Docs > Keybase Pages >
Experimental Please don't post this publicly without asking the Keybase team.

Getting Started with Keybase Pages

Keybase Pages serves static sites from the Keybase Filesystem or Keybase Git, under your own domain, with HTTPS certs issued by Let's Encrypt.

You can host a static site using Keybase Pages with two simple steps:

  1. Put the site content into the Keybase Filesystem or Keybase Git, in a folder (or repo) readable by our bot user kbpbot.

  2. Configure 2 DNS records for your domain to 1) direct traffic for the domain to the Keybase Pages servers, and 2) tell the Keybase Pages servers where to look for the site content.

Prepare or Update the Site

The simplest way to prepare a site is to copy a directory with static site content into a folder in Keybase Filesystem. This can be simply your public folder (/keybase/public/yourname), or a non-public folder that kbpbot has read access to. For example, /keybase/private/yourname,kbpbot or /keybase/team/aclu.bots (assuming kbpbot is a reader in aclu.bots).

If you prefer to deploy with git for easy atomic updates, you can also push your static site into a git repo. For example, keybase://private/yourname,kbpbot/my-site.git.

For example, to create a hello-world site in a shared folder with kbpbot:

mkdir /keybase/private/yourname,kbpbot/my-site
echo 'Hello, World!' > /keybase/private/yourname,kbpbot/my-site/index.html
mkdir my-site; cd my-site
echo 'Hello, World!' > index.html
git init . && git add . && git commit -m init
git remote add kbp keybase://private/yourname,kbpbot/my-site.git
git push kbp master

DNS Configuration

To delegate traffic handling to Keybase Pages, you'll need to configure your domain to point to the Keybase Pages endpoint This is usually done with a CNAME record. But if your DNS service supports A/AAAA ALIAS records, you may use that as well.

A second record is needed to specify the site's root so that Keybase Pages servers know where to serve the static site from. As described above, two types of roots are supported: KBFS paths and Git repos hosted on Keybase. This is done with a single TXT record on the _keybase_pages. subdomain under the domain that the site is on. For example, if you have a static site on, you need this TXT record on (in addition to the CNAME record on The value of the TXT record should be in one of the following formats:

  1. KBFS Path: "kbp=<kbfs_path>"
  2. Git Repo: "kbp=git@keybase:<private|public|team>/<folder_name>/<repo_name>"

You can generate the DNS records for your site using the following tool:


Note that we are using a 5-minute TTL here. After you are sure about your configuration, you can change it into something larger e.g. 3600 (1 hour).

Every domain registrar has a different UI for DNS configuration, so it's easy to get this wrong. To verify the DNS configuration you may use dig to query the configured domain. You should see something like this:


Note that this may not show up immediately, since there's generally a few minutes delay in DNS propagation for newly added records. If you are updating an existing record, the existing record's TTL is the upper bound of the propagation delay.

After the DNS propagation, your site should be up at 🎉

Access Controls

By default, Keybase Pages enables reading and listing for the entire site. If you prefer to turn off directory listing, or want a simple ACL control using HTTP Basic Authentication, you can provide an optional .kbp_config in your site root. See the .kbp_config doc for more details.