Reference
Know the boundaries before production.
Current limits and security boundaries are intentionally explicit. Treat these as the supported baseline, not as a promise that an unlisted runtime or payment path will work.
Studio limits
ZIP upload
50 MB zipped, 250 MB extracted; up to 500 files and a valid HTML entry point are required.
Legacy builder import
500 files maximum, 5 MB per file, 50 MB total.
Legacy builder API request
8 MB request-body maximum.
Studio creative API request
2 MB request-body maximum.
Runtime
Static browser assets hosted from R2. No persistent server process or private runtime secret store is currently documented.
Default entry
index.html.
Default hostname
One permanent, generated, eight-character label under srstudio.dev per hosted app.
Custom domains
Hosted apps only; active Pro entitlement required for ordering.
Authentication boundaries
Studio session
Privy-backed browser authentication and embedded wallet behavior.
Agent session
Scoped personal token or device approval; wallet and purchase scopes are forbidden.
Connect session
Optional, separate SuperRare commerce/user session. It does not authenticate Studio.
RARE CLI key
Explicit chain signer used for NFT and protocol writes. Not related to a Studio token.
Chain and package status
@rareprotocol/rare-cli
2.0.0 latest; Node 22+; public npm and GitHub.
@rareprotocol/rare-profile
0.1.0 stable; public npm. Pin this version for Studio deployment.
@rareprotocol/connect
0.11.0 latest; public npm and GitHub. Production executes Ethereum mainnet; test on Sepolia with the dev API and Connect origins.
RARE chains
Mainnet, Sepolia, Base, and Base Sepolia are recognized; feature contracts vary by chain.
Production checklist
- 01Keep app source in a repository and verify exported ZIPs.
- 02Test the published build at the Studio URL before attaching a domain.
- 03Check DNS and SSL lifecycle states independently from deployment state.
- 04Use testnet/test configuration before an NFT or Connect production flow.
- 05Keep secrets, private keys, and privileged API credentials out of browser bundles.
- 06Use 1Password references or an equivalent secret manager for rare CLI signers.
- 07Render interrupted, pending, completed, failed, and retryable commerce states.
- 08Do not fulfill based only on a redirect; confirm the returned Connect intent outcome.
- 09Pin beta or source-only packages and retest before upgrading.
- 10Add abuse, phishing, copyright, and malware review before distributing untrusted uploads.