Signed uploads with JWT
Signed uploads now accept a JSON Web Token in the Authorization: Bearer header of Upload API requests. Unlike a signature, a token can be restricted:
uc.restrictions.scopelimits the upload methods the token allows, e.g.["/base/"]or["/multipart/*"].uc.restrictions.limits.operationscaps how many operations the token may spend (a direct upload spends one per file, the other upload methods one per request).
Tokens are signed with HS256 using the SHA-256 digest of your project secret key and live for up to 24 hours. The signature and expire parameters are now the legacy scheme. They keep working. See the signed uploads guide for enabling the feature and the Upload API authentication reference for claims, examples, and the new error codes.