Wordy Page agent mode

Agent mode is the agent-facing side of Wordy Page. People use the editor; AI agents send finished HTML and CSS. Both share the same accounts, My pages, addresses (wordy.page/your-name/) and free hosting.

No visual limits: any layout, any styling. Agent mode only does visual publishing and outgoing links. There are no scripts, forms, embeds, file or image uploads, and no outside images. Photos come only from the Wordy image library (Unsplash), by photo ID.

1. Get a personal key

Sign in on My pages with your email (one-tap link), then create a key here. Keys are shown once, stored only as a hash, and can be revoked at any time. A key publishes as you: its pages show up in My pages.

Loading…

Send the key with every request: Authorization: Bearer wpk_… (or X-API-Key: wpk_…). Never put a key in a published page or a public repo.

Apps with OAuth: MCP clients such as ChatGPT or Claude can connect without a key. Add https://wordy.page/mcp/auth; the app sends you here to sign in and approve it (OAuth 2.1 with PKCE, discovery at /.well-known/oauth-protected-resource). Approved apps are listed under Connected apps above, where you can disconnect them.

2. The API

One endpoint: POST https://wordy.page/agent.php with a JSON body {"action": "…", …}. Every answer is JSON with "ok": true|false; on errors read "error" (and "field" when one input is at fault).

action	inputs	does
`whoami`		checks the key and returns the limits
`check`	`slug`	is `wordy.page/slug/` free (or already yours)?
`photos`	`q`, `page` (1–5)	searches the image library; returns photo IDs, thumbnails, alt text and photographer
`publish`	`slug`, `title`, `html` or `pages`, `css`, `description`, `lang`, `from`	creates or replaces the whole site; `from` moves it from an old slug
`get`	`slug`	returns the HTML/CSS you last sent, so you can edit and republish
`list`		all pages in the account (editor and agent mode)
`unpublish`	`slug`, `confirm: true`	removes an agent mode page for good

Publish a page

curl -s https://wordy.page/agent.php \
  -H "Authorization: Bearer $WORDY_KEY" -H "Content-Type: application/json" \
  -d '{"action":"publish","slug":"lantern-hill-bakehouse","title":"Lantern Hill Bakehouse",
       "description":"Sourdough, pastries and coffee in the hills.",
       "css":"body{margin:0;font-family:Georgia,serif;background:#fbf6ef;color:#2b2118} .hero{min-height:60vh;background:photo(2Hzmz15wGik) center/cover;display:grid;place-items:center} .hero h1{color:#fff;font-size:3rem;text-shadow:0 2px 12px #0008}",
       "html":"<header class=\"hero\"><h1>Lantern Hill Bakehouse</h1></header><main><p>Fresh bread daily.</p><a href=\"https://maps.google.com/?q=Lantern+Hill+Bakehouse\">Find us</a></main>"}'

{"ok": true, "slug": "lantern-hill-bakehouse", "url": "https://wordy.page/lantern-hill-bakehouse/",
 "pages": ["https://wordy.page/lantern-hill-bakehouse/"], "photos": ["2Hzmz15wGik"], "removed": [], "mode": "agent"}

removed lists anything the safety filter took out (for example removed <script>), so you can fix your HTML and resend.

Several pages

{"action":"publish","slug":"lantern-hill-bakehouse","title":"Lantern Hill Bakehouse","css":"…",
 "pages":[
  {"title":"Home","html":"<h1>Welcome</h1><a href=\"/lantern-hill-bakehouse/menu/\">Menu</a>"},
  {"path":"menu","title":"Menu","description":"Breads and pastries","html":"<h1>Menu</h1>…"}]}

The first page is the home page. Others live at /slug/path/. CSS is shared by all pages. Publishing replaces the whole site.

Images by ID

{"action":"photos","q":"sourdough bread"}
→ {"ok":true,"results":[{"id":"Bkci_8qcdvQ","thumb":"https://images.unsplash.com/…","alt":"…","name":"…"}, …]}

HTML: <img data-photo="Bkci_8qcdvQ" alt="Fresh loaf">. Wordy fills in src, size and lazy loading.
CSS: background-image: photo(Bkci_8qcdvQ)
Inline <svg> is welcome for icons, logos and illustrations (see section 3). Any other image (src, url(), data URIs, SVG <image>) is removed. Photographer credit is added to the page footer automatically, as Unsplash requires.

3. What is allowed

Allowed	Text and layout elements (headings, paragraphs, lists, tables, `section`, `div`, `span`, `details`, `figure`…), `class`, `id`, `style`, `aria-*`; a stylesheet in `css`; links to `https://`, `http://`, `mailto:`, `tel:`, `#anchors` and `/same-site/` paths.
Inline SVG	`svg`, `g`, `path`, `circle`, `ellipse`, `rect`, `line`, `polyline`, `polygon`, `text`, `tspan`, `defs`, `linearGradient`, `radialGradient`, `stop`, `clipPath`, `mask`, `pattern`, `symbol`, `use`, `title`, `desc` with presentational attributes (`viewBox`, `d`, `fill`, `stroke`, `transform`…). References must stay in the page: `href="#id"`, `fill="url(#id)"`. Example: `<svg viewBox="0 0 24 24" width="48"><circle cx="12" cy="12" r="10" fill="#2563eb"/></svg>`
Removed	Scripts and event handlers (`on…=`), `<style>` inside html (use `css`), iframes, embeds, objects, forms and inputs, video/audio, canvas, SVG `<foreignObject>`/`<image>`/animation elements and outside or `data:` SVG references, outside images, CSS `url()`/`@import`/`@font-face`, `javascript:` links.
Enforced	Each page is served with a Content-Security-Policy that blocks scripts, forms and every image host except the library. External links open in a new tab with `rel="noopener nofollow ugc"`.

4. Limits

HTML: 200,000 characters per page. CSS: 50,000 characters. Request: 2 MB.
Up to 10 pages per site and 30 library photos per site.
600 API requests per hour per account. Up to 10 keys per account.
Addresses: 3–40 lowercase letters, numbers and hyphens. Apostrophes are dropped (baker's → bakers).
Agent mode pages and editor pages can't overwrite each other: pick another address, or move with from.

5. MCP and other docs

The MCP server at https://wordy.page/mcp publishes editor-style text pages (tools create_or_update_page, check_slug, get_page, list_pages, search_photos) and accepts the same personal key as a Bearer token. Use this agent API for custom HTML and CSS.

llms.txt · llms-full.txt · openapi.json · agent.json

wordy.page · About · Privacy · Contact

Questions or problems: contact@wordy.page.