\n\n

Upload

Static file hosting service — HTML, images, media

\n\n \n

Upload

\n \n

\n\n \n

Recent Uploads

\n \n

\n\n \n

API Reference

\n\n

POST /upload

Upload a file via multipart/form-data. Returns JSON with the public URL of the uploaded file.

\n\n

Authentication

\n \n \n \n \n

Method	Detail
Bearer token	`Authorization: Bearer <token>`
Form field	`password` field in the multipart body

\n\n

Fields

\n \n \n \n \n \n \n \n

Field	Type		Detail
`file`	file	Required	HTML, PNG, JPEG, PDF, etc.
`filename`	text	Optional	Override filename in URL
`description`	text	Optional	Readable slug, stored as metadata
`expires_in`	text	Optional	`7d` (default), `14d`, or `never`
`password`	text	Optional	Auth token (alternative to header)

\n\n

Response

{ \"url\": \"/uploads/a3f1b2-my-report-dashboard.html\",\n  \"expiresAt\": \"2026-02-24T12:00:00.000Z\" }

\n\n

GET /uploads/{id}

Serves the file publicly before expiration. After expiration, requires authentication with the same token used for uploads.

\n\n

Examples

\n\n

Basic upload (defaults to 7-day expiration)

curl -X POST ${origin}/upload \\\\\n  -H \"Authorization: Bearer YOUR_TOKEN\" \\\\\n  -F \"file=@page.html\"

\n\n

Upload with 14-day expiration

curl -X POST ${origin}/upload \\\\\n  -H \"Authorization: Bearer YOUR_TOKEN\" \\\\\n  -F \"file=@report.pdf\" \\\\\n  -F \"expires_in=14d\"

\n\n

Upload without expiration

curl -X POST ${origin}/upload \\\\\n  -H \"Authorization: Bearer YOUR_TOKEN\" \\\\\n  -F \"file=@permanent.html\" \\\\\n  -F \"expires_in=never\"

\n\n

Retrieve after expiration (Basic Auth)

curl -u :YOUR_TOKEN ${origin}/uploads/a3f1b2-report.pdf

\n\n

Expiration Behavior

Default: All uploads expire after 7 days.

\n\n

Before expiration: Files are publicly accessible with no authentication required.

\n\n

After expiration: Files require authentication using your UPLOAD_TOKEN via:

HTTP Basic Auth: curl -u :YOUR_TOKEN <url>

\n\n

URL Format

IDs follow the pattern {hex}-{slug}-{filename}

\n \n \n \n \n \n

Provided	Example
File only	`/uploads/a3f1b2-screenshot.png`
+ filename	`/uploads/a3f1b2-hero.png`
+ description	`/uploads/a3f1b2-team-photo-hero.png`

\n\n

Limits

10 MB maximum file size.
Accepted: HTML, CSS, JS, JSON, images, audio, video, PDF.

\n\n \n\n

\n \n\n`;\n}\n\n// --- Main Handler ---\nexport default async function(req: Request): Promise {\n const url = new URL(req.url);\n\n // GET / — show upload form + API docs\n if (req.method === \"GET\" && url.pathname === \"/\") {\n return new Response(buildUploadFormHtml(url.origin), {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n }\n\n // POST /upload — authenticated file upload\n if (req.method === \"POST\" && url.pathname === \"/upload\") {\n let formData: FormData;\n try {\n formData = await req.formData();\n } catch {\n return jsonResponse({ error: \"Invalid form data. Send multipart/form-data with a 'file' field.\" }, 400);\n }\n\n const password = formData.get(\"password\")?.toString();\n\n if (!authenticate(req, password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n const file = formData.get(\"file\");\n if (!(file instanceof File)) {\n return jsonResponse({ error: \"No file provided. Include a 'file' field in your form data.\" }, 400);\n }\n\n const rawBytes = new Uint8Array(await file.arrayBuffer());\n if (rawBytes.length === 0) {\n return jsonResponse({ error: \"File is empty.\" }, 400);\n }\n if (rawBytes.length > MAX_SIZE) {\n return jsonResponse({ error: `File too large. Max size is ${MAX_SIZE / 1024 / 1024}MB.` }, 413);\n }\n\n const contentType = file.type || \"application/octet-stream\";\n if (!isAllowedType(contentType)) {\n return jsonResponse({ error: `Content type '${contentType}' is not allowed.` }, 415);\n }\n\n const filenameOverride = formData.get(\"filename\")?.toString().trim() || undefined;\n const description = formData.get(\"description\")?.toString().trim() || undefined;\n const expiresIn = formData.get(\"expires_in\")?.toString().trim() || undefined;\n\n const expiresAt = resolveExpiration(expiresIn);\n if (expiresAt === undefined) {\n return jsonResponse({ error: \"Invalid expires_in value. Use '7d', '14d', or 'never'.\" }, 400);\n }\n\n const compressed = await gzip(rawBytes);\n const id = buildUploadId({\n description,\n filenameOverride,\n originalName: file.name || \"upload\",\n });\n\n try {\n await sqlite.execute({\n sql: \"INSERT INTO uploads (id, content_type, description, data, expires_at) VALUES (?, ?, ?, ?, ?)\",\n args: [id, contentType, description ?? null, compressed, expiresAt],\n });\n } catch (err: any) {\n // Handle unlikely collision — retry with longer hex prefix\n if (err.message?.includes(\"UNIQUE constraint\")) {\n const retryId = `${randomHex(5)}-${id.slice(7)}`; // replace 6-char hex with 10-char\n await sqlite.execute({\n sql: \"INSERT INTO uploads (id, content_type, description, data, expires_at) VALUES (?, ?, ?, ?, ?)\",\n args: [retryId, contentType, description ?? null, compressed, expiresAt],\n });\n return jsonResponse({\n url: `/uploads/${retryId}`,\n id: retryId,\n filename: filenameOverride || file.name || \"upload\",\n description: description ?? null,\n contentType,\n size: rawBytes.length,\n createdAt: new Date().toISOString(),\n expiresAt,\n });\n }\n throw err;\n }\n\n return jsonResponse({\n url: `/uploads/${id}`,\n id,\n filename: filenameOverride || file.name || \"upload\",\n description: description ?? null,\n contentType,\n size: rawBytes.length,\n createdAt: new Date().toISOString(),\n expiresAt,\n });\n }\n\n // GET /uploads/{id} — serve uploaded content\n const uploadMatch = url.pathname.match(/^\\/uploads\\/(.+)$/);\n if (req.method === \"GET\" && uploadMatch) {\n const id = decodeURIComponent(uploadMatch[1]);\n\n const result = await sqlite.execute({\n sql: \"SELECT content_type, data, expires_at FROM uploads WHERE id = ?\",\n args: [id],\n });\n\n if (!result.rows.length) {\n return new Response(\"Not Found\", { status: 404 });\n }\n\n const row = result.rows[0];\n const contentType = (row as any).content_type;\n const data = (row as any).data;\n const expiresAt = (row as any).expires_at;\n\n // Check if file has expired\n if (expiresAt) {\n const now = new Date();\n const expiry = new Date(expiresAt);\n\n if (now > expiry) {\n // File has expired — require UPLOAD_TOKEN via Basic Auth or ?password=\n if (!checkBasicAuth(req)) {\n return new Response(\"Unauthorized: This file has expired and requires authentication.\", {\n status: 401,\n headers: {\n \"WWW-Authenticate\": 'Basic realm=\"Expired Upload\", charset=\"UTF-8\"',\n \"Content-Type\": \"text/plain\",\n },\n });\n }\n }\n }\n\n // Convert data to Uint8Array if needed\n const bytes = data instanceof Uint8Array ? data : new Uint8Array(data);\n\n const acceptEncoding = req.headers.get(\"Accept-Encoding\") || \"\";\n if (acceptEncoding.includes(\"gzip\")) {\n return new Response(bytes, {\n headers: {\n \"Content-Type\": contentType,\n \"Content-Encoding\": \"gzip\",\n \"Cache-Control\": \"public, max-age=31536000, immutable\",\n \"Vary\": \"Accept-Encoding\",\n },\n });\n }\n\n // Rare fallback: client doesn't support gzip\n const decompressed = await gunzip(bytes);\n return new Response(decompressed, {\n headers: {\n \"Content-Type\": contentType,\n \"Cache-Control\": \"public, max-age=31536000, immutable\",\n },\n });\n }\n\n return new Response(\"Not Found\", { status: 404 });\n}\n\nfunction jsonResponse(data: Record, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"Content-Type\": \"application/json\" },\n });\n}\n","deleted","label","p6r-uploads",[110],"pulls","branches",1,"forks","envVars",{"_135":129,"_137":39},"connections",{"_135":39,"_136":39},"count","unfilledCount","emptyCount",{"_18":109,"_20":110,"_111":112,"_113":-5,"_114":68,"_115":66,"_116":103,"_22":139,"_65":118,"_119":120,"_121":122,"_123":26,"_124":125,"_140":141,"_85":142},["D",1775582038582],"children",[],[110],["D",1770764947473],["D",1789534231467],{"_16":17,"_83":79},{"_16":17,"_77":-5,"_78":79,"_32":33,"_80":81,"_82":26},{"_65":66,"_20":67,"_18":68,"_69":19,"_70":-5,"_71":-5,"_72":-5,"_73":-5,"_74":-5,"_75":21,"_76":17},"ctx",{"_58":-5,"_105":181,"_182":183,"_184":185,"_186":26,"_187":26,"_188":26,"_189":103,"_190":-5,"_191":-7,"_192":-7,"_193":39,"_194":26,"_195":26,"_196":-5,"_197":26,"_198":26,"_199":26,"_200":-5},"ENV",{"_152":153,"_154":155,"_156":67,"_157":158,"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Search