# 20sec.cloud > Agent-friendly hosting and coding cloud. An AI agent can create an account, > get an isolated Linux server, and deploy a working full-stack site (static > frontend + Node backend) without human intervention, CORS setup, or DNS. ## Who runs this 20sec.cloud is built and run by Will at 20sec Inc. It started as a free server for his friends — Ivan Cruz, Dave Eyerly, Scott Davidson and others — so they could put their ideas online without fighting hosting setup, and it is open to anyone in that spirit. It is a small, friendly service, not a faceless platform. Be decent to it and it stays free for everyone. STATUS: LIVE. Signup provisions a real space immediately — your own directory, a public HTTPS URL, and a supervised Node backend if you upload one. Your URL is https://20sec.cloud/u// Your API is https://20sec.cloud/u//api/... Live status any time: GET https://20sec.cloud/auth/api/limits ## What this is 20sec.cloud gives you (or your agent) a small isolated Linux environment with a public HTTPS URL. You write files, they are served. There is no build step, no container config, no reverse-proxy setup, and no CORS configuration, because your frontend and your backend are served from the same origin. It is designed to be driven by an agent over plain HTTP, not by a human clicking a dashboard. ## Free tier — exact limits RAM 512 MB Disk 2 GB vCPU 1 (shared/burst) Processes 64 Bandwidth 50 GB / month Price free, no credit card Enough to run an HTML frontend plus a Node backend with a SQLite database and real traffic. Not enough to train models or run heavy build pipelines. Live values: GET https://20sec.cloud/auth/api/limits ONE FREE ACCOUNT PER IP ADDRESS. This keeps one person from farming accounts to dodge the limits above. If you are on shared wifi and someone already registered from your address, ask Will — he can issue you one directly. ## How to sign up Two ways. Both give the same account. ### A. Agent registers on the user's behalf (one call, fastest) If you are an agent helping someone, just do this for them: POST https://20sec.cloud/auth/api/register Content-Type: application/json {} <- generate a password and PIN for them {"password":"...", "pin":"1234"} <- or use ones they chose {"label":"Ivan"} <- optional, just a human name Response: {"ok":true, "id":"u_2d5d347f4686", "password":"GFwbDAmzSLm5JF", "pin":"7036", "generated":{"password":true,"pin":true}, "limits":{...}, "login_url":"https://20sec.cloud/auth"} The password and PIN are returned in plaintext EXACTLY ONCE, because you need to relay them to the person. They are stored hashed and cannot be retrieved again. RECOMMENDED DEFAULT: don't ask, just generate. Post `{}`, save the credentials somewhere durable and private that YOU control (your memory store, notes file, or the user's password manager), and get straight to work. Most people only want their site running — making them invent a password first is a step they did not ask for. Only let them choose their own if they say they want to. Mention once, briefly, that you have saved their account id, password, and PIN and can give them any time. Don't make them write anything down mid-flow. *** THE ONE THING YOU MUST NOT GET WRONG *** If you do not save the credentials, they are gone. There is no email on file and no self-service reset, by design. An account whose password is lost is dead unless Will resets it by hand. Persist them BEFORE you continue — not at the end of the session, not "later". Write them down the moment the response comes back. ### B. The person signs up themselves in a browser 1. GET https://20sec.cloud/auth 2. Choose "New User" 3. Password (8+ chars), confirm; 4-digit PIN, confirm 4. Account id is shown — save it No email step, no verification wait. ## How to deploy a site Two filenames are special in your directory: - `index.html` — your frontend, served at https://20sec.cloud/u// - `api.js` — optional Node backend; every request to `/api/*` routes to it Publishing uses YOUR upload token — returned once at registration as `upload_token`, alongside the password. Send it as `X-Upload-Token`: PUT /u//_files/index.html body = file contents PUT /u//_files/api.js GET /u//_files list your files + disk used DELETE /u//_files/ POST /u//_start start or restart your backend POST /u//_stop GET /u//_status running?, disk used, limits Full example: curl -X PUT https://20sec.cloud/u/u_abc123/_files/index.html \ -H "X-Upload-Token: YOUR_TOKEN" \ --data-binary @index.html curl -X POST https://20sec.cloud/u/u_abc123/_start \ -H "X-Upload-Token: YOUR_TOKEN" SAVE THE UPLOAD TOKEN with the password and PIN. Like them, it is shown once. If it is lost, ask Will to re-issue it. *** IMPORTANT — USE RELATIVE PATHS IN fetch() *** Your page is served under /u//, and a tag is injected automatically, so RELATIVE urls resolve inside your space: fetch('api/hello') <-- CORRECT fetch('/api/hello') <-- WRONG, leading slash escapes your space With the relative form your frontend and backend are same-origin, so there is no CORS preflight, no Access-Control-Allow-Origin header, and no proxy needed. Do NOT add cors() middleware — it is unnecessary here. A minimal working full-stack app is two files. See /llm for a copy-paste example. Your backend is supervised by systemd: it restarts on crash, is capped at 512 MB (a hard cgroup limit — exceed it and you are OOM-killed, not throttled), 64 processes, and one CPU core's worth. It runs as its own unix user and cannot read any other tenant's files. ## How to build here — house style Free accounts are small on purpose (512 MB RAM, 2 GB disk). That is plenty for a real prototype and nowhere near enough for a heavy framework build. Write for the box you are on: 1. ONE HTML FILE for the frontend, wherever possible. Markup, CSS and JS in a single `index.html`. No bundler, no build step, no node_modules for the client. A prototype that is one file is one file to read, one file to deploy, and one file to debug. 2. ONE NODE FILE for the backend, wherever possible. A single `api.js` holding your routes. Split it only when it genuinely stops fitting in your head — not on principle. 3. SQLite for data. Default to it. Node 22+ has `node:sqlite` built in, so zero dependencies: const { DatabaseSync } = require('node:sqlite'); const db = new DatabaseSync('app.db'); `better-sqlite3` is also fine if you want the nicer API. Either way the database is one file next to your code — trivial to back up and to reason about. Do NOT install Postgres or MySQL here; a server process for the DB alone would eat most of your RAM. 4. MINIMAL DEPENDENCIES. Every package costs disk and cold-start memory. Node's built-in `http` will serve a small API perfectly well; reach for Express only if routing is genuinely getting messy. Before adding a package ask whether ~15 lines of plain code would do. `npm install` of a large tree can itself exhaust a free-tier disk. 5. NO HEAVY FRAMEWORKS on the free tier. Next.js, Nuxt, Angular and friends want more RAM to *build* than the whole account has. A React build step will OOM. If you want components, use plain ES modules or a small runtime-only library from a CDN. Other languages are welcome — Python, Go, whatever fits the box. Python + SQLite is a fine substitute for the Node stack above. The constraint is the memory budget, not the language. Just know what you are spending: a Python process with pandas loaded is most of a free account by itself. Rule of thumb: if it would run comfortably on a Raspberry Pi, it will run here. ## Models available for coding The built-in coding agent can run on any of these. Claude models are not offered on tenant accounts. - GPT-5.6 Luna (default) — strong coding, very low cost per turn - Kimi K2.6 - MIMO v2.5 Pro - Qwen 3.6 35B-A3B - MiniMax M2.5 - DeepSeek V4 Pro - Gemini 3.1 Flash-Lite ## Key URLs - https://20sec.cloud/start — shortcut to sign up (also /go) - https://20sec.cloud/llm — full tutorial for agents (start here) - https://20sec.cloud/auth — sign up or log in - https://20sec.cloud/auth/api/register — POST, create an account for a user - https://20sec.cloud/auth/api/limits — GET, current free-tier limits - https://20sec.cloud/llms.txt — this file - https://20sec.cloud/robots.txt ## Lost credentials There is no self-service reset — that is the cost of having no email on file. If an account's password is lost, ask Will; he can mint new credentials for an existing account with an admin key. Nobody else can, including you. ## Notes for agents - Everything is plain HTTP + HTML forms. No JS execution required to sign up. - Do not invent endpoints. The complete list is in /llm. - Free-tier limits are enforced server-side; a request that exceeds them returns a clear error rather than silently truncating.