From d27f34bea8e22d380b6e2c3e6c90c25879ed579d Mon Sep 17 00:00:00 2001 From: Samraaj Bath Date: Mon, 29 Jun 2026 22:21:24 -0700 Subject: [PATCH] Update hosted signup docs --- README.md | 2 +- docs/DEPLOY.md | 2 +- docs/SERVICE.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index c0b55f2..a734c79 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ frozen capture in, byte-stable app out. - REST API: `https://api.ditto.site` - MCP server: `https://api.ditto.site/mcp` -Get a hosted key at `https://ditto.site/api-key`, or call the verified-email +Get a hosted key at `https://www.ditto.site/api-key`, or call the verified-email signup flow directly: ```bash diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md index df67bf8..62fb6f6 100644 --- a/docs/DEPLOY.md +++ b/docs/DEPLOY.md @@ -56,7 +56,7 @@ DEFAULT_SIGNUP_KEY_RATE_LIMIT=30 SIGNUP_DIRECT_ENABLED=false # recommended once verified email is configured RESEND_API_KEY=re_... SIGNUP_FROM_EMAIL=Ditto # must be a verified Resend sender/domain -SIGNUP_VERIFY_URL=https://ditto.site/api-key +SIGNUP_VERIFY_URL=https://www.ditto.site/api-key SIGNUP_TOKEN_TTL_MINUTES=30 SIGNUP_CORS_ORIGINS=https://ditto.site,https://www.ditto.site # browser origins allowed to call signup routes # SSRF is on by default; do NOT set SSRF_ALLOW_LOOPBACK in prod. diff --git a/docs/SERVICE.md b/docs/SERVICE.md index 4a1760d..504d429 100644 --- a/docs/SERVICE.md +++ b/docs/SERVICE.md @@ -143,7 +143,7 @@ List-then-read so a clone never floods the agent's context: | `SIGNUP_DIRECT_ENABLED` | api | `true` | keep direct `POST /v1/signup` enabled; set `false` when Resend verification is configured | | `RESEND_API_KEY` | api | — | enables verified-email signup request/verify endpoints | | `SIGNUP_FROM_EMAIL` | api | — | verified sender, e.g. `Ditto ` | -| `SIGNUP_VERIFY_URL` | api | — | landing-page URL that receives `?token=...`, e.g. `https://ditto.site/api-key` | +| `SIGNUP_VERIFY_URL` | api | — | landing-page URL that receives `?token=...`, e.g. `https://www.ditto.site/api-key` | | `SIGNUP_TOKEN_TTL_MINUTES` | api | `30` | one-time email verification token lifetime | | `SIGNUP_CORS_ORIGINS` | api | `https://ditto.site,https://www.ditto.site` | comma-separated browser origins allowed to call public signup routes | | `SSRF_DISABLE` | api | `false` | turn off the SSRF guard (not recommended) |