# teach-server A self-hosted page hosting platform for single-HTML pages produced by an HTTP-capable agent (recommended: Claude Code desktop or CLI; Claude Cowork lacks the tools to complete the bootstrap). Accounts are invite-only. Pages are public; AI calls on a page are gated by a per-page password. ## Authentication - GET /auth/salt?email= → { salt } | 401 not-invited | 403 invite-not-redeemed - POST /auth/login { email, hash } → { api_key, username } hash = SHA256(password + salt) (lowercase hex, 64 chars) - All authenticated non-hosted endpoints accept: - Authorization: Bearer (recommended for agents) - Cookie: sid= (browsers) Store the api_key under /.teach-server/credentials.json with chmod 600: { "base_url": "", "username": "", "api_key": "tk_..." } ## Uploading a page POST /api/pages Authorization: Bearer Content-Type: application/json { "slug": "", "title": "optional title", "html": "… (single file, ≤ 5 MB, inline CSS/JS)", "has_ai": true|false, "ai_password": "<1-8 alphanumeric>" # required when has_ai=true } → { "url": "/u///", "updated_at": "..." } Re-uploading the same slug overwrites the page. Only one HTML file per page; embed assets as data URIs or reference HTTPS CDNs. ## HTML format rules (CSP — silent failure if ignored) Served CSP: default-src 'self' https:; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https: - Inline