Automate a controlled Local-to-Live deployment.

Quickstart

Deploy a ZIP in three requests.

Use an existing Sitedropper account. Public API registration is currently disabled, and REST JWTs are separate from MCP OAuth access tokens.

curl --fail-with-body -X POST "https://api.sitedropper.com/api/v1/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"your-password"}'

{
  "token": "<jwt>",
  "expires_at": "<ISO-8601 timestamp>",
  "user": { "email": "[email protected]" }
}

export SITEDROPPER_API="https://api.sitedropper.com"
export SITEDROPPER_TOKEN="<token from login response>"

curl --fail-with-body -X POST "$SITEDROPPER_API/api/v1/local-to-live" \
  -H "Authorization: Bearer $SITEDROPPER_TOKEN" \
  -F "[email protected]" \
  -F "name=studio" \
  -F "visibility=draft"

{
  "action": "local_to_live_queued",
  "project": { "url": "https://studio.apps.sitedropper.com" },
  "operation": { "id": "<operation-id>", "status": "running", "progress": 5 },
  "next_step": "poll the parent operation until it finishes"
}

export OPERATION_ID="<operation.id from deploy response>"

curl --fail-with-body \
  -H "Authorization: Bearer $SITEDROPPER_TOKEN" \
  "$SITEDROPPER_API/api/v1/operations/$OPERATION_ID"

Authentication

Use a REST JWT only for server-side automation.

• Send Authorization: Bearer <token> on every protected request.
• Keep credentials and tokens out of source archives, browser JavaScript, logs, and Analytics.
• REST tokens currently expire without a refresh-token flow; authenticate again after expiration.
• Logout is stateless and does not revoke an issued token, so protect it for its full lifetime.
• Never substitute an MCP OAuth token for a REST JWT.

Large uploads

Keep archive transfer separate from API authentication.

Create an authenticated upload session when an agent or external uploader should send a ZIP without receiving your REST token. The returned upload_url is short-lived, one-time, and itself a credential.

curl --fail-with-body -X POST "$SITEDROPPER_API/api/v1/upload-sessions" \
  -H "Authorization: Bearer $SITEDROPPER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "studio",
    "visibility": "draft",
    "filename": "site.zip",
    "runtime": "static",
    "framework": "static",
    "skip_build": true,
    "root_directory": "."
  }'

export UPLOAD_URL="<upload_url from session response>"

curl --fail-with-body -X POST "$UPLOAD_URL" \
  -F "[email protected]"

New-project upload sessions cannot carry environment variables or an access password. Create the project first or use the authenticated Local-to-Live endpoint when those values are required.

Asynchronous work

Follow the parent operation to a terminal state.

Queued work can report queued, running, succeeded, failed, or canceled. The operation detail also includes child state, build-log context, queue information, maybe_stuck, and a recommended next step when available.

Poll with bounded backoff. Stop when the parent operation reaches a terminal state; inspect its guidance before using cancel or retry.

Reference

Core endpoint map.

Every protected route is account-scoped by the JWT. Project resources additionally verify that the project belongs to the authenticated account.

Read the complete repository-backed endpoint reference →

Errors and current limits

Handle the status before reading the body.

Errors generally use {"error":"message"}. Plan restrictions can also include machine-readable code, feature, plan, required_plan, limit, and usage fields.

Archive size and runtime support depend on deployed configuration. Do not assume databases, persistent volumes, cron jobs, background workers, multi-container applications, runtime log retrieval, custom domains, or rollback controls are available.