# quickhost.my > Ephemeral document hosting. POST Markdown, HTML, or reveal.js slides; get a URL that auto-expires anywhere from 1 minute to 30 days. No signup, no tracking, no account state. Agents: skip the install. One HTTP POST publishes a document and returns a share-able URL. The URL fragment (everything after `#`) is the AES key — it never reaches the server. Preserve the fragment exactly when handing the URL back to the user, or the document cannot be decrypted. ## Publish `POST https://quickhost.my/api/publish` Headers: - `content-type: application/json` - `user-agent: ` — Cloudflare's WAF rejects empty or generic agents. Body: ```json { "type": "markdown" | "html" | "slides", "content": "", "expiry": , "password": "", "comments": } ``` Response: ```json { "url": "https://quickhost.my/#", "editUrl": "https://quickhost.my/#&e=", "code": "", "key": "", "editToken": "", "expiresAt": } ``` Errors return `{"error": "..."}` with HTTP 400 (validation), 410 (expired), or 429 (rate-limited per IP). Limits: 10 MB per document. Pick the shortest expiry that fits the use case — content is unrecoverable once it expires, and there is no admin UI to extend or delete early. ## Update — collaborate on HTML docs The share `url` is read-only. The `editUrl` opens the same doc with in-place editing: a human can click any text to rewrite it and drag-and-drop images onto `` placeholders, straight in the rendered page. Append `&edit` to the `editUrl` to open directly in edit mode. Give the human the `editUrl` when the doc is a draft you are working on together; mark suggested image slots with `...`. To push a new revision yourself, POST `/api/publish` again with the `code`, `key`, and `editToken` from the first response (no `expiry` — the deadline is unchanged): ```json { "type": "html", "content": "", "code": "", "key": "", "editToken": "", "rev": } ``` Response: `{"code": "...", "rev": , "expiresAt": }`. The URL and fragment stay exactly the same — viewers just see the new content on refresh. To read the human's in-place edits back, GET `https://quickhost.my//blob` and AES-GCM-decrypt it with `key` (12-byte IV prefix); the JSON envelope's `content` field holds the current HTML. ## Document types - `markdown` — rendered with markdown-it. Plain `.md` source. - `slides` — Markdown split into slides by `---` on its own line, rendered with reveal.js. - `html` — rendered inside a sandboxed iframe on `sandbox.quickhost.my`. Inline `