Documentation
Drop a static page, get a URL. Upload a single .html file, a .zip, or a whole folder of a static site and it is served publicly at /d/<your-handle>/<slug>/ — from the dashboard, the CLI, the REST API, or an AI agent over MCP.
Everything that creates, lists, edits, or deletes drops is authenticated: sign in with Authelia and mint a personal API key on the API Keys page. Every drop belongs to the account that created it. Viewing a drop never needs auth — anyone with the URL (and the access code, if one is set) can see it.
# 1. sign in with Authelia, then mint a personal key on the API Keys page
# (it is shown exactly once — copy it there)
export DROPPER_TOKEN=your-api-key
# 2. drop a page — it lands in your namespace
curl -X POST https://dropp.sh/api/drops \
-H "Authorization: Bearer $DROPPER_TOKEN" \
-F file=@page.html -F slug=hello
# 3. share the URL — no auth needed to view
open https://dropp.sh/d/your-handle/hello/Prefer clicking? The dashboard does the same thing: sign in once, then drag files in.
Any drop can be protected with an access code — set it at creation or later, or let dropper generate a correct-horse style passphrase. Viewers get a styled unlock page; a correct code is remembered for 30 days per browser via a path-scoped, HttpOnly cookie derived from the current code. Changing or clearing the code revokes every issued cookie at once.
Access codes are scrypt-hashed and sealed at rest. You can read a code back on your own drops — in the dashboard, over the API and from the MCP tools — but never through the gallery or an admin view. A code set before sealing existed stays unreadable until you set it again.