List & delete drops

Returns the drops owned by the account, newest first. expires_at is null on subscriber drops, since those never expire.

{
"total": 12,
"drops": [
{
"slug": "launch-metrics-c2dse",
"url": "https://launch-metrics-c2dse.shipped.run/",
"name": "launch-metrics",
"file_count": 3,
"redeploy_count": 7,
"password_protected": false,
"created_at": "2026-06-02T09:14:00.000Z",
"updated_at": "2026-06-09T16:41:00.000Z",
"expires_at": null
}
]
}

Removes a drop. The <slug> is the subdomain part of the drop's URL — for launch-metrics-c2dse.shipped.run that's launch-metrics-c2dse.

{
"deleted": "launch-metrics-c2dse"
}

Attaches an anonymously deployed drop to your account. Every anonymous POST /deploy response carries a one-time claim_token (spc_…, shown once) — send it here and the drop becomes yours: listable, deletable, and redeployable on paid plans. Claiming extends the drop to the free-account lifetime of 90 days — including anonymous drops recovered during the 30 days after expiry, when they are offline but remain privately claimable.

{
"claim_token": "spc_7xk3m9q2vj8n4p1w6z5y0r2t"
}

{
"slug": "launch-metrics-c2dse",
"claimed": true,
"restored": false,
"expires_at": "2026-10-02T14:00:00.000Z",
"url": "https://launch-metrics-c2dse.shipped.run/"
}

Answers 403 on a wrong token, 409 when another account claimed the drop first, and 404 for unknown slugs, and 410 once the 30-day claim window has closed. Re-claiming a drop you already own is a no-op 200.

Brings an expired drop you own back online while its files are still retained (90 days past expiry). Free accounts restore up to 30 days past expiry and the drop comes back at the free 90-day lifetime; subscribers restore up to 90 days and the drop never expires again.

Answers 402 when the drop is too old for a free account (upgrade to restore), 410 once the files are purged for good, 409 on a concurrent state change (retry), and 404 for unknown or unowned slugs. Restoring a drop that is still live is a no-op 200.

Pageview analytics for a drop you own: all-time totals (within the 90-day retention window), the last 24 hours and 7 days, and a daily views series. Bots and crawlers are excluded; views count page loads of HTML pages, not raw asset requests. The same numbers power the stats dialog on the dashboard Drops page.

Free accounts get a 7-day history window (window_days); paid plans get 90 days plus top_referrers and top_paths (up to 5 entries each; a direct referrer means none was sent).

{
"slug": "vast-juice-c2dse",
"total": 128,
"last_24h": 9,
"last_7d": 41,
"window_days": 90,
"daily": [{ "day": "2026-08-21", "views": 12 }],
"top_referrers": [{ "label": "chatgpt.com", "views": 30 }],
"top_paths": [{ "label": "index.html", "views": 120 }]
}

Mints a new API key. This is the one route that requires a Firebase ID token from your dashboard session — existing sp_ keys can't mint new keys.

{
"accountId": "9f1c2c4e-7b2a-4f5e-a1d3-2c8b51b6f0aa",
"apiKey": "sp_QffDmo0uWxx_BKbZjjtSwdgPaksp58XTGgj0tsLZfhU",
"keyId": "8c1f4b2e6a9d35c7e0b8a2f41d6c9e3b5a7d0f82c4e6b1a39d5f7c0e2b4a6d81",
"note": "Shown once — store it. Send as 'Authorization: Bearer <key>' …"
}

Lists the keys on the account. Only metadata comes back — the secret itself is never returned, just the prefix so you can tell keys apart.

{
"keys": [
{
"id": "8c1f4b2e6a9d35c7e0b8a2f41d6c9e3b5a7d0f82c4e6b1a39d5f7c0e2b4a6d81",
"prefix": "sp_QffDmo0",
"created_at": "2026-05-28T11:02:00.000Z",
"last_used_at": "2026-06-10T07:55:00.000Z"
},
{
"id": "2f9e7c4b1a6d8e3c5b0a9f7d4e2c6b8a1d3f5e7c9b0a2d4f6e8c1b3a5d7f9e0c",
"prefix": "sp_b7Rt2wX",
"created_at": "2026-04-12T15:30:00.000Z",
"last_used_at": null
}
]
}

Revokes a key by its id (from GET /keys) — the id is the key’s SHA-256, 64 hex chars. Takes effect on the very next request.

{
"revoked": "2f9e7c4b1a6d8e3c5b0a9f7d4e2c6b8a1d3f5e7c9b0a2d4f6e8c1b3a5d7f9e0c"
}