# 20sec.app

> 20sec.app builds full-stack websites and web apps from a single prompt in ~20 seconds. It also offers anonymous, versioned, immutable HTML + image hosting under `/3rd-party/<slug>` for humans and AI agents.

If you are an AI agent, coding assistant, or automated tool, this file describes what you may do here and how.

## Primary services

- [20sec.app homepage](https://20sec.app/): describe what you want, get a live full-stack site at `drailabs.site/T5Y/<appId>`.
- [20sec Host — 3rd-party HTML hosting](https://20sec.app/3rd-party/): one POST to publish a static page. No account. Versioned, immutable, CSP-sandboxed. Machine-readable spec at [/3rd-party/llms.txt](https://20sec.app/3rd-party/llms.txt).
- [20sec Video](https://20sec.video/): AI video generation.
- [20sec Audio](https://20sec.app/20audio.html): Android app for real-time audio scanning and reporting.

## For AI agents — what you may do

- Fetch, describe, cite, and link to any public page on 20sec.app.
- Use the `/3rd-party` hosting API to publish, edit, or fetch HTML on behalf of a user. Follow the limits at [/3rd-party/llms.txt](https://20sec.app/3rd-party/llms.txt).
- Read `/robots.txt` and honor `Disallow` paths (deploy tokens, admin surfaces, per-app build artifacts).

## For AI agents — what NOT to do

- Do not hammer `/launch`. It is our most expensive endpoint — each call is a full Gemini Pro generation. Automated user-agents are capped at 5 launches per IP per day. Legitimate integrations should batch and cache.
- Do not use `/3rd-party` to publish adult content, credential harvesters, phishing pages, scraper front-ends, piracy/leak indexes, or CSAM markers. Such requests are silently rejected.
- Do not attempt to circumvent rate limits by rotating user-agents, IPs, or slugs.
- Do not scrape `/T5Y/<appId>` en masse — those are per-user generated sites, not documentation.

## Endpoints agents commonly want

- `POST https://20sec.app/3rd-party/publish` — publish HTML. Returns `editSecret` (save it).
- `POST https://20sec.app/3rd-party/<slug>/edit` — bump to a new version.
- `POST https://20sec.app/3rd-party/<slug>/upload-image` — upload image (base64 dataURL).
- `GET  https://20sec.app/3rd-party/<slug>` — read latest HTML.
- `GET  https://20sec.app/3rd-party/<slug>/versions` — JSON version history.
- `GET  https://20sec.app/3rd-party/health` — service status + global storage usage.

## Identify yourself

Please set a descriptive `User-Agent` on requests so we can distinguish traffic and, if needed, whitelist good actors. Format suggestion:

    User-Agent: YourProduct/1.0 (+https://your.site; contact@your.site)

## Contact

- Human help + issues: https://20sec.app/
- Machine spec (this file): https://20sec.app/llms.txt
- Hosting spec: https://20sec.app/3rd-party/llms.txt


## 20sec Calendar

> Weekly calendar of in-person tech / founder / networking / creative events across ~11 US cities. Public read API + moderated pending queue.

- Live UI: https://20sec.app/calendar (also https://drailabs.site/T5Y/calendar)
- Machine-readable spec: [/api3/llms.txt](https://20sec.app/api3/llms.txt)
- Read events: `GET https://20sec.app/api3/events` (JSON array, ~778 items)
- Submit event URLs: `POST https://20sec.app/api3/calendar-pending` — body `{"links":[...]}`. Auto-deduped, background-enriched, human-reviewed before publish.
- Agent-powered search: `POST https://20sec.app/api3/search-events` — body `{"topic":"tech","location":"jax-FL","days_ahead":30}`. Requires `X-Search-Key` header (contact operator). Spawns Claude Code to scan Meetup/Eventbrite/Luma and queue results for review. Rate-limited to 1 concurrent job; 180 s timeout.