# Quickstart: put a site live on clicked.cloud

For agents (Claude Code, Cursor, Codex) and the people running them. Your agent built it; this puts it live on the user's own clicked.cloud package, over SSH, on their domain.

**No account yet?** `clicked preview ./out` gives a free 7-day link at `https://<id>.clickedpreview.uk/`; claim it to keep it. It needs a verified email once (the human clicks a link). Static files only: nothing loaded from a CDN (scripts, CSS, fonts, images), no remote iframes, no forms, no password fields. See [previews.md](previews.md), which also has the curl version.

**No terminal (Claude on claude.ai or the Claude app)?** Connect `https://clicked.cloud/mcp` as a custom connector and use `publish_site`; see [mcp.md](mcp.md#publish-with-no-terminal-claude-on-the-web). People: https://clicked.cloud/get-started/

## What you need
- A clicked.cloud plan with at least one site (buy at https://clicked.cloud/; the human pays on Stripe).
- A way in: connect the MCP server (the person signs in with an emailed link, see [mcp.md](mcp.md)), or `clicked login`, or an API token from the dashboard's **Account → Security** tab (starts with `ck_`, shown once; store it as `CLICKED_TOKEN`).
- An SSH key on the site (see [ssh-keys.md](ssh-keys.md)). A new key takes about 10 minutes to work.
- `ssh` and `rsync` on the machine doing the upload.

## Ways in, today
| Way | Status | Setup |
|---|---|---|
| MCP server | any MCP client; OAuth sign-in | `claude mcp add --transport http --scope user clicked https://clicked.cloud/mcp`, then `/mcp` to sign in ([mcp.md](mcp.md)) |
| Claude Code plugin | from clicked.cloud | `/plugin marketplace add https://clicked.cloud/plugin/marketplace.json` then `/plugin install clicked@clicked` |
| `clicked` CLI | from clicked.cloud (Node 20+) | `npm install -g` the URL in https://clicked.cloud/cli/latest.json, then `clicked login` ([cli.md](cli.md)) |
| Plain ssh + rsync + the API | any agent with a shell | the commands below (needs a `ck_` token) |

## The deploy, in five steps
1. Build. Static export: Next `out/` (needs `output: 'export'`), Vite `dist/`, Astro `dist/`. PHP: the folder with `index.php`.
2. Check the folder has no `.env`, `.envrc`, `.dev.vars`, `*.pem`, `*.key` or private keys.
3. Upload to a new release folder: `releases/<RELEASE_ID>/` in the site's SSH home.
4. **Only if the upload succeeded** (both commands exited 0), activate that release. The site's domain now serves it. If the upload failed, stop and tell the human; a new SSH key can take about 10 minutes to start working.
5. Report the live URL. If it's wrong, roll back: the previous release goes live again.

## Plain ssh + rsync (no MCP, no CLI)
Get the site id, SSH user and host from `GET /api/sites` and `GET /api/sites/<id>` (or `site_details` over MCP). For `hartleysbakes.co.uk`:

```sh
TOKEN=$CLICKED_TOKEN SITE=<site id> TARGET=hartleysbakes.co.uk@ssh.gb.stackcp.com
RELEASE_ID=$(date -u +%Y%m%dT%H%M%SZ)
SSH='ssh -p 22 -o BatchMode=yes -o ConnectTimeout=15 -o StrictHostKeyChecking=accept-new'

$SSH $TARGET mkdir -p releases/$RELEASE_ID &&
rsync -az --exclude=.git -e "$SSH" ./out/ $TARGET:releases/$RELEASE_ID/ &&
curl -fsS -X POST https://clicked.cloud/api/sites/$SITE/releases -H "authorization: Bearer $TOKEN" \
  -H 'content-type: application/json' -d "{\"releaseId\":\"$RELEASE_ID\"}" &&
curl -fsS -X POST https://clicked.cloud/api/sites/$SITE/activate -H "authorization: Bearer $TOKEN" \
  -H 'content-type: application/json' -d "{\"releaseId\":\"$RELEASE_ID\"}"
```

The `&&` chain is the point: nothing is registered or activated unless the upload worked. Roll back with `POST /api/sites/<id>/rollback`.

## Rules for agents
- Only ever send a PUBLIC key (`*.pub`). Never read, print or upload a private key.
- Never open or pay a checkout. Hand the URL to the human.
- Confirm before anything destructive: removing a key, changing DNS, rolling back.
- Never activate a release you did not just upload successfully.
- Agents can't cancel, delete a site or move a domain away. Cancelling is the human's, in the dashboard; the rest goes to support@help.clicked.cloud.
- A token can't reset a mailbox password, change the profile or cards, or write to support either (`403 forbidden`). Ask the person to do it in the dashboard.
- A site or domain that isn't the user's answers 404. That's expected, not a bug to work around.

Help: support@help.clicked.cloud