Before you start

Input: one browser-ready .html or .htm file that works without a development server.
Anonymous allowance: 3 decks per IP per UTC day, up to 1 MB each.
Anonymous decks are unlisted. The initial publish does not accept a zip archive.
Do not publish secrets or content you are not authorized to host.

Install, publish, and verify

Install from the official origin
```
curl -fsSL https://slidesfly.com/install.sh | sh
slidesfly --version
```
Continue only when the installed version is 0.1.1 or newer.
Publish the exact artifact
```
slidesfly publish ./deck.html --title "Q4 review" --json
```
Pass --json when a script or Agent will parse stdout.
Check the result and open the URL
A successful result has ok: true and contains the generated deck ID, complete slidesfly.xyz/d/… URL, visibility: "unlisted", and anonymous: true. Open that returned URL before sharing it.

Claim the deck, then update the same URL

Browser PKCE is the default login flow. Use slidesfly login --code --json on SSH or another headless host. Login claims pending local anonymous decks unless you pass--no-claim.

slidesfly login --json
slidesfly list --json

After ownership is confirmed, publish the replacement artifact to the existing ID:

slidesfly publish ./deck-v2.html --id YOUR_DECK_ID --json
slidesfly versions YOUR_DECK_ID --json

Failure recovery

Code	Likely cause	Recovery
`FILE_NOT_FOUND`	The local path is wrong or the artifact was not written to disk.	Resolve the real file path, verify it exists, then retry.
`INVALID_HTML`	The uploaded HTML or archive does not meet the publishing contract.	Fix the artifact locally; do not auto-rewrite user content without approval.
`MALICIOUS_CONTENT`	A remote script, blocked domain, or another security rule was triggered.	Bundle runtime code locally. Use the report route if the rejection is a false positive.
`QUOTA_EXCEEDED / RATE_LIMITED`	The current plan, anonymous daily allowance, or request rate was exceeded.	Follow the returned hint. For a rate limit, wait about 60 seconds and retry once.
`AUTH_REQUIRED / AUTH_INVALID`	An owned-deck operation has no current API key.	Run slidesfly login, then repeat only the intended operation.

Security and lifecycle boundaries

Uploaded HTML runs inside a sandboxed, opaque-origin iframe.
Remote script sources are rejected; bundle runtime code into the artifact.
Reader availability still follows owner deletion, expiry, visibility, moderation, and the current-version policy.
Use the returned URL; do not construct or guess reader and object-storage paths.

Agent-readable equivalent: quickstart.md.