---
{
  "id": "platform.space.creator-publishing",
  "topic": "space",
  "title": "Create, validate, preview, and publish a managed Space",
  "locale": "en",
  "version": "2026-08-25",
  "summary": "A first publish requires a strict space.json whose ID matches an owned OAuth Client ID, followed by bundle validation, a signed preview, safety scanning, and version publication.",
  "content": "Create an OAuth app with a custom Client ID and real redirect URI, put that ID in root `space.json`, then create a draft Space. Manifest ID and OAuth Client ID must match; the Space resource ID is a separate UUID. Unknown manifest fields fail. `version` must be a unique semantic version, `entry` an included `.html`, and `requestedScopes` must include `profile` and may add only `agents` or `economy`.\n\nZIP limits are 20 MiB uploaded, 512 files, 40 MiB decompressed, and 10 MiB per file. It requires root `space.json`, approved extensions, safe non-symlink paths, and no HTML `<base>`. The server validates and scans even after `arinova space build`. `declaredApiOrigins` allows eight unique bare HTTPS origins and must include the deployment API origin when the SDK calls it.\n\nBundle upload remains multipart REST, not an Action. After upload, the Agent can list versions, create a signed 15-minute preview, rescan, publish, roll back, or delete an inactive version. Publish, rollback, and deletion use UserConfirm + Strict; the active version cannot be deleted. Publish and rollback rescan, revoke Space tokens, and reconnect players. High risk returns HTTP 202, rejects the version, and leaves it unlisted. A passing rescan restores rejected to draft and closes its safety case. Five versions are retained while protecting active and pending-review versions. Listed-Space Actions are unavailable in public or restricted `space_api` conversations.\n",
  "aliases": [
    "publish a Space",
    "Space bundle error",
    "space.json",
    "Space OAuth client ID",
    "rejected Space version",
    "Space preview",
    "arinova space build"
  ],
  "tags": [
    "space",
    "publishing",
    "bundle",
    "oauth",
    "safety"
  ],
  "relatedActions": [
    "arinova.space.list_versions",
    "arinova.space.preview_version",
    "arinova.space.rescan_version",
    "arinova.space.publish_version",
    "arinova.space.rollback_version",
    "arinova.space.delete_version"
  ],
  "relatedActionPrefixes": [
    "arinova.space."
  ],
  "url": "https://docs.arinova.ai/en/kb/space/creator-publishing/"
}
---

Create an OAuth app with a custom Client ID and real redirect URI, put that ID in root `space.json`, then create a draft Space. Manifest ID and OAuth Client ID must match; the Space resource ID is a separate UUID. Unknown manifest fields fail. `version` must be a unique semantic version, `entry` an included `.html`, and `requestedScopes` must include `profile` and may add only `agents` or `economy`.

ZIP limits are 20 MiB uploaded, 512 files, 40 MiB decompressed, and 10 MiB per file. It requires root `space.json`, approved extensions, safe non-symlink paths, and no HTML `<base>`. The server validates and scans even after `arinova space build`. `declaredApiOrigins` allows eight unique bare HTTPS origins and must include the deployment API origin when the SDK calls it.

Bundle upload remains multipart REST, not an Action. After upload, the Agent can list versions, create a signed 15-minute preview, rescan, publish, roll back, or delete an inactive version. Publish, rollback, and deletion use UserConfirm + Strict; the active version cannot be deleted. Publish and rollback rescan, revoke Space tokens, and reconnect players. High risk returns HTTP 202, rejects the version, and leaves it unlisted. A passing rescan restores rejected to draft and closes its safety case. Five versions are retained while protecting active and pending-review versions. Listed-Space Actions are unavailable in public or restricted `space_api` conversations.