Signed uploads with JWT
Signed uploads now accept a JSON Web Token in the Authorization: Bearer header of Upload API requests. Unlike a signature, a token can be restricted:
uc.restrictions.scopelimits the upload methods the token allows, e.g.["/base/"]or["/multipart/*"].uc.restrictions.limits.operationscaps how many files the token may upload.
Tokens are signed with HS256 using the SHA-256 digest of your project secret key and live for up to 24 hours. The signature and expire parameters are now the legacy scheme. They keep working, and File Uploader still uses them. See the signed uploads guide for enabling the feature and the Upload API authentication reference for claims, examples, and the new error codes.