Neocities API | Ancient Deities Dossier™

Security rule: Never paste a Neocities API key, authorization client secret, access token, or refresh token into HTML, JavaScript, JSON, a public repository, or a chat message. Every file hosted here is static and public. Secrets stay in the owner’s protected local credential store.

Public read API

These HTTPS files require no authentication and are safe for browsers, approved owner tools, and catalog applications to read.

GET /site.jsonBrand identity, canonical URLs, public capabilities, and current schema version.

GET /catalog.jsonThe official public index of 72 long-form uploads and 144 Shorts, including YouTube IDs, titles, type, and canonical links.

GET /oauth-config.jsonPublic OAuth application identity, minimum scopes, policy links, and explicit non-capabilities. It contains no secret.

Neocities management API

Neocities provides authenticated endpoints for upload, delete, site information, file listing, and API-key retrieval. The approved owner workflow uses upload and site information. The owner’s local deployment tool reads NEOCITIES_API_KEY from the computer’s protected environment and sends it as a Bearer token to Neocities over HTTPS; the key is never placed on this public website.

Action	Neocities endpoint
Publish changed site files	`POST https://neocities.org/api/upload`
Confirm public site identity	`GET https://neocities.org/api/info?sitename=ancientdeitiesdossier`
List owner files	`GET https://neocities.org/api/list` with Bearer authorization
Delete	Not used by the approved workflow because Neocities deletion is irreversible.

Integration boundary

The integration uses a separate owner-controlled local connector. It can read this public catalog, inspect Neocities site information, and upload explicitly selected website files. It has no destructive remote command.

Authorization boundary

Neocities hosts public brand and policy pages; it must not exchange authorization codes for tokens because it has no protected server runtime. Secure token exchange belongs in the owner’s protected local application using a desktop-app flow and an approved loopback callback. The authorization consent screen should point to this public homepage and its matching policy URLs.

Health check

An approved owner tool may verify identity by fetching https://ancientdeitiesdossier.neocities.org/site.json and checking that site_id equals ancient-deities-dossier, the canonical host matches, and the schema version is supported.

Official API reference

For the current hosting API contract, see the Neocities Developers API. The local scripts in the downloadable site package implement its Bearer-token upload convention.