Opti Deploy Portal — Employee Guide

Deploy any static web app to a shareable, Optimizely-only URL — in seconds. From the dashboard, or directly from Claude.

🔗 Portal: https://deploy.optimizely.com 🔗 Get started: https://deploy.optimizely.com/start

What it does

Drop a built static site (a folder, a ZIP, or anything Claude generates) and get a URL like:

https://deploy.optimizely.com/your-name/your-project/

Anyone with an @optimizely.com Microsoft account can open it. Nothing is public by default — reaching somebody outside Optimizely takes a deliberate external link, one project at a time, and while that feature is approval-gated the control is shown only to the support admins. Sign-in is the same one you use for everything else.

Use it for: design mockups, AI-generated demos, prototype sharing, internal microsites, hackathon projects, before/after pages, one-off dashboards — anything that builds to HTML/CSS/JS.

Every page arrives with a backend already attached: a database, file uploads, AI, API calls that keep your keys off the page, and automations. So your page can collect data — a form, a survey, a poll — with no backend and no API key. See "Your app can store data" below.

Not for: server-rendered apps (Next.js SSR, Express, etc.), customer-facing production content (no SLA, no custom domain), or anything over 1 GB.

Prerequisites

✅ Optimizely Microsoft account

← Start Go to the dashboard →

Tool	Upload this folder
Vite (React, Vue, Svelte, Solid)	`dist/`
Create React App	`build/`
Next.js (static export)	`out/`
Astro	`dist/`
SvelteKit (static)	`build/`
Nuxt 3 (static)	`.output/public/`
Angular CLI	`dist/<your-app>/browser/`
Gatsby	`public/`
Plain HTML/CSS/JS	the folder containing `index.html`
Lovable / v0 / Bolt / similar	usually `dist/`

Using a client-side router? (React Router, Vue Router — anything with a basename.) Everything else works with no configuration: we rewrite root-relative paths and set <base href> for you. Routers are the exception, because they need the value in JavaScript — so read it from Opti.basePath rather than hardcoding it:
createBrowserRouter(routes, { basename: Opti.basePath })
Don't build it from your name and project: the same page is also served at your short link (/go/…) and at per-version preview URLs (/…/v3/), where a guessed value is wrong. Opti.basePath is always the prefix the visitor actually arrived on.

name: Deploy
on:
  push:
    branches: [main]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20 }
      - run: npm ci && npm run build
      - name: Deploy to Optimizely Deploy Portal
        run: |
          cd "dist"        # folder with index.html at its root (. for a static repo)
          zip -qrX /tmp/deploy.zip . -x '.git/*' '.github/*' 'node_modules/*'
          curl --fail-with-body -sS -X POST "https://deploy.optimizely.com/api/deployments/cli" \
            -H "Authorization: Bearer ${{ secrets.OPTI_DEPLOY_TOKEN }}" \
            -F "name=my-app" -F "mode=zip" -F "files=@/tmp/deploy.zip"

#!/usr/bin/env bash
# ⚠️ Fail on the first error, not at the end: a PUT that silently fails turns into a
# confusing 409 from finalize ("declared 1200 bytes, arrived 0") three steps later.
set -euo pipefail

# Portable on both GitHub's ubuntu-latest and a Mac: `find -printf` and `stat -c` are
# GNU-only, `wc -c` and one of the two sha tools are everywhere.
sha() { command -v sha256sum >/dev/null 2>&1 && sha256sum "$1" | cut -d' ' -f1 || shasum -a 256 "$1" | cut -d' ' -f1; }

# 1. Describe what you are about to upload. No files are sent yet.
cd 'dist'
# jq builds the JSON, not printf: a filename containing a quote or backslash would produce
# an invalid manifest, and with set -e that now dies as a jq parse error naming nothing.
find . -type f ! -path './.git/*' ! -path './.github/*' ! -path './node_modules/*' | sed 's|^\./||' | while read -r f; do
  jq -Rn --arg p "$f" --argjson s "$(wc -c < "$f" | tr -d ' ')" --arg h "$(sha "$f")" \
    '{path:$p, size:$s, sha256:$h}'
done | jq -s --arg n 'my-app' '{name:$n, manifest:.}' > /tmp/begin.json

BEGIN=$(curl --fail-with-body -sS -X POST "https://deploy.optimizely.com/api/deployments/upload/begin" \
  -H "Authorization: Bearer $OPTI_DEPLOY_TOKEN" \
  -H 'content-type: application/json' --data-binary @/tmp/begin.json) || {
  # ⚠️ Print the refusal: a failed $(…) keeps the body in BEGIN, and set -e would exit silently.
  echo "$BEGIN" >&2; exit 1; }
UPLOAD_ID=$(echo "$BEGIN" | jq -r '.upload_id')
# ⭐ THE CREDENTIAL FOR THE REST OF THIS UPLOAD, and the reason the token above may be a
# single-use one. It is good for finalize and abort of THIS upload only, and dies with it —
# so the long-lived key is presented once, not three times, and never reaches the trap.
CONT=$(echo "$BEGIN" | jq -r '.continuation')

# Give the slot back on the way out, however we leave.
# ⚠️ INT and TERM as well as ERR: a cancelled or timed-out CI job dies by signal, which does
# not fire an ERR trap — and that is exactly the job this is here for.
trap 'curl -sS -X DELETE "https://deploy.optimizely.com/api/deployments/upload/abort?upload_id=$UPLOAD_ID" \
  -H "Authorization: Bearer $CONT" >/dev/null || true' ERR INT TERM

# 2. Send each file to the URL minted for it. These do not touch the portal.
#    -T streams the file; 8 at a time, because one at a time is slow for a big build.
# ⚠️ NUL-separated, because xargs splits on SPACES as well as tabs — a path with a space in
# it would mis-pair, and a file would be PUT to the wrong URL rather than failing cleanly.
echo "$BEGIN" | jq -j '.uploads[] | .path + "\u0000" + .url + "\u0000"' |
  xargs -0 -P 8 -n 2 sh -c 'curl --fail-with-body -sS -T "$0" -H "x-ms-blob-type: BlockBlob" "$1"'

# 3. Publish. The portal now checks what actually arrived, scans it, and commits.
curl --fail-with-body -sS -X POST "https://deploy.optimizely.com/api/deployments/upload/finalize" \
  -H "Authorization: Bearer $CONT" -H 'content-type: application/json' \
  -d "{\"upload_id\": \"$UPLOAD_ID\"}"

# $OPTI_DEPLOY_TOKEN = a deploy token (the "Deploy from GitHub" dialog's, or one from Access tokens).
# Zip the *contents* of dist/ so index.html is at the zip root, then POST it:
(cd dist && zip -qr /tmp/up.zip .)
curl -X POST https://deploy.optimizely.com/api/deployments/cli \
  -H "Authorization: Bearer $OPTI_DEPLOY_TOKEN" \
  -F "name=my-app" -F "mode=zip" -F "files=@/tmp/up.zip"

<ul id="entries"></ul>
<script>
  // The async wrapper matters: a plain <script> is a *classic* script, and
  // top-level `await` there is a SyntaxError that kills the whole block.
  (async () => {
    const list = document.getElementById('entries')

    async function render() {
      const rows = await Opti.collection('guestbook').list()
      // Built as elements, never innerHTML: an entry is a colleague's text, and markup in it must stay text.
      list.replaceChildren(...rows.map((r) => {
        const li = document.createElement('li')
        li.textContent = `${r.createdByName}: ${r.data.message}`
        return li
      }))
    }

    document.addEventListener('opti:saved', render)   // refresh after a submit
    render()
  })()
</script>

Request	What it does
`POST …/{collection}`	Add one entry, id generated for you
`PUT …/{collection}/{key}`	Replace the entry at that key (needs "let it update records")
`PATCH …/{collection}/{key}`	Merge — the fields you send are set, the ones you leave out are untouched, and `null` removes one (same tick-box)
`DELETE …/{collection}/{key}`	Remove an entry a feed wrote (needs "let it remove records")
`POST …/{collection}/batch`	Up to 200 of the above in one call

POST https://deploy.optimizely.com/api/ingest/{token}/{collection}/batch

[ { "data": { "account": "Acme", "arr": 40000 } },
  { "key": "acct-1", "data": { "account": "Acme", "arr": 40000 } },
  { "op": "patch",  "key": "acct-2", "data": { "status": "stale" } },
  { "op": "delete", "key": "acct-3" } ]

const ref = await Opti.collection('claims').upload(input.files[0])
await Opti.collection('claims').add({ who: 'Ada', receipt: ref })

await Opti.ai('What was the total?', { file: { collection: 'claims', id: ref.id } })

// Exact — the rows are computed, not read
const total = await Opti.ai('What was the total revenue, by region?',
  { data: { collection: 'orders', compute: true } })

// No arithmetic needed, so no sandbox — faster and cheaper
const mood = await Opti.ai('What are people unhappy about?',
  { data: { collection: 'feedback' } })

	What happens to it
Prose — handbooks, notes, policies, PDFs	Searched and quoted back
Spreadsheets and CSVs	Loaded into a sandbox and computed

	you fill in	typical of
A header	header name + credential	`Authorization: Bearer …`, `X-Api-Key`
A query parameter	parameter name + credential	keys that ride in the address, like `?api_key=`
A username and password	both halves	older internal APIs — the portal does the encoding
A client id and secret	token URL, client id, secret, optional scope	Salesforce, Marketo, Microsoft Graph
Several tokens, one chosen per call by a key	header name + an optional scheme (`Bearer`); the tokens come after saving	one Opal PAT per instance, one key per account or site

import { jwtVerify } from 'jose'

const { payload } = await jwtVerify(
  req.headers['x-opti-identity'],
  new TextEncoder().encode(process.env.OPTI_IDENTITY_SECRET),
  {
    issuer: 'https://deploy.optimizely.com',
    audience: 'jira',        // the connection name
    clockTolerance: '60s',   // your clock and ours are not the same clock — see below
  },
)
// payload.sub     the person's email — verified, not claimed
// payload.name    their display name
// payload.project which page called, as owner/slug

On a schedule — hourly, daily or weekly. Daily and weekly ask for a time in UTC; hourly does not, because it runs on every beat. Hourly is the shortest we offer: anything finer would be a promise the scheduler cannot keep. When you need seconds, use the arrival trigger below.
Whenever an entry arrives — it fires on each submission, in seconds, for the things that can't wait until tomorrow. It knows the specific entry, so it can ask a question about that one. ⚠️ "Arrives" means somebody or something submitted it — a form on your page, or another system posting to the inbound URL. Entries your own scheduled fetch writes don't count, so a fetch and an arrival trigger never chain into each other. ⚠️ Only the first time, unless you say otherwise. By default it fires when an entry is created and not when somebody edits it later — so a system that keeps updating the same record sets this off once, on the way in, however many times it writes afterwards. Tick "…and whenever one changes" under the trigger and a real change fires it as well, which is what you want for anything with state: a ticket's status, a build result, a headcount. Re-sending an identical row is not a change and does not count, so a sync that repeats itself every hour does not repeat the automation. It can also bring a related record with it. If the entry holds another record's id — a contact carrying its accountId, an order carrying its customer — name that collection and that field, and the matching record travels with it as related, beside the entry rather than merged into it. Pick which of its fields to send, or leave that empty for all of them. If the id is missing or matches nothing the automation still runs, and the run says which id it couldn't find. The id is the key that record was saved under — and an entry written by a form gets a generated one you never see. So the collection you look in usually wants importing with keys you choose, one per record (an account number, a CRM id), through PUT /api/ingest/{token}/{collection}/{key}. Then put that same value on the arriving entry. Matching on an ordinary field instead — "the account whose email is…" — is a search of that collection on every single arrival, which is why the lookup is by key and not by field.

Looking at the collection — "every Monday, tell me what arrived." It can go to a Teams channel, to your inbox, or to a named group of colleagues — email alone is fine, so you don't need a channel to get one.
Looking at an API — "every morning, call Jira and save the result." It calls one of your API connections on the timer and stores the reply in the collection, so the page reads data that's already fresh:
```
const status = await Opti.collection('status').doc('jira').get()
// { fetchedAt, source, value } — `value` is the reply
```
A fetch can also keep every result instead of overwriting one value, which is what turns it from today's answer into a history you can chart.

This is usually better than calling the API on every visit: nobody waits for it, you don't hammer the other system once per viewer, and a page nobody opened today is still current. It needs an API connection (not a channel), and it is always read-only — a scheduled job never writes to the other system. If a run fails, your last good data stays put rather than being replaced by an error.

	Who owns the project	What happens when that person leaves
Sharing / a group	You	It leaves with you
An editor	You	It leaves with you; they could only ever update it
A workspace	The workspace	Nothing. It stays, at the same link

Role	Can
Admin	Everything: add and remove people, deploy to any project the workspace owns, change its name
Can add projects	Add new projects, and update the ones they made
Can view	Open every project in the workspace

	What it is	Why it's here and not on a project
API connections	A saved credential your pages call by name — `Opti.call('jira', …)`	One key, for every project you tick it for. The secret is write-only: replace it, never read it back.
Channels	A Teams or Power Automate webhook, saved once with a name	Announce deploys, post form submissions, send digests — all to the same saved channel. Rotate the URL in one place.
Groups	A named list of people	Share a project with the group instead of naming everyone. Add someone once and they get every project it's on.
Access tokens	What can act as you — Claude, the CLI, a GitHub Action	They deploy into your namespace against your quota, so revoke rather than share.
Your requests	Support tickets and limit increases you filed	So you can see what you asked for without going hunting.

await Opti.sendMail({ to: 'jane.doe@optimizely.com', subject: 'Your request #142 has a reply', text: 'Hi Jane,\n\nIt is fixed.' })
// { sent: 1 }   — or { sent: 0, skipped } where email is not live
await Opti.sendMail({ to, subject, text, bell: true })        // email AND a line in their portal bell; the reply adds { bell }

await Opti.notify({ to: 'jane.doe@optimizely.com', title: 'Your request #142 has a reply' })   // the bell alone
// { bell: 1 }   — with bellFailed when some could not be saved

Call	What it does
`.add(data)`	Save a new entry. Stamped with who sent it, by the server
`.list({ limit, offset, where })`	Newest first. 50 by default, up to 5000 per call
`.page({ … })`	Same, plus `total`, `hasMore` and `nextCursor` — use it whenever you show a count
`.counts(field, { where })` · `.aggregate({ sum, avg, min, max, by }, { where })`	How many of each value, and how much — over the whole collection, not the page you fetched; `by` groups totals as `counts` groups. Both report `skipped` and `truncated`
`.all(opts?, onPage?)`	Every matching entry, paged for you. `onPage` renders progressively instead of freezing
`.update(id, data, { rev })`	Replace an entry. Pass `rev` and a clashing write gets a 409 instead of winning
`.remove(id)`	Delete one
`.upload(file)`	Store a file (up to 25 MB), get a reference to put in an entry

const rows = await Opti.collection('contacts').list({
  join: { collection: 'accounts', on: 'account_id', fields: ['name', 'tier'] },
})
rows[0].related     // { name: 'Acme', tier: 'gold' }
rows[0].data.name   // still the CONTACT's name — `related` sits beside data, never merged in

Call	What it does
`Opti.ai(prompt, { input, assistant, schema })`	Ask a model. Returns text, or parsed data when you pass a `schema`. It can search the web and run code. Off until the owner or a maintainer switches AI on
`Opti.sharepoint.search(query)` · `.read(url, { sheet? })`	SharePoint with no model in the way. `search` returns `{ results: [{ name, url, summary, lastModified }] }`; `read` returns `{ name, text }` for a document and `{ name, columns, rows }` for a spreadsheet or a SharePoint list; `read(url, { sheet })` reads a workbook's other tab by name. Nothing is summarised — no tokens, no allowance, nothing to hallucinate. Reads as whoever opened the page, so each person sees only their own documents. Needs no project setting — it runs on the reader's own Microsoft access
`Opti.directory.groups.mine()` · `.search(q)` · `.members(id)` · `Opti.directory.users.search(q)`	Who the reader is, beyond their name. `groups.mine()` gives the Entra groups the person reading the page belongs to, so one page can show action buttons to an SDR and hide them from a CSM. Every answer is `{ items, truncated }` — check `truncated` before saying "everyone". Colleagues only; the tenant is mostly customer and partner accounts and they are filtered out at the source. ⚠️ It tells you, it does not enforce. A visitor can read any of it in devtools, so hiding a control is a courtesy — what stops a write is the collection's own rule. Returns nothing on an external link
`Opti.call(connection, { path, method, body, key })`	Call another system through a saved API connection, by name. The credential stays on the server. `key` picks one of a connection holding several tokens — required there, never defaulted
`Opti.sendMail({ to, cc, subject, text })`	Email Optimizely addresses only, as whoever pressed the button; `bell: true` also rings their bell. See its section.
`Opti.notify({ to, cc, title })`	A line in the portal bell alone, no email. See its section.
`Opti.connectionKeys(connection)`	The keys of a connection holding several tokens — `[{ key, label, instance }]`, never a token. `instance` is there for an Opal PAT, because every Opal path carries it; a key for another platform simply has none. Loop over it for a page across every instance
`Opti.me()`	The signed-in visitor (`{ name, email }`), for display. The server decides who wrote what
`Opti.activity({ days })`	The project's Activity tab, as data: changes, API calls, automation runs and AI calls over the window, for the project's owners, editors and platform admins. `Opti.activity()` asks for a view with no one named for a call or a run and no model name, whoever opens the page. A log that could not be read is listed in `unread`
`Opti.analytics({ days })`	The project's Analytics tab, as data: visits over time and each person who opened the site, how often and when they last did. It answers the project's owners, editors and platform admins only, and throws the server's sentence for anyone else, so put it on a panel they open. `totals` covers the window; `viewers` covers all time, so the two counts of people need not match
`Opti.owner` · `Opti.app`	Who owns this project, and its slug
`Opti.basePath`	The prefix this page is served under — only needed by client-side routers
`Opti.ready`	True when the portal is serving the page (so it has a store)
`Opti.external`	True when the page is being served through an external link — to somebody outside Optimizely. `Opti.me()`, `Opti.owner` and `Opti.app` are all null there, so branch on this rather than assuming a name

await Opti.collection('signups')
  .page({ where: { path: 'status', op: 'eq', value: 'open' }, limit: 5000 })
// → { records, total, hasMore, offset, nextCursor?, nextUrl?, scanned, truncated? }

let cursor, rows = []
do {
  const p = await Opti.collection('signups').page({ limit: 1000, cursor })
  rows = [...rows, ...p.records]
  if (p.stoppedEarly) throw new Error(p.stoppedEarly)  // more rows, no link to them
  cursor = p.nextCursor          // absent once there is nothing left
} while (cursor)


Entries per collection	1,000,000
Collections	100 per project, 1,000 per person
Reading	50 per call by default, 5,000 maximum — pass `limit`, or you get 50
Response size	8 MB — a page comes back shorter, never silently cut
One entry	1 MB (a named `doc()` — the keyed kind you'd cache an API reply in — may be 1.5 MB); bigger wants a file, not a field
A filtered read	examines up to 10,000 entries, and tells you if it stopped early
A question	up to 4 conditions, ANDed — no `OR`
Batch write	200 add/update/remove per call — a different limit that happens to be 200
Ingest	10,000 entries a minute, per token — a project may hold 5, so the ceiling multiplies by the number of senders
File on an entry	25 MB
CSV import	8 MB

# Claude Code: install & register globally
npm install -g @anthropic-ai/claude-code
claude mcp add --scope user --transport http opti-deploy \
  https://deploy.optimizely.com/api/mcp

# Verify
claude mcp list

# Reset OAuth cache if anything's stuck
rm -rf ~/.mcp-auth

Resource	URL
Portal (dashboard)	https://deploy.optimizely.com
Get started (what it is, how to connect Claude)	https://deploy.optimizely.com/start
Access tokens (create, list, revoke)	https://deploy.optimizely.com/settings/tokens
MCP server URL	https://deploy.optimizely.com/api/mcp
Claude.ai connectors page	https://claude.ai/settings/connectors

Opti Deploy Portal — Employee Guide

What it does

Prerequisites

Five ways to deploy

🪄 Site Builder — start from a sentence, not a folder

Path 1 — Dashboard (drag & drop)

Re-deploys, versions & rollback

Which folder do I upload?

Path 2 — Claude & Opal (AI chat)

Claude.ai (web) & Claude Desktop

Opal

Claude Code (CLI)

Claude will confirm before deploying

Once connected — just ask

Path 3 — GitHub (push to deploy)

Very large builds — uploading straight to storage

Terminal / CI — a token and one curl

Managing a project — the card and the project page

The card, and the project page behind it

👥 Groups — share with a group, not a list

✏️ Editors — let a colleague deploy to your project

📋 What happened to my project — the Activity tab

🙋 Asking for access to someone else's project

Copying a project — Duplicate

Your app can store data — with no backend and no API key

Letting another system write to it — an ingest link

What the sending system actually POSTs

A page that can think — and search, and calculate

Assistants — give it your handbook, and every page can answer from it

Filled from the company warehouse — a data feed

📂 SharePoint — let it answer from documents you already have

One page, two audiences

If it says your sign-in cannot reach SharePoint

A page that needs an API key

Who is calling? — signed identity for your backend

Automations — a page that keeps itself up to date

Saying something about what it found

No page at all — a project that just collects

🌍 External link — somebody outside Optimizely

📈 Who visits my site — the Analytics tab

Your page — everything in one place

One star, two meanings

Saving a page someone shared with you

🔎 Browse — what colleagues have built

Workspaces — work that outlives whoever made it

Making one

Who can do what

Putting work in one

Winding one down

Settings — the things that aren't one project's

💬 OptiX — ask instead of hunting

✉️ Email and the bell from a page — a reply, a confirmation

Everything a page can call — one reference

Asking a collection a question — where, filter, sort and paging

Limits & policies

Troubleshooting

"Claude says it doesn't know how to deploy"

"Browser didn't open for sign-in"

"I get an OAuth error / invalid_client"

"Your MCP token has expired" / 401 from the server

Deploying from GitHub with no stored secret

"My GitHub deploy suddenly fails with 401"

"It asked me to sign in again"

"I want to disconnect everything" (lost laptop, leaked deploy token)

"Upload exceeds 250 MB"

"I'm at my deployment cap"

"My deployment broke after re-uploading"

Something else?

FAQ

Quick reference

Terminal / CI — a token and one `curl`

"I get an OAuth error / `invalid_client`"