",
  "created_at": "2026-06-17T10:00:00.000Z",
  "deployed_at": "2026-06-17T10:00:01.000Z",
  "url": "https://my-site.supadrop.site"
}

Status values

Status	Meaning
`PROCESSING`	File queued for processing
`DEPLOYED`	Site is live
`SUSPENDED`	Content flagged by automated scanner
`FAILED`	Processing failed

Error responses

{
  "statusCode": 400,
  "statusMessage": "Slug must contain only lowercase letters, numbers, and hyphens"
}

Endpoints

GET /api/v1/sites

Returns all sites owned by the authenticated user, newest first.

Response `200`

{
  "sites": [
    {
      "id": "...",
      "slug": "my-site",
      "name": "My Site",
      "file_name": "site.zip",
      "file_size": 102400,
      "status": "DEPLOYED",
      "created_at": "2026-06-17T10:00:00.000Z",
      "deployed_at": "2026-06-17T10:00:01.000Z",
      "url": "https://my-site.supadrop.site"
    }
  ]
}

Example

curl https://app.supadrop.host/api/v1/sites \
  -H "Authorization: Bearer sk_live_YOUR_KEY"

GET /api/v1/sites/{slug}

Returns a single site by slug.

Parameters

Parameter	In	Required	Description
`slug`	path	yes	The site slug

Response `200`

{
  "site": {
    "id": "...",
    "slug": "my-site",
    "name": "My Site",
    "file_name": "site.zip",
    "file_size": 102400,
    "status": "DEPLOYED",
    "created_at": "2026-06-17T10:00:00.000Z",
    "deployed_at": "2026-06-17T10:00:01.000Z",
    "url": "https://my-site.supadrop.site"
  }
}

Errors

Status	Message
`400`	Missing slug
`404`	Site not found

Example

curl https://app.supadrop.host/api/v1/sites/my-site \
  -H "Authorization: Bearer sk_live_YOUR_KEY"

POST /api/v1/sites

Deploy a new static site. Send the file as multipart form data.

Parameters

Field	In	Required	Description
`file`	form	yes	The file to deploy (ZIP, HTML, PDF, or image)
`slug`	form	no	Custom slug. Auto-generated from filename if omitted.
`name`	form	no	Display name. Derived from slug if omitted.

Slug rules

3 to 63 characters
Lowercase letters, numbers, and hyphens only
Must start and end with a letter or number
Pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
Some slugs are reserved (e.g. api, admin, www)

If omitted, the slug is generated from the filename (e.g. portfolio.zip becomes portfolio). If that slug is taken, a suffix is appended (portfolio-2, portfolio-3, etc.).

Accepted file types

MIME type	Detected as
`application/zip`, `application/x-zip-compressed`	zip
`text/html`	html
`application/pdf`	pdf
`image/jpeg`, `image/png`, `image/webp`, `image/gif`, `image/svg+xml`	image

Response `201`

{
  "site": {
    "id": "...",
    "slug": "my-site",
    "name": "My site",
    "file_name": "my-site.zip",
    "file_size": 102400,
    "status": "DEPLOYED",
    "created_at": "2026-06-17T10:00:00.000Z",
    "deployed_at": "2026-06-17T10:00:01.000Z",
    "url": "https://my-site.supadrop.site"
  }
}

The status field may be PROCESSING if the file was queued for async processing. Poll GET /api/v1/sites/{slug} until it becomes DEPLOYED.

Errors

Status	Message
`400`	Multipart form data required
`400`	File is required
`400`	Unsupported file type
`400`	Slug must contain only lowercase letters, numbers, and hyphens
`400`	This slug is reserved
`400`	This slug is not available
`403`	Site limit reached
`403`	Storage limit exceeded
`403`	Your account is under review
`409`	Slug already taken

Examples

# Deploy a ZIP archive
curl -X POST https://app.supadrop.host/api/v1/sites \
  -H "Authorization: Bearer sk_live_YOUR_KEY" \
  -F "file=@./dist.zip" \
  -F "slug=my-portfolio"

# Deploy a single HTML file (auto-generated slug)
curl -X POST https://app.supadrop.host/api/v1/sites \
  -H "Authorization: Bearer sk_live_YOUR_KEY" \
  -F "file=@./resume.html"

PUT /api/v1/sites/{slug}

Replace the files of an existing site. The slug and URL stay the same.

Parameters

Parameter	In	Required	Description
`slug`	path	yes	The site slug
`file`	form	yes	The new file to deploy

Response `200`

{
  "site": {
    "id": "...",
    "slug": "my-site",
    "name": "My Site",
    "file_name": "dist-v2.zip",
    "file_size": 204800,
    "status": "DEPLOYED",
    "created_at": "2026-06-17T10:00:00.000Z",
    "deployed_at": "2026-06-17T10:05:00.000Z",
    "url": "https://my-site.supadrop.site"
  }
}

Errors

Status	Message
`400`	Missing slug
`400`	Multipart form data required
`400`	File is required
`403`	Storage limit exceeded
`403`	Your account is under review
`404`	Site not found

Example

curl -X PUT https://app.supadrop.host/api/v1/sites/my-portfolio \
  -H "Authorization: Bearer sk_live_YOUR_KEY" \
  -F "file=@./dist-v2.zip"

DELETE /api/v1/sites/{slug}

Permanently delete a site. Removes all files from storage and frees the slug.

Parameters

Parameter	In	Required	Description
`slug`	path	yes	The site slug

Response `200`

{
  "deleted": true,
  "slug": "my-site"
}

Errors

Status	Message
`400`	Missing slug
`404`	Site not found

Example

curl -X DELETE https://app.supadrop.host/api/v1/sites/my-portfolio \
  -H "Authorization: Bearer sk_live_YOUR_KEY"

Common error codes

Status	Meaning
`400`	Bad request (invalid input, missing fields)
`401`	Authentication failed
`403`	Forbidden (tier limit, account issue)
`404`	Resource not found
`409`	Conflict (slug already taken)
`422`	Subscription expired
`429`	Rate limit exceeded
`500`	Server error

Tier limits

Tier	Max sites	Max storage	Price
Pro	10	5 GB	$15/mo
Large	30	20 GB	$30/mo

When a limit is reached, the API returns 403 with a descriptive message.

Quick start

Four commands to deploy, check, update, and delete a site:

# 1. Deploy a site
curl -X POST https://app.supadrop.host/api/v1/sites \
  -H "Authorization: Bearer sk_live_YOUR_KEY" \
  -F "file=@./site.zip" \
  -F "slug=demo"

# 2. Check it's live
curl https://app.supadrop.host/api/v1/sites/demo \
  -H "Authorization: Bearer sk_live_YOUR_KEY"

# 3. Update with a new version
curl -X PUT https://app.supadrop.host/api/v1/sites/demo \
  -H "Authorization: Bearer sk_live_YOUR_KEY" \
  -F "file=@./site-v2.zip"

# 4. Delete when done
curl -X DELETE https://app.supadrop.host/api/v1/sites/demo \
  -H "Authorization: Bearer sk_live_YOUR_KEY"

Your site is available at https://demo.supadrop.site as soon as the status is DEPLOYED.

Ready to automate?

Generate your API key in the dashboard and start deploying with code.

Go to dashboard

Deploy sites with code

Use with your AI coding tool

Overview

Authentication

Getting an API key

Key format

Authentication errors

Rate limiting

Response format

Status values

Error responses

Endpoints

Response 200

Example

Parameters

Response 200

Errors

Example

Parameters

Slug rules

Accepted file types

Response 201

Errors

Examples

Parameters

Response 200

Errors

Example

Parameters

Response 200

Errors

Example

Common error codes

Tier limits

Quick start

Ready to automate?

Response `200`

Response `200`

Response `201`

Response `200`

Response `200`