Let your AI agent build real websites
Claude, ChatGPT, autonomous agents, or your own scripts can connect to Canvas Builder through a secure, scoped REST API and drive the exact same engine as the app: building, refining, publishing, and downloading production Bootstrap 5 websites on your behalf, with your approval and your credits.
Why an agent API?
AI assistants are becoming the way people get work done. When someone asks their assistant to "make me a website for my bakery", the assistant needs somewhere real to build it: not a code sandbox that produces a throwaway React prototype, but a production website engine with hosting, domains, and clean exportable code.
The Canvas Builder Agent API is that engine. It exposes the same CanvasAI build pipeline used by the Canvas Builder app: a real design agent that plans a visual direction, writes multi-page Bootstrap 5 HTML on the battle-tested Canvas design system (1,658+ components, 85+ niche demos), reviews its own output, and ships deploy-ready files. Your assistant orchestrates; Canvas Builder builds.
Everything is consent-first. An agent only gets access after the account owner scans a QR code and approves specific permissions, every action lands in an audit log, and access is revocable with one click.
Use Cases
How It Works
Agent requests a link
The agent calls POST /api/v1/agents/link/start with its name and the scopes it needs. It gets back a short human-readable code, an approval URL, and a ready-made QR image to show you.
You approve in your account
Open the link or scan the QR while logged in to Canvas Builder. You see exactly which agent is asking and which permissions it wants (build, publish, domains). Approve or deny. Nothing happens without this step, and no secrets ever pass through the chat window.
Agent receives a scoped token
The agent polls /link/poll and receives a bearer token exactly once. Tokens are scoped to the approved permissions, stored hashed on our side, expire after 90 days, and can be revoked from your account at any time.
Build and refine conversationally
POST /sites starts a build from a plain-English description, exactly like typing in the chat app. The build runs asynchronously; the agent polls GET /sites/{id} until it is complete, then refines with POST /sites/{id}/changes: change copy, swap sections, add pages, adjust colours.
Publish, connect a domain, download
With the right scopes, the agent publishes to a free HTTPS subdomain on cnvs.site (optionally password-protected), connects a custom domain, or downloads the whole site as a self-contained ZIP with all HTML, CSS, JS, fonts, and images.
Quickstart
Plain HTTPS and JSON. These four calls are the whole core loop.
# 1. Start a device link (show the QR / link to the user)
curl -X POST https://canvasbuilder.co/api/v1/agents/link/start \
-H "Content-Type: application/json" \
-d '{"agentName": "My Assistant", "scopes": ["sites:build", "sites:publish"]}'
# 2. Poll until the user approves (token is returned exactly once)
curl -X POST https://canvasbuilder.co/api/v1/agents/link/poll \
-H "Content-Type: application/json" \
-d '{"code": "WXYZ-1234"}'
# 3. Build a site (async, returns siteId immediately)
curl -X POST https://canvasbuilder.co/api/v1/agents/sites \
-H "Authorization: Bearer cb_agent_..." \
-H "Content-Type: application/json" \
-d '{"description": "A landing page for an artisan bakery in Lisbon. Warm, rustic design with a menu section, story section, and contact form."}'
# 4. Poll status (every 15-30s; a full build takes 5-10 minutes)
curl https://canvasbuilder.co/api/v1/agents/sites/SITE_ID \
-H "Authorization: Bearer cb_agent_..."API Reference
Base URL: https://canvasbuilder.co/api/v1/agents · Full schema in the OpenAPI spec.
| Endpoint | Scope | What it does |
|---|---|---|
| POST/link/start | public | Begin a device link. Returns a short code, an approval URL, and a QR image the agent shows to the user. |
| POST/link/poll | public | Poll until the user approves. Returns the bearer token exactly once, then the code is burned. |
| GET/me | any | Token identity check: linked account, granted scopes, expiry, and current credit balance. |
| POST/sites | sites:build | Start a new website build from a plain-English description. Returns a siteId immediately; the build runs async. |
| GET/sites | sites:build | List the account's sites with status and titles. |
| GET/sites/{id} | sites:build | Poll build status. Returns building, complete, or error (with a reason), plus the live URL and preview HTML. |
| POST/sites/{id}/changes | sites:build | Refine an existing site conversationally: change copy, swap sections, add pages. Same engine as the chat app. |
| POST/sites/{id}/publish | sites:publish | Publish to a free HTTPS subdomain on cnvs.site, with optional password protection. |
| POST/sites/{id}/domain | sites:domain | Connect a custom domain to a published site. |
| GET/sites/{id}/download | sites:build | Download the complete site as a ZIP: HTML, CSS, JS, fonts, and images. Fully self-contained. |
Security Model
Consent-first linking
Access is only granted when the account owner approves a link request in their logged-in session. The agent never sees credentials, and the approval screen shows exactly what is being requested.
Scoped permissions
Three scopes: sites:build (create, refine, download), sites:publish (cnvs.site publishing), sites:domain (custom domains). An agent gets only what you approve, and unknown scopes are silently dropped.
Hashed, expiring, revocable tokens
Tokens are delivered once, stored as SHA-256 hashes, expire after 90 days, and can be revoked instantly from your account settings. Revocation takes effect on the very next request.
One-time token delivery
The link code is burned when the token is delivered, and the transient secret is erased server-side. Pending links expire after 10 minutes if not approved.
Audit log on every action
Every build, publish, domain change, and download is recorded with the token, action, and result. Rate limits apply per token, and one build runs at a time per account.
Same guardrails as the app
Agent-submitted briefs pass through the same prompt-injection screening and scope guardrails as the chat app, and builds are the same reviewed, production-grade output.
Connecting Popular Agents
Claude / Claude Code
Tell Claude to read https://agents.canvasbuilder.co and follow the link flow. With tool use or a fetch-capable MCP server, Claude can complete the entire handshake itself: it shows you the QR link, waits for your approval, then builds and polls autonomously.
ChatGPT and custom GPTs
Import the OpenAPI spec (https://canvasbuilder.co/agents-openapi.yml) as a GPT Action. The link endpoints are public, so the GPT can start the handshake, give you the approval URL, and store the token for subsequent build calls.
Agent frameworks (LangChain, CrewAI, AutoGen, ...)
Wrap the endpoints as tools. The API is intentionally simple: two unauthenticated link endpoints, then bearer-token JSON calls. The async build-then-poll pattern maps cleanly onto any tool-calling loop with a wait primitive.
Plain scripts and backends
No agent required. The same API works for programmatic site generation from your own backend: link once manually, store the token, and create sites from structured data whenever you need them.
What Your Agent Gets
Frequently Asked Questions
Which AI agents work with Canvas Builder?
Any agent that can call a REST API: Claude (including Claude Code and MCP-based setups), ChatGPT and custom GPTs with Actions, autonomous agent frameworks like LangChain or CrewAI, and plain scripts. The API is standard HTTPS + JSON with an OpenAPI 3.1 spec, so no SDK is required.
How does an AI agent connect to my account?
Through a device-link consent flow. The agent requests a link code and shows you a QR code or URL. You open it while logged in to Canvas Builder, review the requested permissions, and approve. The agent then receives a scoped bearer token. You never paste passwords or API keys into a chat window.
What can a connected agent do, and what can it not do?
Exactly what its scopes allow. sites:build lets it create, refine, and download sites. sites:publish adds publishing to cnvs.site subdomains. sites:domain adds custom domain management. It can never access your billing, change your account, or act outside the granted scopes, and every action is written to an audit log.
Can I revoke an agent's access?
Yes, instantly. Connected agents are listed in your account settings with their name, scopes, and last-used time. One click revokes the token and the agent loses access immediately. Tokens also expire automatically after 90 days.
Whose credits are used when an agent builds a site?
The linked account's credits, at the same rates as building in the app yourself. The agent's builds appear in your project history like any other build, so you can open them in the chat app and keep refining manually.
Is the output real code or a proprietary format?
Real, production-grade Bootstrap 5 HTML built on the Canvas design system, the same engine behind the Canvas Builder app. Agents can download the complete site as a self-contained ZIP with all CSS, JS, fonts, and images. You own the code with no platform lock-in.
How do builds work over an API if generation takes minutes?
Builds are asynchronous. POST /sites returns a siteId immediately with status building. The agent polls GET /sites/{id} every 15 to 30 seconds until status is complete (or error, with a reason). A quality full-site build typically takes 5 to 10 minutes.
Is there a machine-readable spec my agent can discover on its own?
Yes. Point any agent at https://agents.canvasbuilder.co and it gets an agent-oriented markdown guide covering the whole flow, plus a full OpenAPI 3.1 specification at /agents-openapi.yml. Most modern agents can read those two documents and connect without any human-written glue code.
Are there rate limits?
Yes, sane ones: builds are limited per hour per token, other endpoints have a generous general limit, and one build runs at a time per account (concurrent build requests receive a 409 and simply retry after the current build finishes). Normal agent usage never hits them.
Can my agent reference an existing website's design?
Yes. If the build description mentions a URL, for example "design it in the style of example.com", Canvas Builder analyzes that site's palette, typography, and layout and applies the same design language to your content. It never copies the reference site's text, images, or logo.
Point your agent at the docs
The whole integration is self-serve: an agent-readable guide plus an OpenAPI spec. Most agents connect in a single conversation.
Related: All integrations · WordPress · Next.js