reportbin takes one self-contained HTML file and gives you a link. Choose who can open it: only you, selected people, or anyone with the link. This page covers installation, uploads, sharing settings and the API.
Before you start
The hosted beta is free, and sign-up is open. Connect your installation by signing in with GitHub or Google and approving its code in your browser. Anyone-with-the-link reports need no reader account. Restricted reports require sign-in.
The command runs on macOS and Linux and needs sh and curl. That’s the whole list.
Install the command
$ curl -fsSL https://reportbin.dev/install.sh | sh
It installs reportbin into ~/.local/bin and prints a connection link and code. Open the link in your browser, sign in, check that the code matches, and select Connect. The browser can be on another computer or phone. The command waits up to ten minutes and saves the server and its upload key to ~/.config/reportbin/env, readable only by you.
Each installation gets its own key. Connecting another machine preserves existing connections. To reconnect an installed CLI, run ~/.local/bin/reportbin login. Requests expire after ten minutes and are cancelled by a server restart; start login again if needed.
For CI, provide a manual key through secret settings. The account page has a separate manual key and this command with a newly created key included:
curl -fsSL https://reportbin.dev/install.sh | REPORTBIN_TOKEN='<key>' sh
The installer is plain text at /install.sh; read it before piping it to a shell. It reuses a valid saved key or an explicitly supplied REPORTBIN_TOKEN. Set REPORTBIN_INSTALL_ONLY=1 to install without connecting.
After connecting, run ~/.local/bin/reportbin sample to publish a built-in sample containing no project data. It uses your account's default access; use sample --private for a private sample or sample --unlisted for anyone with the link. To upload your own file, run ~/.local/bin/reportbin report.html. The short command works after opening a new terminal with the installer's PATH update.
Share a report
Give it a file and it prints the link:
$ reportbin report.html https://reportbin.page/r/gI6WCjnKCTiQyLf_HkZo-A
Or pipe the page in, which is what a script or an agent usually does:
reportbin - <<'EOF' <!doctype html> <h1>Nightly build</h1> EOF
On success it prints only the link to stdout, so LINK=$(reportbin report.html) captures the URL. It also prints the actual access to stderr, such as Access: Only me. On failure it exits non-zero and says why on stderr.
One more: reportbin --hi "your message" sends a note to whoever runs the server.
Choose who can open it
On your account page, change each report's sharing settings:
- Only me: sign in to your account to read the report on any device.
- Selected people: you and people whose reportbin account email matches an address you allow can read it. Use their Google or GitHub email, and send them the report link yourself.
- Anyone with the link: anyone who gets the URL can read it without signing in.
In Account settings, choose Only me or Anyone with the link as the default access for new reports. Accounts start with Anyone with the link. The default applies to future uploads without an access option; existing reports keep their own settings. Choose recipients per report, up to 100 email addresses.
To choose the audience for one upload, use a sharing flag before the file:
reportbin --private report.html reportbin --to colleague@example.com,client@example.com report.html reportbin --unlisted report.html
These flags override your account default and also work with stdin, for example generate-report | reportbin --private -. With no flag, the upload uses your saved default access.
If a reader is signed out or lacks access, the link shows the same 404 page as a missing report. They can sign in or try another account, then return to the report. The page reveals no report title or content before access is granted.
Write a page that keeps working
A report is one file. Inline the CSS, the scripts, the data, and images as data URLs. A page that pulls its chart library from a CDN works today and breaks the day that CDN moves — and the link is meant to outlive the machine that made it.
Scripts in a report still run in a sandboxed opaque origin, separate from your account pages. They cannot read reportbin cookies. External resources and network requests are still possible, so keep the report self-contained. Charts, tabs and filters are fine. Anything that needs a credential is not.
Teach your coding agent
Paste this into your CLAUDE.md or AGENTS.md, globally or per project. It tells the agent how to publish when you ask for a report link:
## Reports When I explicitly ask to share a report by link, write one self-contained HTML page, upload it with `reportbin report.html`, and reply with the printed link and access reported by the command. Without an access flag, uploads use my saved default access. When I specify an audience, use `--private` for only me, `--to email[,email]` for selected people, or `--unlisted` for anyone with the link. These flags override the default. Selected readers need a reportbin account with a matching Google or GitHub email. Include personal or confidential information only when I explicitly authorise uploading it and have the right to share it with the intended readers. Use `--private` or `--to` when access should be limited; confirm the audience if unclear. Never upload passwords, API keys, access tokens or highly sensitive personal data such as identity documents, payment card details or medical records, even with restricted access. Remove those details or keep the report local.
To have the agent set itself up, give it this prompt:
Set up Reportbin using https://reportbin.dev/llms.txt. Connect my account through browser approval, then publish a sample report.
The agent instructions explain installation, browser approval and publishing the sample. The agent shows you the approval link while its login process waits. Approve the matching code yourself; keep upload keys out of agent conversations.
Upload from CI or a script
Where the command can’t be installed, the API takes the same key as a bearer token:
curl -H "Authorization: Bearer $REPORTBIN_TOKEN" \ -H "Content-Type: text/html" \ --data-binary @report.html https://reportbin.dev/api/reports
Omit sharing headers to use your account's default access. To override it, add X-Reportbin-Access: private, unlisted, or selected. Selected mode also requires X-Reportbin-Recipients: colleague@example.com,client@example.com; recipient headers are accepted only with that mode.
It answers 201 with {id, url, sharing}. The sharing field contains the actual mode and recipients applied to the upload. The rest of it:
POST /api/reports— the body is the raw HTML, astext/html.POST /api/feedback— a short note, astext/plain.GET /api/token— checks a key without uploading anything:204, or401.GET https://reportbin.page/r/<id>— the report, according to its sharing settings. This is theurlan upload returns; the same path on this site redirects there. Restricted reports need an allowed browser session or Clerk session token, not an upload key.
API failures come back as {"error": "<reason>"}: 401 for a bad key, 400 for an empty body or invalid sharing settings, 404 for a missing or inaccessible report, 409 for a full account quota or an account being deleted, 413 too large, 415 wrong content type, 429 for a rate limit, 503 when accounts are temporarily unavailable, and 507 when the server is nearly out of disk. This server’s upload and default storage limits are in llms.txt.
Storage and deletion
Each beta account gets 50 MiB of compressed report storage. The server compresses each report with gzip; those stored bytes count toward your quota. The separate upload limit is 20 MiB of original HTML per report. Reports do not expire automatically.
Your account page shows your current limit, usage, and reports with their titles, links, upload dates and stored sizes. Give a report a recognizable name with an HTML <title> near the start of the file. Delete a report there to remove its link and free space once its files are removed. Pending uploads and unfinished cleanup still count toward usage.
Deleting your account blocks new uploads immediately, removes reports associated with it, and deletes the account and all its keys in Clerk. If cleanup fails, the server retries it.
Report management uses your signed-in browser session, not your upload key: GET /api/account/reports lists a page, with ?cursor= for the next page, and DELETE /api/account/reports/<id> removes one of your reports. Deletion cannot recall copies someone already downloaded.
The list includes each report's sharing. To change one owned report, send PUT /api/account/reports/<id>/sharing with JSON such as {"mode":"selected","emails":["colleague@example.com"]}. It returns the updated first page of reports. Use an empty emails array with private or unlisted.
GET /api/account/default-access returns {defaultAccess: "private" | "unlisted"}. PUT to the same path accepts and returns that shape. It requires your browser session and changes the default for future uploads only.
Your connections and manual key
Your account page lists connected installations. Revoke a connection to stop its uploads immediately; other installations and existing reports stay available. Each connection can upload and send feedback, but cannot read restricted reports or manage your account.
The manual key for CI is separate and shown only when created. Rotate it if lost or exposed and update scripts that used it. Rotation preserves browser-paired connections. Deleting your account removes all its keys.
Keep keys out of reports, agent conversations, screenshots and commits. They upload under your account.
Links, and what they don’t do
Report links open on reportbin.page, a domain apart from this site, so reports never run alongside your account pages. A link holds 128 random bits. There is no public report directory, your account lists only your reports, and search engines are told not to index report links.
For Only me and Selected people reports, a leaked link alone does not grant access. Anyone-with-the-link reports can be read by anyone who gets the URL. Changing sharing settings controls future reads; it cannot remove copies already saved. The server operator can still access stored report contents.
You may include personal or confidential information if you have the right to upload it and share it with the intended readers. Use Only me or Selected people when access should be limited.
Do not upload passwords, API keys, access tokens or highly sensitive personal data, such as identity documents, payment card details or medical records, even with restricted access. See the terms and the privacy policy for details.
Uninstall
Two paths, both yours:
rm ~/.local/bin/reportbin rm -r ~/.config/reportbin
Revoke the installation from your account page as well. Reports you already uploaded stay up until they are removed.