Link a live URL

The clip#

Every space gets a 5-second clip for its tile, and the clip's first frame is its thumbnail. After you publish, Velven plays the space in its own browser and records one, which takes a few minutes. Until it lands, only you can see the space, marked Getting ready, and the Clip tab of its edit page shows the progress.

To skip the wait, press Add your own clip on the card before you publish, and the space goes live as soon as it is proven. Later, open the Clip tab on the space's edit page. Under Upload your own video, press Choose a video. Under Record a new clip, say what the clip should show and press Record again. You can ask for 2 new recordings in the space's life.

When the site changes, Velven's background check notices and records again, at most once a day. A clip you uploaded yourself is never replaced. An agent can ask for a new clip through the API.

Supported hosts#

Velven reads the host from the address and the response headers, after redirects, and refuses any other host with a 422.

Allow Velven to frame your page#

Every space plays inside its Velven page; there is no option to open it in a new tab. So its host must let velven.ai frame it. All 7 hosts allow that by default, and most pages need nothing. A page that sends its own headers must allow velven.ai in them:

• A Content-Security-Policy with frame-ancestors must name https://velven.ai (or allow every site with * or https:). 'self' alone refuses Velven.
• Without frame-ancestors, X-Frame-Options must not be DENY or SAMEORIGIN. When both are sent, frame-ancestors wins.

This header keeps the page framable by its own site and by Velven:

Content-Security-Policy: frame-ancestors 'self' https://velven.ai

Velven reads the headers when the space is listed, and again on its background check. The agent API refuses a page that blocks framing with 422 unframeable and the change for its host. A listed space whose host starts refusing frames leaves Velven until the header is back. Its creator sees the fix on the space's page and its edit page, and can press Check again on either.

ChatGPT#

A ChatGPT site sends no headers of its own and always allows framing. Nothing to do.

Vercel#

Add this to vercel.json at the project root, merged into any headers list already there. A Next.js app can set the same header in next.config instead.

{  "headers": [    {      "source": "/(.*)",      "headers": [        {          "key": "Content-Security-Policy",          "value": "frame-ancestors 'self' https://velven.ai"        }      ]    }  ]}

Remove any X-Frame-Options header the app sets (a security preset, a middleware).

Deploy the change.

Netlify#

Add this to a _headers file in the publish directory, or the same rule under [[headers]] in netlify.toml.

/*  Content-Security-Policy: frame-ancestors 'self' https://velven.ai

Remove any X-Frame-Options header the app sets (a security preset, a middleware).

Deploy the change.

GitHub Pages#

GitHub Pages sets no headers and always allows framing. If a page there refuses framing, something in front of it is blocking it.

Cloudflare#

On Pages, or a Worker that serves static assets, add this to a _headers file in the output (assets) directory. On a Worker whose fetch handler builds the page, set the header on the response there.

/*  Content-Security-Policy: frame-ancestors 'self' https://velven.ai

Remove any X-Frame-Options header the app sets (a security preset, a middleware).

Deploy the change.

Replit#

On a static deployment, add this to the .replit file at the project root. On an Autoscale or Reserved VM deployment, set the header on the response in the server.

[[deployment.responseHeaders]]path = "/*"name = "Content-Security-Policy"value = "frame-ancestors 'self' https://velven.ai"

Remove any X-Frame-Options header the app sets (a security preset, a middleware).

Publish again.

Firebase#

Add this to firebase.json at the project root, merged into the hosting block and any headers list already there.

{  "hosting": {    "headers": [      {        "source": "**",        "headers": [          {            "key": "Content-Security-Policy",            "value": "frame-ancestors 'self' https://velven.ai"          }        ]      }    ]  }}

Remove any X-Frame-Options header the app sets (a security preset, a middleware).

Deploy again with firebase deploy.

What Velven checks, and when#

Velven checks a linked page when it is listed, claimed or moved, in the background, and when you press a button for it. The background check runs every 6 hours and visits the spaces checked longest ago first, so a space's turn can come less often. The proof tag is read only at a listing, a claim and a move; removing it later changes nothing.

Publish with an agent has the API calls, and Leaderboards the boards block.

Claim a space Velven listed#

Velven lists some spaces itself, marked Unclaimed and credited to their creator. If one is yours, add the proof tag to it and deploy. Press Claim on its page, sign in, and press Check now. Its plays stay, and it moves to your handle. An agent claims it with POST /api/spaces/verify.

Move to another host#

A space that moves to a new URL keeps its listing: its slug, plays, likes, boards, scores, saves and page text stay. Put the proof tag on the new page and allow framing there, deploy, then enter the new URL under Move to a new address on the Settings tab of the space's edit page.

Velven reads the boards block on the new page. Boards the old page declared and the new one does not are withdrawn, with their scores kept, so copy the block across.

An agent moves it with POST /api/spaces/{slug}/move. Move to another host has the call and what to update on the new host, and the REST API every refusal. To move the space onto Velven's own hosting, see Move a linked space onto Velven.