Fast answers for publishing and building authenticated apps

Use HTML for a single file. Use Folder or ZIP when you have images, CSS, or JS.

Dashboard → Pages → New Page, then upload and click Publish.

Basic static hosts stop at the URL. MiniUp lets the same workspace grow into a branded page, data-backed app, hosted dataset, map, PDF Pack, or ChatGPT-built experience that you can continue managing.

Yes. Choose a name during publish and confirm the URL before going live.

Yes. Signed-in accounts can connect custom domains to published pages when the feature is enabled for the account. Open Dashboard → Pages → Edit → Custom Domain, add the hostname, then save.

Pending verification or pending configuration means MiniUp is still waiting for hostname verification or the required DNS records. Once the hostname points correctly, the status moves to Active.

Yes. Dashboard → Pages → Edit lets you upload new files while keeping the same URL.

Yes. Signed-in users can open Dashboard → Pages → Edit → Revision History to restore a saved snapshot. Revision history is not included for guest publishing, and the number of saved revisions per file follows your current account limits.

Open Dashboard → Pages → Edit, expand the Gallery card, then turn on Show in Gallery. You can add a title, thumbnail, and short description before saving so the page looks good in the public Gallery.

Yes. All files in your folder or ZIP are served from the same link.

A MiniUp Function is server-side JavaScript hosted by MiniUp. It can run as a standalone Public or API Key API at a stable functions.miniup.app endpoint, or link to one MiniUp site as a Site Members backend. Use it for authorization, business logic, private data access, or external API requests; frontend files stay in the MiniUp site.

MiniUp's built-in signed-in defaults include one MiniUp Function and 1,000 production calls per month. Configured limits can differ; see Plans for current limits. MiniUp administrators can adjust account limits or disable Functions for an individual account.

Yes. Run an isolated draft test, review the response, and publish only when it is ready. Draft tests and CORS preflight requests do not count against the monthly production-call quota.

Yes. Function Memory stores persistent JSON through env.MINIUP_MEMORY. Shared memory belongs to a Function; env.MINIUP_MEMORY.caller isolates values by authenticated caller. Preview and production are separate, and both count toward storage limits. Read methods, quotas, and examples.

MiniUp derives env.MINIUP_CALLER from a verified API key, site member, or x402 payer. Caller memory automatically uses that identity. It does not create company tenants or share data across separate keys or members. Never trust a browser-supplied tenant ID as authorization. See tenant patterns and boundaries.

A Function supports up to 20 active named keys. Renaming changes the label. Rotation replaces the secret immediately while preserving caller identity and memory. Revocation stops authentication; audit history and caller memory are retained. A newly created key has a separate identity. Copy new secrets when shown; they cannot be viewed again.

Most previews have no authenticated caller. A Site Member owner preview has the owner’s caller identity in separate preview storage. Anonymous Public calls and free x402 routes also have no caller identity. Test API-key isolation with distinct keys against the published endpoint. Review identity and preview behavior.

Yes. Open your Function and select Memory to inspect production or preview data, search keys, filter callers, view JSON, and delete records with confirmation. Caller isolation separates callers from one another, while the Function owner can manage the stored data. API keys and ordinary site membership do not grant access to these owner controls. Read the management guide.

Public is callable without Function authentication. API Key is for trusted external or server-to-server callers. Site Members links the Function to one MiniUp site and uses that site's authenticated members and roles. Browser code on the linked site can call /api/functions/... without embedding a Function API key. Each protected Function route must still enforce its own authorization checks.

Yes. Keep HTML, CSS, JavaScript, and components in your MiniUp site: index.html, app.js, style.css, and components/*.js. Use a linked Site Function for backend logic. Invite-only or Private access can require membership before protected site files load. A Public page remains public even when its Site Members API requires authenticated membership. This fits lightweight internal tools, portals, dashboards, and customer/member experiences.

It is a MiniUp Function in Site Members access mode, linked to one MiniUp site. MiniUp authenticates the site's member and securely passes their identity and role to the Function. Browser code on that site can call /api/functions/... without a Function API key. Create one from the site's Functions page.

Through env.MINIUP_USER, which contains id, email, name, role, and siteId. MiniUp supplies this authenticated context for a Site Members Function. The browser does not create this trusted identity, and browser-provided user or role values are not authorization proof.

Yes. The frontend can request a /bootstrap route from its Site Function and use the response to show or load features for owner, admin, editor, or viewer. Components remain normal site files. The frontend controls what users see. The Function controls what users are allowed to do: backend routes must enforce authorization independently, including when a user calls them directly.

The site owner or an admin manages members in Page Settings → Access. Invite users as Admin, Editor, or Viewer. Linked Site Functions receive the current owner, admin, editor, or viewer role. Member role changes are reflected without redeploying the Function.

They can attempt the request. For an admin-only action, the Function should check env.MINIUP_USER.role, allow only owner or admin, and return 403 for a viewer. Hiding an Admin button or component alone is not security; every protected backend route must enforce authorization.

Store private credentials in Function Secrets, not browser JavaScript or public site source. Function Secrets let backend logic call protected services without exposing credentials to app users. Do not embed Function API keys or MiniUp Table write keys in frontend files.

Keep small private JSON in caller-scoped Function Memory, and queryable application records in MiniUp Tables or another approved protected service accessed through the Function. Keep the data service's access controls in place, authorize each request, and return only the records and fields the signed-in user may access. Avoid storing private business data in frontend files; a Function provides backend logic and data access, not frontend storage.

No. A Site Members Function is linked to one MiniUp site. Another site or an unsigned direct request cannot use it as that site's authenticated backend. Browser calls should use /api/functions/... on the linked site.

Yes. Trusted ESM lets a MiniUp Function import server-side libraries from approved sources shown in the Function editor. Use those libraries for backend logic; keep frontend HTML, CSS, JavaScript, and components in the MiniUp site.

In ChatGPT, open Settings → Apps, find MiniUp in the directory, and click Connect. If you use a managed workspace, an admin may need to enable the app first.

A good default prompt is: “Use the uploaded file to build and publish a professional MiniUp app. If it is geospatial, make it a map app. If it is tabular, make it a dashboard. Publish it and show me the final URLs.”

Yes. The MiniUp ChatGPT app is meant to publish a real MiniUp site backed by MiniUp-hosted data instead of leaving you with a browser-local upload demo.

Yes. ChatGPT can list and inspect eligible datasets from your MiniUp Data Catalog, including their fields, limited sample data, profile, and recommended uses, before creating an app.

Yes. Create or approve a Dataset Bundle to define which eligible datasets belong together and what role each one should play. MiniUp keeps the underlying access requirements in place.

Start a chat, then add MiniUp from the + menu and More, or use an @ mention if your ChatGPT interface shows the app that way.

Dashboard → My API → Create from Table, then upload a CSV or XLSX.

It is a published page paired with live API or dataset links from the same workspace, so the share link, docs, and data delivery all stay under one project.

Open My API → View API Data to see auto-generated docs, copyable examples, and the OpenAPI file.

Yes. Toggle GET, POST, PATCH, PUT, or DELETE per table in My API.

It is one supported way to authorize record changes from a trusted app or workflow. Keep it private and rotate it if it is no longer trusted.

Yes. My API → Rotate Key replaces it and disables the old key.

Signed-in users can upload CSV, XLSX, XLS, JSON, GeoJSON, shapefile ZIP, Parquet, and GeoParquet files from the Parquet tab.

Yes. Each dataset includes practical usage guidance, field information, and a browser preview so you can understand it before connecting an app.

Yes. Signed-in users can publish the page, create tables and APIs, attach Parquet or GeoParquet assets, and generate PDF Knowledge Packs under the same project and access model.

Yes. Hosted datasets can follow their site's access or use another supported data access setting. Review the access badge in the Data Catalog before using the dataset in an app.

Signed-in users can connect a supported HTTP or HTTPS data file or ArcGIS REST layer from the dashboard, preview it, and create a refreshable MiniUp-hosted Parquet or GeoParquet snapshot.

The Data Catalog brings together the Table APIs, Parquet files, GeoParquet files, and supported map layers you own across MiniUp sites. You can search, filter, preview, and inspect them before deciding how to use them.

MiniUp can show field information, a limited sample, a lightweight profile, spatial details when available, access status, and recommended dashboard uses. This helps people and ChatGPT choose appropriate charts, maps, filters, and tables.

A Dataset Bundle records which datasets are approved for one app and how they should be used, such as primary records, map layers, boundaries, events, metrics, or reference data. It helps prevent accidental use of unrelated data.

No. Bundles help approve and describe datasets, but they do not remove the underlying access rules. MiniUp blocks public app creation when the selected data is not eligible for public use.

It turns a PDF into app-ready content with source references and prompts. The App Prompt helps ChatGPT, Codex, Claude, or another coding AI create a useful experience grounded in the original document.

Sign in, open a site's PDF Packs tab, then upload a PDF, drag and drop it, paste a PDF URL, or convert an existing PDF file already attached to the site.

It gives a coding AI the context and source-reference guidance needed to create a complete, mobile-friendly app from the PDF Pack.

The default signed-in limit is shown on the Plans page and on the PDF Packs screen before you upload.

Yes. Enable Password in Publish settings or Dashboard → Pages → Settings.

With Public access, anyone with the link can view the page, even if a linked Site Members API requires authenticated membership. Invite-only and Private access can require membership before protected frontend files are served. Password access uses a password unlock flow. Gallery listing is separate from these access settings.

Yes. Gallery is moderated. Owners control whether they list a page, and admins can still hide or re-enable a listing when needed.

Yes. MiniUp supports controlled write access for Table APIs. Only trusted people, apps, or workflows should be allowed to change records.

Yes. Dashboard → Pages → Disable unpublishes the link.

MiniUp shows the access status of hosted datasets in the Data Catalog and checks compatibility before they are added to an app workflow. Use public data for open apps and protected options for data that should have a limited audience.

Yes. Dashboard → Pages or My API → Delete removes it and its data.

Yes. Dashboard → Pages → Edit lets you replace HTML or upload new files.

Yes. My API → View API Data lets you edit rows inline.

Yes. In View API Data, click Export CSV.

Yes. Open the Custom Domain panel on the page, change the hostname, or remove the domain entirely without rebuilding the page itself.

No. Your page and API links stay the same.

No. Replacing a Parquet or GeoParquet dataset keeps the same published access URL so dashboards and scripts do not need a new link.

Yes. Use the table editor in View API Data.

They prevent abuse and keep the service fast for everyone.

Yes. Links stay the same unless you delete or disable them.

Guest is meant for simple publishing. For the current default limits, see the Plans page.

Signed-in accounts include publishing, Gallery, Data API, Parquet / GeoParquet, PDF Knowledge Packs, and custom domains, subject to the current plan limits. See the Plans page for the latest defaults.

Yes. Data API requires sign-in.

You will see a clear limit message. You can retry later, reduce file size, or sign in for more room depending on the action.