# Free previews: a 7-day link, no account, a verified email

For agents and the people running them. Put a static build online at `https://<id>.clickedpreview.uk/` for 7 days. No account and no card: the human confirms their email once, by clicking a link. The human keeps the site by opening the `claimUrl` and buying a plan.

## Make one
With the `clicked` CLI ([cli.md](cli.md) says how to install it from clicked.cloud):

```sh
clicked preview ./out          # or ./dist; the folder with index.html at its root
# First time only: it asks for your email, emails you a link, and asks you to paste the pvt_ token the link's page shows.
# Preview: https://amber-otter-4821.clickedpreview.uk/
# Expires: 2026-11-15T10:00:00.000Z
# Keep it: https://clicked.cloud/pricing/?preview=amber-otter-4821
```

The token is saved to `~/.config/clicked/preview-token.json` (mode 0600) and lasts 30 days. An agent with no terminal prompt: `clicked preview ./out --email you@example.com` sends the link; ask the human for the token, then `clicked preview ./out --token pvt_…`.

With curl, from any shell. Once, to get a token:

```sh
curl -sS -H 'content-type: application/json' -d '{"email":"you@example.com"}' https://clicked.cloud/api/previews/verify
# → {"ok":true}. The human clicks the link in the email; the page shows the pvt_ token (once).
```

Then each upload (pipe or file both work):

```sh
COPYFILE_DISABLE=1 tar -C out -czf - . | curl -sS -H "Authorization: Bearer $PVT" --data-binary @- https://clickedpreview.uk/api/previews
```

The answer has `url`, `expiresAt`, `claimUrl` and a `deleteToken`. The delete token is shown once. The CLI saves it to `~/.config/clicked/previews.json` (mode 0600) and never prints it. Delete early with `clicked preview delete <id>`, or `curl -X DELETE -H "Authorization: Bearer $DELETE_TOKEN" https://clickedpreview.uk/api/previews/<id>`.

No token, or an expired one (30 days) or revoked one: `401 {"error":"verify_email", …}`. Verify again.

Tell the human: the link, the expiry date, and that the claim link keeps the site. Never print the `pvt_` token or the delete token back into chat.

## What works in a preview
Plain static files only. These extensions, and no others (anything else is refused with `file_type`):

`html css js mjs json txt xml svg png jpg jpeg gif webp avif ico woff woff2 ttf map webmanifest md`

So no `.htm`, `.php`, `.wasm`, `.pdf`, video or `.htaccess`. Limits: **25 MiB of files in total**, at most 300 files, paths up to 255 bytes, and `index.html` at the root. Every page gets a small "Free preview by clicked.cloud" banner.

## What doesn't (and why)
Previews are public, so they are locked down against phishing:
- **Nothing from a CDN.** Scripts, CSS, fonts, images and video from another site (Tailwind Play CDN, Google Fonts, jQuery from a CDN, analytics, hot-linked images) won't load. Put them in the build: self-host fonts, copy images in. A page could otherwise send what a visitor types to another site inside an image URL.
- **No remote iframes.** YouTube, Google Maps and other embeds won't show.
- **No forms that submit.** Forms can't post anywhere, and a form pointing at another site is refused.
- **No password fields** (or card-number autocomplete, or fields styled to look like one). The upload is refused.
- **No calls to other APIs.** Page JS can only fetch files from the preview itself.
- No PHP, no server code, no service workers, no popovers or modal dialogs.
- 10 previews an hour per address, and 10 an hour (30 a day) per verified email.

A refusal is `{"error":"<code>","detail":"<why>"}`, for example `verify_email`, `password_field`, `offsite_form`, `file_type`, `no_index` (you pointed at the folder above the build), `too_large`. Fix the build and upload again.

## Abuse
Anyone can report a preview with the **Report abuse** link in its banner; it goes offline at once. Every preview is linked to the email and IP address that made it, and a reported one is kept as evidence for a year. Uploading means accepting the [acceptable use policy](https://clicked.cloud/legal/acceptable-use/) (no adult content, no phishing, nothing illegal). Report anything else at https://clicked.cloud/report-abuse/ or abuse@help.clicked.cloud.

## Then make it real
Once the human has a plan, deploy the same folder to their domain: [quickstart.md](quickstart.md).