API-first static hosting

Tanzaku

Give your AI agent a safe way to publish websites. Create a site, issue a scoped token, and let the agent ship static HTML, CSS, JavaScript, images, fonts, and data files.

Open app See workflow 日本語

Tanzaku is in public beta — sign in or sign up with just an email address.

Credential model: Site-scoped API tokens
Output: Static sites on Tanzaku URLs
Setup: No cloud project needed

Workflow

Keep the human in control, and let the agent handle the publish step.

Create a site

Choose a public slug in the Tanzaku app. Tanzaku reserves the URL and shows the site in your dashboard.

Issue a token

Generate a token for that site only. The token can be copied into an agent prompt or local automation.

Publish files

The agent calls the Tanzaku API with static assets. Tanzaku stores, validates, transforms, and serves the result.

Designed for agents

The API is discoverable, token-based, and narrow enough to give to coding agents without sharing AWS credentials.

Built for static output

HTML, CSS, JS, images, fonts, JSON, and text files are accepted. Server-side code and risky files are rejected.

Access control included

Sites can be public or password protected, with owner preview and deployment history visible from the app.

API

One publish request from an agent can update the live site.

Use Tanzaku when the output is a static website and the missing piece is safe, repeatable publication.

POST https://api.tanzaku.io/v1/publish
Authorization: Bearer tanzaku_live_...
Content-Type: application/json

{
  "public_slug": "my-agent-site",
  "files": [
    {
      "path": "index.html",
      "content": "<h1>Published by an agent</h1>"
    }
  ]
}

Showcase

Real sites, already published through Tanzaku.

fugafuga.hosted-by.tanzaku.io

FABLE — Generative Atelier

A generative-art lab designed, built, and deployed by Claude Fable 5. Five real-time engines, zero libraries.

Visit site → hohohello-ai.hosted-by.tanzaku.io

CSS Animation Compendium

Over 100 CSS animations organized by category, each with a copy-paste-ready sample.

Visit site → diagram.hosted-by.tanzaku.io

Swimlane Diagram Editor

A working in-browser editor, published as-is. Tools count as sites too.

Visit site →

Under the hood

Once published, serving is just S3 and CloudFront.

There is no server in the serving path — your site is static files on S3, delivered from CloudFront's global edge. Boring, proven AWS parts, arranged so an agent can be trusted with publishing.

Serving — every request

Visitor

Requests {slug}.hosted-by.tanzaku.io over HTTPS.

CloudFront

Answers from the nearest global edge location.

Private S3

Static files, read through Origin Access Control. No runtime, no build step, no cold starts.

Publishing — only when the agent updates the site

01 · Issue a token

The dashboard issues a site-scoped token (tanzaku_live_…). Shown once, stored only as a hash.

02 · POST /v1/publish

A Lambda API validates the token and every file — size, paths, content types — then transforms the HTML.

03 · Store in S3

Originals and served copies land in private S3 buckets; metadata and deploy history in DynamoDB. Then the compute exits — delivery stays fully static.

Site-scoped tokens

Agents never see AWS credentials. A leaked token can only update its one site, and you can revoke it from the dashboard at any time.

Passwords checked at the edge

Protected sites are gated by a CloudFront Function that verifies an HMAC-signed, site-bound cookie before requests reach the origin. Rotating the password invalidates old cookies.

Buckets stay private

S3 is never public — CloudFront reads it through Origin Access Control. Public sites take a no-auth fast path; the API sits behind WAF rate limiting.

Custom domains with managed TLS

Point one CNAME and serve from your own domain; CloudFront issues and renews the certificate automatically.