> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://uploadcare.com/docs/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://uploadcare.com/docs/_mcp/server.

## Signed uploads with JWT

[Signed uploads](/docs/security/secure-uploads/) now accept a JSON Web Token in the `Authorization: Bearer` header of Upload API requests. Unlike a signature, a token can be restricted:

* `uc.restrictions.scope` limits the upload methods the token allows, e.g. `["/base/"]` or `["/multipart/*"]`.
* `uc.restrictions.limits.operations` caps how many files the token may upload.

Tokens are signed with HS256 using the SHA-256 digest of your project secret key and live for up to 24 hours. The `signature` and `expire` parameters are now the legacy scheme. They keep working, and File Uploader still uses them. See the [signed uploads guide](/docs/security/secure-uploads/) for enabling the feature and the [Upload API authentication](/docs/api/upload/authentication/#jwt) reference for claims, examples, and the new error codes.