Overview
Canvas is Mixpeek’s application hosting platform. Build a web app using any frontend framework — React, Vue, Svelte, vanilla JS, or plain HTML — and deploy it as a zip bundle. Mixpeek handles hosting, CDN, auth, versioning, and the entire backend. Your app is live at{slug}.mxp.co the moment you deploy. No servers to manage, no infrastructure to configure, no API keys in your frontend code.
How it works
You write frontend code. Mixpeek provides everything else:- Hosting — your built assets (HTML, JS, CSS, images) are stored on S3 and served via CDN with immutable caching
- Backend proxy — all
/api/*requests are forwarded toapi.mixpeek.comwith your org’s API key and namespace injected server-side. Your credentials never reach the browser. - Runtime injection — the Canvas runtime injects
window.__MIXPEEK__into your HTML at serve time with auth config, environment variables, and monitoring hooks - Auth — optionally enable Clerk-powered sign-in (Google, GitHub, email) with per-app user management. The auth SDK is auto-injected — no libraries to install.
- Environments — deploy to staging (
staging-{slug}.mxp.co) or production ({slug}.mxp.co) independently - Versioning — every deploy creates an immutable version with content hash, commit message, and source files. Rollback instantly.
- Monitoring — error boundaries, Sentry, and PostHog are auto-injected for crash detection and usage analytics
Deploy from code
Upload any React, vanilla JS, or static site. Mixpeek serves it from S3 with CDN caching.
Custom domains
Default domain at
{slug}.mxp.co. Add your own subdomain via CNAME with auto TLS.Built-in auth
Clerk-powered sign-in (Google, GitHub, email) — auto-injected into your app with zero config.
User management
Invite members, assign roles, and control per-app access — powered by Clerk organizations.
Git-like version control
Every publish and deploy creates an immutable version with a content hash, message, and diffable snapshot.
Architecture
When a user visits{slug}.mxp.co, here’s the request lifecycle:
- DNS — resolves to the Canvas runtime (Cloudflare-proxied, DDoS protected)
- Routing — the Express server maps the hostname to your
app_id(cached in Redis). Supports{slug}.mxp.co,staging-{slug}.mxp.co, and custom domains. - HTML —
index.htmlis fetched from S3 and dynamically injected withwindow.__MIXPEEK__(runtime config, auth, monitoring) - Assets — JS, CSS, and images are served from S3 via CDN with immutable cache headers (content-hashed filenames → permanent caching)
- SPA routing — non-asset paths fall through to
index.htmlso client-side routing (React Router, etc.) works out of the box - API proxy —
/api/*requests are forwarded toapi.mixpeek.comwithAuthorizationandX-Namespaceheaders injected server-side
Your API key is never sent to the browser. The
/api proxy runs server-side and injects credentials on every request. Your frontend code only calls relative paths like /api/v1/retrievers/execute.Runtime config injection
The canvas runtime injects awindow.__MIXPEEK__ object into your app’s HTML at serve time:
Quickstart
Create an App in Studio
Go to Apps → Create App. Give it a name and a globally-unique slug — this becomes your default URL at
https://{slug}.mxp.co.Build your frontend
Write a React app (or any static site) that calls Mixpeek APIs via the canvas proxy. See the example below.
Deploy the bundle
In the App details page, drag & drop your
.zip onto the Deploy panel and click Deploy. Your build is queued immediately.Or via API:Canvas SDK
The canvas runtime injects credentials server-side — your API key never reaches the browser. Call any Mixpeek API through the/api proxy:
What /api supports
The proxy forwards all Mixpeek API methods with your org’s credentials injected:
| Category | Example paths |
|---|---|
| Retrievers | /api/v1/retrievers/{id}/execute, /api/v1/retrievers/list |
| Collections | /api/v1/collections/list, /api/v1/collections/{id} |
| Documents | /api/v1/documents/{id}, /api/v1/documents/list |
| Namespaces | /api/v1/namespaces/list |
| Batches | /api/v1/batches/list, /api/v1/batches/{id} |
| Tasks | /api/v1/tasks/{id}, /api/v1/tasks/list |
| Marketplace | /api/v1/marketplace/catalog/{name}/execute |
| Taxonomies | /api/v1/taxonomies/list, /api/v1/taxonomies/{id}/classify |
Use
/api/v1/... (relative path) instead of https://api.mixpeek.com/v1/... — the canvas proxy injects Authorization and X-Namespace headers automatically, avoiding CORS and keeping API keys out of your bundle.Using the Mixpeek JS SDK
You can also use themixpeek npm package pointed at /api:
Billing
All API calls through/api are billed to the organization that owns the canvas app. End-users don’t need their own Mixpeek API keys or accounts — usage is attributed to your org automatically.
Environments
Each app supports two independent environments:| Environment | URL | Use case |
|---|---|---|
| Staging | staging-{slug}.mxp.co | Test changes before going live |
| Production | {slug}.mxp.co | Live, user-facing deployment |
Deploying to staging
Set"environment": "staging" in the deploy request. Your staging build is live at https://staging-{slug}.mxp.co.
Promoting to production
Deploy the same bundle to production, or use the restore endpoint to point production at a staging version’s assets:Creating an App
Via Studio
Go to Apps → Create App. The wizard collects:- Name + Slug — the name is display-only; the slug becomes your URL (
{slug}.mxp.co) and must be globally unique - Access Control — choose how end-users authenticate (public, password, API key, JWT, or SSO)
Via API
Onlyslug and meta are required. After creation, deploy your code via the deploy pipeline.
Deploy lifecycle
Every deploy creates a new versioned build. The lifecycle is:| Stage | Description |
|---|---|
queued | Bundle uploaded, build queued |
building | Mixpeek is packaging and deploying your bundle |
complete | Build complete — app is live |
failed | Build failed — previous version stays live, check error message |
Operations
| Operation | What it does | Creates a version? |
|---|---|---|
Deploy (POST /v1/apps/{id}/deploy) | Upload and serve a new code bundle | Yes — with asset manifest and message |
Restore (POST /v1/apps/{id}/versions/{v}/restore) | Roll back to any previous version’s assets | No — instant redirect |
Promote (POST /v1/apps/{id}/promote) | Promote staging deploy to production | No — swaps environments |
Update (PATCH /v1/apps/{id}) | Update app config (auth, meta, etc.) | No |
Authentication modes
| Mode | Description |
|---|---|
public | Anyone can access — no login required |
password | Shared password gate |
api_key | Requires X-App-Key header |
clerk | Clerk-powered sign-in with per-app user management |
jwt | Customer-managed tokens |
sso_oidc | Okta, Auth0, Azure AD |
sso_saml | Enterprise SAML 2.0 IdP |
Auth enforcement activates when the canvas runtime is deployed. Config is stored now and takes effect automatically.
Custom domains
Every app gets a default URL athttps://{slug}.mxp.co. You can also add your own subdomain:
- Enter your subdomain (e.g.,
search.yourdomain.com) in the Domains panel - Add a DNS
CNAMErecord pointing to the target shown in the response - Click Verify — Mixpeek provisions a TLS certificate automatically via Cloudflare
Example apps
E-commerce product search
React app with multimodal search — text queries, image upload, and faceted filters backed by a Mixpeek retriever.
Internal knowledge base
Password-protected semantic search over company documents, PDFs, and meeting transcripts.
Media library
Video + image search portal with scene-level results, thumbnails, and timestamp previews.
Content moderation dashboard
Real-time moderation queue pulling from alert webhooks and showing flagged content with similarity scores.

