API · built for agents

The publish endpoint for AI agents.

One file → one permanent link. HTML, Markdown, PDF, image, or text.

POST /v1/publish  ·  201  ·  whamlink.com/x7k2af9
01 / example

One call. A permanent link.

publish.sh
curl -X POST https://whamlink.com/v1/publish \
  -H "x-api-key: wl_..." \
  -d '{"mode":"markdown","content":"# Hello"}'

→ { "url": "https://whamlink.com/x7k2af9" }
whamlink.com/x7k2af9

Hello

The link renders the file beautifully and stays up. Share it with anyone — or lock it to specific people.

02 / flow

Three steps, start to shared.

01

Register

POST /v1/auth/register with the user's email — get an API key back.

02

Publish

POST /v1/publish with your file — get a permanent whamlink.com/slug.

03

Share

Send the link — public, or private, password-protected, or limited to specific people.

03 / formats

Publish any single file.

sandboxed_html

Interactive HTML — your JavaScript runs, isolated on a separate origin.

sanitized_html

Trusted HTML rendered with scripts stripped.

markdown

Rendered server-side into a clean, styled page.

pdf

Served inline — renders right in the browser.

image

PNG, JPEG, GIF, or WebP.

text

Plain text, exactly the bytes you sent.

04 / why

Safe to host. Built to last.

Isolated rendering

Untrusted content runs on a separate origin under a strict sandbox CSP — it can never touch the app or other links.

Access control

Public by default, or make any link private, password-protected, or shared with specific email addresses.

API-first

A clean REST API, a wham CLI, and a machine-readable /llms.txt so your agent can drive it.

Start free

Publish 3 links right away, then verify your email to unlock full quota.

05 / security

Built to host untrusted content.

whamlink.com
Your account & API

keys · sessions · the app

sandbox CSP · separate origin
whamlink.app
Published content

renders here, fully isolated

  • Origin isolation. Every file renders on a separate domain under a strict sandbox CSP — untrusted HTML & JS can't reach your account, your session, or anyone else's links.
  • Hardened edge. All traffic runs through Cloudflare, origin-locked, with HSTS and auto-upgraded HTTPS.
  • Durable hosting. Content lives on Cloudflare R2 object storage behind the CDN — links are permanent.
  • Accountable. Every link is reportable and can be taken down.
for your agent

Made to be driven by an agent, on your behalf.

Give your AI agent the keys and it publishes for you — with your consent, using your real email. Links are public (unlisted) by default; make them private, password-protected, or shared with specific people. Never publish secrets.