Artifact Publisher — Brainstorm Internal

How to use it

Say "publish this" or type /publish

Claude will check for your API key. First time, it'll ask you to authenticate.

publish this

I don't have your Brainstorm publisher API key yet. Visit files.brainstormtech.us/auth to sign in with your Brainstorm Google account — the page will give you a prompt to paste back here.

Authenticate — first time only

Visit the link, sign in with your @brainstormtech.io Google account, and paste the prompt the page gives you back into Claude. Takes about 30 seconds. Never needed again.

Claude publishes

Claude suggests a slug, asks how it should be protected (public, password, or email verification — open or restricted to specific people), and posts the artifact. You get a live URL immediately.

Got it. I'll publish this as files.brainstormtech.us/evandro/acme-proposal — does that work, or would you like a different slug?

files.brainstormtech.us/evandro/acme-proposal

Commands

/publish — publish the current artifact

Use the slash command /publish or just say "publish this", "make this live", "share this as a URL".

"show my files" — list published artifacts

Lists all your published artifacts with URLs, password status, expiry date, and last updated date. Say "show my files", "list my artifacts", or "what have I published".

"pull acme-proposal" — edit a published artifact

Fetches the artifact back into Claude as an editable artifact. Say "pull acme-proposal", "edit my voltlites-deck", or "bring back acme-proposal". After editing, say "publish this" to update the live URL — same slug, same URL.

"unpublish acme-proposal" — remove an artifact

Removes the artifact from its live URL. Say "unpublish acme-proposal" or "take down voltlites-deck". Claude will ask for confirmation before deleting — cannot be undone.

"set password on acme-proposal" — update password protection

Sets, changes, or removes a password on any artifact without republishing. Say "set password on acme-proposal", "lock voltlites-deck", "remove password from acme-proposal", or "unlock acme-proposal".

"set expiry on acme-proposal" — set or remove an expiry

Makes a link auto-expire after a set time. Say "set expiry on acme-proposal to 7 days", "expire voltlites-deck in 24h", or use an absolute date like "expire acme-proposal on June 1". To cancel an expiry, say "remove expiry from acme-proposal". You can also set an expiry when publishing: "publish this, expires in 30 days".

"gate acme-proposal with email" — email-verified access

Requires visitors to verify their email with a 6-digit code instead of typing a password. Say "gate acme-proposal with email" for open access (any email), or "restrict acme-proposal to alice@client.com" to allow only specific addresses or domains. Manage who has access with "add/remove <email> from acme-proposal" and "who has access to acme-proposal". Setting this clears any existing password, and vice versa.

"how many views does acme-proposal have" — analytics

See view count, last-visited date, and where traffic came from. For email-gated artifacts, also see exactly who's viewed it and when. Ask "how many views does acme-proposal have", "who's viewed acme-proposal", or "did anyone try to access acme-proposal without permission".

Features

Instant publishing — Publish anything Claude builds — HTML pages, JSON, CSV, or any standalone file — to a live URL in seconds. No setup, no deploy steps.

User-scoped URLs — Every artifact lives under your username. You own your slugs — no one else can overwrite them.

Password protection — Lock any artifact behind a password. Enforced server-side with a branded gate — no bypass.

Custom slugs — You choose the URL path. Republish to the same slug to overwrite silently.

Google SSO — One-time sign-in with your Brainstorm Google account. Your API key is stored in Claude memory — never typed again.

Multi-file publishing — Publish HTML alongside companion data files. Relative references like fetch('data.json') resolve correctly. Standalone files with no HTML entry point are served directly at their path.

File listing — View all your published artifacts, their URLs, and password status directly from Claude chat.

Pull & edit — Fetch any artifact back into Claude as an editable artifact. Update and republish — same URL, new content.

Unpublish — Remove a published artifact from its live URL at any time. Password hash is cleaned up automatically.

Update password in place — Set, change, or remove a password on any published artifact without republishing. Say "set password on <slug>" or "remove password from <slug>".

Expiry / TTL — Set a link to auto-expire after a set time. Accepts relative durations (7d, 24h, 30m) or an absolute date. Expired URLs return a branded 410 page. Say "expires in 7 days" when publishing, or "set expiry on <slug>" to update any artifact.

Email-confirmed access — Gate an artifact behind email verification instead of a password. Viewers enter their email and get a 6-digit code to type on the same page, valid for 5 minutes. Allow any email, or restrict to specific addresses or domains. One verified email unlocks every other email-gated artifact it's allowed on, and revoking access takes effect immediately.

Claude can read gated links — Paste any files.brainstormtech.us link into Claude and it reads it with your API key. You don't have to click through the gate. Email-gated artifacts open if your email is allowed. Password-protected ones open after you give Claude the password, and your own artifacts always open.

Analytics — See how many times each artifact has been viewed, when it was last visited, and where traffic came from. For email-gated artifacts, see exactly who's viewed it and when. Ask "how many views does <slug> have" or "who's viewed <slug>".

Roadmap

High value

Owner-only accessSecurity

Make an artifact visible only to yourself. Visitors are redirected to a Google sign-in — no password, no shared secret. Only the account that published the artifact can open it.

Team-only sharingSecurity

Restrict an artifact to @brainstormtech.io Google accounts only. Visitors sign in once via Google OAuth and get a 30-day session across all internal artifacts — no password to share or manage.

Client-branded slugsFeature

Publish under a client name instead of yours — files.brainstormtech.us/build-a-bear/proposal. Makes shared links feel more intentional.

Soft unpublish (archive)Feature

Take an artifact offline without deleting it. The URL stops working but the content stays in storage — pull it back or republish it any time.

File dashboardFeature

A web UI at files.brainstormtech.us showing all your published artifacts — browse, open, manage passwords and expiry, and unpublish without going through Claude chat.

Medium value

DuplicateFeature

Clone a published artifact to a new slug without pulling and republishing — useful for versioning or forking a starting point.

Version historyFeature

Keep the last N versions of an artifact. Roll back to any previous version with a single command.

Scheduled unpublishFeature

Set an artifact to come down automatically after a set number of days — no manual follow-up needed.

Artifact templatesFeature

Save a published artifact as a reusable starting point. Pull it as a blank template for new work without touching the original.

Long term

Cowork integrationFeature

Non-developers publish directly from Cowork without touching Claude chat at all.

Embed codeFeature

Generate an embed snippet so artifacts can be dropped directly into Notion, HubSpot, or the Client Portal.

Publish notificationsFeature

Automatically message a Slack channel or send an email when an artifact is published or updated — useful for letting clients or teammates know a deliverable is live.

Changelog

October 20, 2026

Email-gated artifacts now send a 6-digit code instead of a one-time link. Corporate mail scanners (like Microsoft Defender or Mimecast) open every link in an email to check it, which used up the link before the viewer could click it. Viewers ended up stuck re-entering their email
The code is typed on the same page, so viewers can read the email on their phone and type the code on their laptop. Phones and Gmail offer to fill or copy the code automatically
Codes expire after 5 minutes, work once, and stop working after 5 wrong tries. The code page has "Resend code" and "Use a different email" links
Each email can get one code a minute and 10 codes a day, across all artifacts. This stops anyone from guessing codes or flooding a client's inbox
A verified email now stays signed in for 7 days instead of 30
The "Send me a code", "Continue" and "Resend code" buttons now switch to "Sending…" or "Checking…" and can't be clicked again while the request is in flight

October 7, 2026

Claude can now read gated artifacts. Before, pasting a password- or email-protected link into Claude just failed with a 401, because Claude can't click through a gate. Now Claude reads it with your API key. Say "read <link>" or just paste the URL
Email-gated: opens if your Google email is allowed. It's the same rule as the email code, but you don't wait for an email
Password-gated: Claude asks for the password and sends it along with your key. Your own artifacts always open without one
Views made this way show up in the owner's analytics under your email
Serving routes now accept an optional Authorization: Bearer header and an X-Artifact-Password header. When a key is sent, failures come back as JSON (401 or 403 with gate) instead of the gate page

September 11, 2026

Fixed: clicking a magic link from an email client could bounce back to the gate instead of granting access — the session cookie needed SameSite=Lax, not Strict, to survive the redirect right after a cross-site link click
Fixed: an invalid or expired magic link now re-shows the email gate with an inline error instead of a dead-end page
Clicking the same magic link again after it already worked no longer errors — it just lets you back in if your session is still valid
Redesigned the magic-link email to match the Brainstorm design system instead of plain unstyled HTML
One-time announcement — the next time you publish, you'll see a note about the new email-gate feature (shown once per user, server-tracked, then never again)
Analytics — see how many times each artifact has been viewed, when it was last visited, and where traffic came from. Say "how many views does <slug> have" or "who's viewed <slug>"
For email-gated artifacts, analytics also show who's viewed it and when — say "who accessed <slug>" or "when did <email> view <slug>"
New endpoints: GET /files/<slug>/analytics and GET /<username>/<slug>/analytics; GET /files now includes view counts
Detailed analytics — a new GET /files/<slug>/analytics/events endpoint lists individual view events with exact timestamps, filterable to one person's history. Ask "when exactly did <email> view <slug>" or "list every blocked attempt on <slug>"
/my-files redesigned — shows Slug, Gate Type (Public / Password / Email (open) / Allowlist (N)), Views, and Last Updated instead of the old URL/Password/Expires columns
Views-over-time chart — asking for total views on an artifact now renders a day-by-day chart instead of a flat number. New GET /files/<slug>/analytics/timeseries endpoint backs it, up to a year of history
No URL column in /my-files in any rendering — an interactive table shows a copy-link control per row instead of a full URL taking up space
A general analytics request (e.g. "details for <slug>") now always shows the views-over-time chart alongside the text summary, not just the numbers
Fixed: publishing a new artifact never offered email verification as an access option — the publish question only asked "password or public?" even after that feature shipped. Now asks a structured choice (public / password / email verification, open / email verification, restricted) and applies the gate right after publishing

September 10, 2026

Email-confirmed access — gate an artifact behind email verification instead of a password. Viewers enter their email and get a one-time link that expires in 5 minutes
Open or allowlist mode — allow any email, or restrict to specific addresses/domains (e.g. @client.com)
One verified email unlocks every other email-gated artifact that accepts it, without a second link — say "who has access to <slug>", "add/remove <email> from <slug>"
Removing an email from an allowlist blocks access on the next request, even for a live session — allow up to a minute for the change to reach every edge location
New endpoints: POST /files/<slug>/allowlist, DELETE /files/<slug>/allowlist/<email>, GET /files/<slug>/allowlist

May 25, 2026

Expiry / TTL — set a link to auto-expire; accepts 7d, 24h, 30m, or an absolute date. Expired URLs return a branded 410 page
Update expiry in place — say "set expiry on <slug>" or "remove expiry from <slug>" without republishing
Expiry shown in file listing — /my-files now shows expiry date and flags expired artifacts
Renew API key — say "renew my API key" to rotate credentials; old key is immediately revoked
Update password in place — set, change, or remove a password on any artifact without republishing
New GET /files/<slug>/<filename> endpoint — fetch any companion file from a slug by name with your API key
Password-protected sub-files now redirect to the password gate instead of showing a bare 401
After authenticating, you're sent directly to the file you originally requested

May 21, 2026

Standalone file publishing — slugs no longer require an index.html
No-index fallback page when visiting a slug with no HTML entry point
"Remember me for 30 days" on the password gate
Improved Brainstorm wordmark on gate and no-index pages
Copy as Markdown button on this guide

May 20, 2026

File listing — see all published artifacts with URLs and password status
Pull & edit — fetch any artifact back into Claude as an editable artifact
Unpublish — remove an artifact from its live URL with confirmation

May 14, 2026

Google SSO — sign in with your Brainstorm account to get a personal API key
User-scoped URLs — every artifact lives under your username
Multi-file artifact support — publish HTML alongside companion data files

May 7, 2026

Initial launch — publish HTML artifacts to a live URL in seconds
Password protection with server-side enforcement
Custom slugs with silent overwrite on republish