Deploy

SkillSafe for agents

Build SkillSafe apps with your coding agent

This is the entry point for agent interactions with the SkillSafe app platform. Your agent deploys hosted mini-apps to your-name.skillsafe.ai over the platform HTTP API — scanned, sandboxed, and free to start.

Point your agent here

Give your coding agent (Claude Code, Cursor, Windsurf, …) the machine-readable guide:

https://deploy.skillsafe.ai/llms.txt

then ask it to build. Everything below is what the agent will do for you.

No account needed to start: the agent mints a 7-day temp key with a single call (POST /v1/auth/temp-key) and deploys instantly — verify your email within 7 days to keep the app. Already signed up? Use a key from skillsafe.ai/account/keys, or let the agent open the sign-in device flow. All three paths are in the guide.

The flow

Four calls against this host (or api.skillsafe.ai — same API), authenticated with Authorization: Bearer $SKILLSAFE_API_KEY.

# 0. Who am I / what do I own
curl https://deploy.skillsafe.ai/v1/creator/me \
  -H "Authorization: Bearer $SKILLSAFE_API_KEY"

# 1. Save the app's agent prompt (SKILL.md) as a skill in your namespace
#    POST /v1/skills/@{you}/{name} — multipart: SKILL.md + metadata

# 2. Create the app from that skill
curl -X POST https://deploy.skillsafe.ai/v1/apps \
  -H "Authorization: Bearer $SKILLSAFE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"slug":"my-app","skill_id":"skl_...","title":"My App"}'

# 3. Upload the frontend — security-scanned before it goes live
curl -X POST https://deploy.skillsafe.ai/v1/apps/my-app/releases \
  -H "Authorization: Bearer $SKILLSAFE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"files":[{"path":"index.html","content":"..."}]}'

# 4. Optional: publish to the public app directory
curl -X PATCH https://deploy.skillsafe.ai/v1/apps/my-app \
  -H "Authorization: Bearer $SKILLSAFE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"visibility":"public"}'

The app is live at https://my-app.skillsafe.ai/ after step 3. Full request/response shapes: llms.txt.

What apps can do

Platform capabilities, all documented in llms.txt:

Hosting

Static bundles served at your subdomain under a strict CSP. Every release is security-scanned; critical findings block it.

Users & sign-in

Guest and SkillSafe SSO identity out of the box — per-user data and balances with no user table to build, plus opt-in profile and email-notification scopes.

Database

Declared JSON collections with per-collection ACLs, typed fields, a query DSL, and vector similarity search over embedded fields — no backend to run.

Files & vision

R2-backed per-user file storage with signed URLs — and uploaded images attach straight to agent runs as model vision input.

AI agent runs

Users run your app's agent (its SKILL.md) on metered credits — cheap default model with Claude/GPT upgrades, cost estimates, SSE streaming, and multi-turn sessions.

Payments

Sell for SkillSafe credits: idempotent purchases, recurring subscription plans, and owner-sponsored free usage with daily budgets.

Server functions

Ship functions/index.mjs to run an isolated worker at /api/* with an egress allowlist (not yet enabled in production — see the guide).

Owner tools

Release history with preview hosts and one-call rollback, a resource dashboard, scoped CI deploy tokens, and custom domains.

Reference