Quickstart

No Cloudflare account is required. The fastest path is a browser upload to Shiplet-managed static hosting.

1. Open the Prepare page

Open the Shiplet app and complete Shiplet sign-in when asked. A first-time account receives a default workspace and sign-in returns you to the Prepare page.

2. Upload a harmless artifact

Keep Upload files selected, then choose one or more supported files: HTML, CSS, JavaScript, images, PDFs, video, audio, or text. The browser upload does not preserve nested directory paths. Use the source-checkout CLI for folders, or select URL when the artifact already has a public preview origin.

Supported extensions: html, htm, css, js, mjs, json, map, md, txt, csv, avif, gif, heic, heif, ico, jpeg, jpg, png, webp, pdf, aac, flac, m4a, mp3, oga, ogg, wav, mov, mp4, ogv, webm, otf, ttf, woff, woff2, and webmanifest. SVG is intentionally rejected because it can contain active script. Convert trusted vector art to PNG, WebP, or AVIF before upload.

Name the artifact and choose its review subdomain. Before publishing, decide who may see it:

• Organization is the safe default for an internal review.
• Private is limited to owners, administrators, and explicit grants.
• Anyone with an unlisted link can open an Unlisted review.
• Public allows anonymous access and may be discovered.

For internal work, organization is the safe default before you publish.

View access never grants edit access. Confirm the visibility, then select Prepare for review.

3. Open the managed review

Open the returned review URL. The trusted review host keeps artifact and widget code separate from reviewer credentials. Leave a harmless comment, then confirm it appears on the Shiplet detail page or global Feedback view.

Read Review feedback for collaboration and Access control before sharing the URL.

After publishing

Published on Shiplet-managed hosting. No Cloudflare account was required. You can move a validated revision to infrastructure you own later.

The review URL, feedback, access policy, and revision history remain attached to the same Shiplet. Continue reviewing now; evaluate customer-owned deployment only when direct infrastructure ownership becomes useful.

Optional: automate with MCP

async () =>
  await codemode.request({
    method: "POST",
    path: "/api/shiplets",
    body: {
      name: "Prototype review",
      subdomain: "prototype-review",
      visibility: "organization",
      assets: [{
        path: "index.html",
        content: "PCFkb2N0eXBlIGh0bWw+PGgxPlByb3RvdHlwZTwvaDE+"
      }]
    }
  });

Open the returned review URL. Interactive MCP should use browser OAuth. Organization API keys are for CI and other non-interactive workloads.

Troubleshooting

Problem	Safe recovery
A rejected file	Remove the reported unsupported or oversized file and prepare again. For nested folders, use the source-checkout CLI. No partial Shiplet is published.
The subdomain is unavailable	Choose another lowercase, hyphenated review name; never reuse an unrelated tenant URL.
The publish fails	Keep the local artifact, retry after the reported prerequisite recovers, and do not treat a missing review URL as success.
Sign-in or access is denied	Return through Shiplet sign-in with the exact invited email, or ask an owner for the narrow viewing grant. Never widen visibility just to bypass access.
An external URL cannot load	Confirm it is public HTTPS on a standard port and does not redirect to a private address. The managed proxy sends only safe GET or HEAD requests.
Review controls are unavailable	Reload the trusted review URL and sign in if asked. The artifact remains governed by its selected visibility.

Next: learn how packages and immutable revisions work, or review the optional customer-owned path.