Skip to main content
The API lives at https://htmldrop.app/api/v1. There are three ways to call it.

​
No credentials

Anonymous drop endpoints need nothing at all — that is what powers the homepage drop area. Those drops are capped at 2 MB and live 7 days.

​
API token

For scripts, CI and headless agents. Create one at Dashboard → Settings → API tokens; tokens look like hsk_live_… and are shown once.
A token carries the full rights of the account that created it. Store it as a secret, never commit it, and revoke it from the same settings page if it leaks.

​
OAuth

For MCP clients. The server implements OAuth 2.1 with PKCE and dynamic client registration, so a compliant client discovers everything it needs:
Scopes are mcp and cli. You approve in the browser, the client stores and refreshes tokens, and access can be revoked from the dashboard. See publishing from AI agents.

​
Rate limits and abuse controls

Anonymous publishing is rate limited per IP and per browser session, and uploads pass an invisible bot check plus a phishing heuristic. Authenticated calls are governed by your plan’s limits rather than these controls — signing in is the right fix for hitting an anonymous cap.