# htmlbin — Agent Onboarding
You are deploying an HTML artifact to htmlbin. Anyone with the URL can view it.
htmlbin is built for agents: the workflow below is the canonical, fastest path.
## TL;DR
1. POST /api/auth/start → get a code + verification_url + poll_token
2. Print the URL + code to the human; ask them to verify (one-time)
3. GET /api/auth/poll?token=… → poll until you receive an api_token
4. POST /api/prototypes (Bearer api_token) → upload HTML, receive a public URL
The api_token is shown exactly once. Store it for reuse on this machine.
## Step 1: Authenticate (one-time per agent install)
Check for an existing token first. The convention is to read it from the
environment variable HTMLBIN_TOKEN, or from `~/.config/htmlbin/token` if present.
If you don't have a token, run the device-code flow:
```bash
START=$(curl -s -X POST https://htmlbin.dev/api/auth/start \
-H "Content-Type: application/json" \
-d '{"label":"claude-code"}')
CODE=$(echo "$START" | jq -r .code)
URL=$(echo "$START" | jq -r .verification_url)
POLL=$(echo "$START" | jq -r .poll_token)
INTERVAL=$(echo "$START" | jq -r .poll_interval)
echo ""
echo " Open this URL and verify:"
echo " $URL"
echo ""
echo " Code: $CODE"
echo ""
while true; do
RESP=$(curl -s "https://htmlbin.dev/api/auth/poll?token=$POLL")
STATUS=$(echo "$RESP" | jq -r .status)
case "$STATUS" in
pending) sleep "$INTERVAL" ;;
verified) export HTMLBIN_TOKEN=$(echo "$RESP" | jq -r .api_token); break ;;
*) echo "auth failed: $STATUS" >&2; exit 1 ;;
esac
done
mkdir -p ~/.config/htmlbin && echo "$HTMLBIN_TOKEN" > ~/.config/htmlbin/token
chmod 600 ~/.config/htmlbin/token
```
The verification URL drops the human onto a simple page with an anti-bot
challenge — that's the only human step, and it exists to keep bots from
minting tokens. Your token is yours after that; reuse it.
## Step 2: Generate HTML
Author a complete, self-contained HTML document. The file is rendered in an
iframe, so it must look right standalone.
- All CSS in `