Signed upload links

Use a signed link when someone else should store a file on your account. Your server, signed in or using an API key, asks for the link. The other person uploads to that URL and does not need a Caskkeep account.

POST /api/uploads/sign HTTP/1.1
Host: caskkeep.com
Authorization: Bearer ck_live_your_secret
Content-Type: application/json

{
  "key": "inbox/report.bin",
  "visibility": "private",
  "sizeBytes": 2048,
  "expiresIn": 3600
}

expiresIn is optional. It must be at least 60 seconds and is capped by the plan. The response is { "url", "expiresAt" }.

The URL is checked again when it is used. It only accepts a write of that object at that exact size:

PUT /api/s3/private/inbox/report.bin?uploadToken=TOKEN HTTP/1.1
Host: caskkeep.com
Content-Type: application/octet-stream
x-caskkeep-size: 2048

A different object, a different size, a read, or an expired token is rejected. Multipart uploads keep uploadToken on the start request, every part, and the complete request. The size header on the start request must still be the size in the grant.

Creating the link also checks that the account can still upload and that the declared size fits. If the account runs out of space before the upload finishes, the upload stops and the unfinished file is removed.