---
title: "Deploy a drop (anonymous allowed)"
method: POST
path: "/deploy"
---

# Deploy a drop (anonymous allowed)

`POST /deploy`

## Request

- Base URL: `https://ship.page`
- URL: `https://ship.page/deploy`
- Auth: one of:
  - none
  - HTTP bearer

Body format is picked by Content-Type: `text/html` (or any non-JSON/non-zip type) stores the raw body as index.html; `application/json` expects a files map; `application/zip` unpacks an archive (single root dir auto-stripped). Limits: 100 files/request anonymous+free, 10,000 paid; zip 25 MB free / 100 MB paid (4× decompression cap); non-zip bodies 10 MB. Rate: 10 deploys/min per IP anonymous and free, 120/min per account on paid plans; 429 responses carry Retry-After: 60. To password-protect a drop, send X-Ship-Password with encodeURIComponent(password) and an active paid Pro/Team credential. Never send a password in the query string or files body. Omitting the header on a live named redeploy preserves protection; recreating an expired or purged named drop requires sending the password again. A top-level JSON password property is rejected. The /_ship/ namespace is reserved and cannot be uploaded; an empty header is invalid. Protected reads return 401 until the visitor unlocks in a browser and are never cached. Password creation/rotation returns 503 if billing cannot be verified.

## Query parameters

- `ttl` integer
- `name` string
- `email` string, email
- `agent` string

## Headers

- `X-Ship-Password` string

## Request body

- FilesBody
  - `files` object, required: Path → content map. Values are a string, or { encoding: "base64", content: string } for binary.

## Response `200`

Drop deployed.

- DeployResponse
  - `slug` string, required
  - `url` string, uri, required
  - `files` string[], required
  - `plan` 'free' | 'pro' | 'team', required
  - `expires_at` string, date-time, nullable, required: Null for drops that never expire (subscribers).
  - `name` string: Present when ?name= was used.
  - `replaced` boolean: Present when ?name= was used; true if an existing named drop was replaced.
  - `password_protected` boolean, required: Whether visitors must unlock the drop with a password.
  - `claim_token` string: One-time claim token, present only on anonymous deploys and shown exactly once. Anyone holding it can attach the drop to an account via POST /drops/{slug}/claim.
  - `claim_url` string, uri: Present on anonymous API and MCP deploys: a browser link that saves the drop to whichever account opens it. It carries the claim token, so keep it private.
  - `next_step` string: Present with claim_url: one sentence on keeping the page online, written to be passed on to the person the page was made for.
  - `claim_email` string, email: Present when ?email= was accepted on an anonymous deploy; the claim link was mailed to this address.

## Other responses

- `400`: Bad request — unparseable body, bad paths, invalid ttl/name, per-request file cap, invalid zip.
- `401`: Missing or invalid credential.
- `402`: Subscriber-gated feature on a free account. The body's `hint` and `upgrade_url` tell the user how to upgrade.
- `413`: Payload too large — a non-zip body over 10 MB, a zip over the plan cap or past its 4× decompression ceiling, or the 10,000-file drop total.
- `429`: Rate limited. Back off per the Retry-After header (60s).
- `503`: Required backend unavailable. Password creation and rotation fail closed when billing cannot be verified; retry later.

## Changes

- **2026-10-20** `99aad34506e8`: 84 warning, 2 info
  - added the new `already_live` enum value to the `code` response property for the response status `400`
  - added the new `already_live` enum value to the `code` response property for the response status `401`
  - added the new `already_live` enum value to the `code` response property for the response status `402`
  - added the new `already_live` enum value to the `code` response property for the response status `413`
  - …82 more

[Operation history](https://skmtc.dev/ship/apis/ship-page/changes/deploy/post.md)

---

[API](https://skmtc.dev/ship/apis/ship-page.md) · [All operations](https://skmtc.dev/ship/apis/ship-page/llms.txt) · [OpenAPI document](https://skmtc.dev/ship/apis/ship-page/revisions/99aad34506e8?raw)