\n\n

Upload

Static file hosting service — HTML, images, media

\n\n \n

Upload

\n \n

\n\n \n

Recent Uploads

\n \n

\n\n \n

API Reference

\n\n

POST /upload

Upload a file via multipart/form-data. Returns JSON with the public URL of the uploaded file.

\n\n

Authentication

\n \n \n \n \n

Method	Detail
Bearer token	`Authorization: Bearer <token>`
Form field	`password` field in the multipart body

\n\n

Fields

\n \n \n \n \n \n \n \n

Field	Type		Detail
`file`	file	Required	HTML, PNG, JPEG, PDF, etc.
`filename`	text	Optional	Override filename in URL
`description`	text	Optional	Readable slug, stored as metadata
`expires_in`	text	Optional	`7d` (default), `14d`, or `never`
`password`	text	Optional	Auth token (alternative to header)

\n\n

Response

{ \"url\": \"/uploads/a3f1b2-my-report-dashboard.html\",\n  \"expiresAt\": \"2026-02-24T12:00:00.000Z\" }

\n\n

GET /uploads/{id}

Serves the file publicly before expiration. After expiration, requires authentication with the same token used for uploads.

\n\n

Examples

\n\n

Basic upload (defaults to 7-day expiration)

curl -X POST ${origin}/upload \\\\\n  -H \"Authorization: Bearer YOUR_TOKEN\" \\\\\n  -F \"file=@page.html\"

\n\n

Upload with 14-day expiration

curl -X POST ${origin}/upload \\\\\n  -H \"Authorization: Bearer YOUR_TOKEN\" \\\\\n  -F \"file=@report.pdf\" \\\\\n  -F \"expires_in=14d\"

\n\n

Upload without expiration

curl -X POST ${origin}/upload \\\\\n  -H \"Authorization: Bearer YOUR_TOKEN\" \\\\\n  -F \"file=@permanent.html\" \\\\\n  -F \"expires_in=never\"

\n\n

Retrieve after expiration (Basic Auth)

curl -u :YOUR_TOKEN ${origin}/uploads/a3f1b2-report.pdf

\n\n

Expiration Behavior

Default: All uploads expire after 7 days.

\n\n

Before expiration: Files are publicly accessible with no authentication required.

\n\n

After expiration: Files require authentication using your UPLOAD_TOKEN via:

HTTP Basic Auth: curl -u :YOUR_TOKEN <url>

\n\n

URL Format

IDs follow the pattern {hex}-{slug}-{filename}

\n \n \n \n \n \n

Provided	Example
File only	`/uploads/a3f1b2-screenshot.png`
+ filename	`/uploads/a3f1b2-hero.png`
+ description	`/uploads/a3f1b2-team-photo-hero.png`

\n\n

Limits

10 MB maximum file size.
Accepted: HTML, CSS, JS, JSON, images, audio, video, PDF.

\n\n \n\n

\n \n\n`;\n}\n\n// --- Main Handler ---\nexport default async function(req: Request): Promise {\n const url = new URL(req.url);\n\n // GET / — show upload form + API docs\n if (req.method === \"GET\" && url.pathname === \"/\") {\n return new Response(buildUploadFormHtml(url.origin), {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n }\n\n // POST /upload — authenticated file upload\n if (req.method === \"POST\" && url.pathname === \"/upload\") {\n let formData: FormData;\n try {\n formData = await req.formData();\n } catch {\n return jsonResponse({ error: \"Invalid form data. Send multipart/form-data with a 'file' field.\" }, 400);\n }\n\n const password = formData.get(\"password\")?.toString();\n\n if (!authenticate(req, password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n const file = formData.get(\"file\");\n if (!(file instanceof File)) {\n return jsonResponse({ error: \"No file provided. Include a 'file' field in your form data.\" }, 400);\n }\n\n const rawBytes = new Uint8Array(await file.arrayBuffer());\n if (rawBytes.length === 0) {\n return jsonResponse({ error: \"File is empty.\" }, 400);\n }\n if (rawBytes.length > MAX_SIZE) {\n return jsonResponse({ error: `File too large. Max size is ${MAX_SIZE / 1024 / 1024}MB.` }, 413);\n }\n\n const contentType = file.type || \"application/octet-stream\";\n if (!isAllowedType(contentType)) {\n return jsonResponse({ error: `Content type '${contentType}' is not allowed.` }, 415);\n }\n\n const filenameOverride = formData.get(\"filename\")?.toString().trim() || undefined;\n const description = formData.get(\"description\")?.toString().trim() || undefined;\n const expiresIn = formData.get(\"expires_in\")?.toString().trim() || undefined;\n\n const expiresAt = resolveExpiration(expiresIn);\n if (expiresAt === undefined) {\n return jsonResponse({ error: \"Invalid expires_in value. Use '7d', '14d', or 'never'.\" }, 400);\n }\n\n const compressed = await gzip(rawBytes);\n const id = buildUploadId({\n description,\n filenameOverride,\n originalName: file.name || \"upload\",\n });\n\n try {\n await sqlite.execute({\n sql: \"INSERT INTO uploads (id, content_type, description, data, expires_at) VALUES (?, ?, ?, ?, ?)\",\n args: [id, contentType, description ?? null, compressed, expiresAt],\n });\n } catch (err: any) {\n // Handle unlikely collision — retry with longer hex prefix\n if (err.message?.includes(\"UNIQUE constraint\")) {\n const retryId = `${randomHex(5)}-${id.slice(7)}`; // replace 6-char hex with 10-char\n await sqlite.execute({\n sql: \"INSERT INTO uploads (id, content_type, description, data, expires_at) VALUES (?, ?, ?, ?, ?)\",\n args: [retryId, contentType, description ?? null, compressed, expiresAt],\n });\n return jsonResponse({\n url: `/uploads/${retryId}`,\n id: retryId,\n filename: filenameOverride || file.name || \"upload\",\n description: description ?? null,\n contentType,\n size: rawBytes.length,\n createdAt: new Date().toISOString(),\n expiresAt,\n });\n }\n throw err;\n }\n\n return jsonResponse({\n url: `/uploads/${id}`,\n id,\n filename: filenameOverride || file.name || \"upload\",\n description: description ?? null,\n contentType,\n size: rawBytes.length,\n createdAt: new Date().toISOString(),\n expiresAt,\n });\n }\n\n // GET /uploads/{id} — serve uploaded content\n const uploadMatch = url.pathname.match(/^\\/uploads\\/(.+)$/);\n if (req.method === \"GET\" && uploadMatch) {\n const id = decodeURIComponent(uploadMatch[1]);\n\n const result = await sqlite.execute({\n sql: \"SELECT content_type, data, expires_at FROM uploads WHERE id = ?\",\n args: [id],\n });\n\n if (!result.rows.length) {\n return new Response(\"Not Found\", { status: 404 });\n }\n\n const row = result.rows[0];\n const contentType = (row as any).content_type;\n const data = (row as any).data;\n const expiresAt = (row as any).expires_at;\n\n // Check if file has expired\n if (expiresAt) {\n const now = new Date();\n const expiry = new Date(expiresAt);\n\n if (now > expiry) {\n // File has expired — require UPLOAD_TOKEN via Basic Auth or ?password=\n if (!checkBasicAuth(req)) {\n return new Response(\"Unauthorized: This file has expired and requires authentication.\", {\n status: 401,\n headers: {\n \"WWW-Authenticate\": 'Basic realm=\"Expired Upload\", charset=\"UTF-8\"',\n \"Content-Type\": \"text/plain\",\n },\n });\n }\n }\n }\n\n // Convert data to Uint8Array if needed\n const bytes = data instanceof Uint8Array ? data : new Uint8Array(data);\n\n const acceptEncoding = req.headers.get(\"Accept-Encoding\") || \"\";\n if (acceptEncoding.includes(\"gzip\")) {\n return new Response(bytes, {\n headers: {\n \"Content-Type\": contentType,\n \"Content-Encoding\": \"gzip\",\n \"Cache-Control\": \"public, max-age=31536000, immutable\",\n \"Vary\": \"Accept-Encoding\",\n },\n });\n }\n\n // Rare fallback: client doesn't support gzip\n const decompressed = await gunzip(bytes);\n return new Response(decompressed, {\n headers: {\n \"Content-Type\": contentType,\n \"Cache-Control\": \"public, max-age=31536000, immutable\",\n },\n });\n }\n\n return new Response(\"Not Found\", { status: 404 });\n}\n\nfunction jsonResponse(data: Record, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"Content-Type\": \"application/json\" },\n });\n}\n","deleted","label","p6r-uploads","children",[],[159],"files",[157],"counts",{"_183":33,"_184":185,"_186":33,"_187":188,"_191":192},"pulls","branches",1,"forks","envVars",{"_189":185,"_190":33},"count","emptyCount","connections",{"_189":33,"_193":33},"unfilledCount","contents",[196],{"_104":158,"_97":159,"_160":161,"_162":-5,"_163":145,"_164":144,"_165":166,"_106":197,"_101":168,"_169":170,"_171":172,"_173":22,"_174":175,"_100":198},["D",1771336721536],[159],"file","upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.environment-variables",{"_95":96,"_97":98,"_102":208,"_187":213,"_221":22},{"_104":105,"_97":98,"_106":209,"_108":-5,"_109":22,"_110":111,"_112":-5,"_113":-5,"_14":114,"_115":-5,"_116":22,"_117":-5,"_118":-5,"_119":33,"_16":120,"_121":122,"_123":124,"_125":126,"_127":126,"_128":129,"_130":129,"_131":129,"_132":126,"_133":126,"_23":210,"_137":211,"_142":212,"_154":22},["D",1770764947473],{"_95":96,"_135":136},{"_95":96,"_139":136,"_14":114,"_140":141},{"_101":144,"_97":45,"_104":145,"_146":105,"_147":-5,"_148":-5,"_149":-5,"_150":-5,"_151":-5,"_152":98,"_153":96},[214],{"_215":216,"_106":217,"_218":-5,"_112":219,"_220":22},"key","UPLOAD_TOKEN",["D",1770765280495],"updatedAt","Secret token for authenticating uploads. Use as Bearer token or form password field.","isEmpty","isTeamOrg","actionData","errors"]

colel

upload-single-page-html

Environment variables