# GoDrop

Upload a file, get a hard-to-guess URL. Downloads are public; uploads work
with or without a token.

Base URL: https://drop.godrop.sh

## Without a token

Anything you upload without a token is deleted two hours later. Nothing to
sign up for, nothing to configure.

    curl -sS -X PUT --data-binary @report.pdf \
      "https://drop.godrop.sh/upload/report.pdf"

## With a token

A token makes uploads last 90 days and keeps them yours.

    curl -sS -X PUT --data-binary @report.pdf \
      -H "Authorization: Bearer $GODROP_TOKEN" \
      "https://drop.godrop.sh/upload/report.pdf"

## Endpoints

POST   /upload            multipart/form-data, one or more parts named "file"
PUT    /upload/{name}     the request body is the file
GET    /f/{id}/{name}     download, public, no token
GET    /f/{id}.{ext}      the same file, short form
DELETE /f/{id}/{name}     delete, token required, only your own files
GET    /healthz           liveness
GET    /stats             what this instance enforces
POST   /mcp               Model Context Protocol, revision 2026-07-28
GET    /openapi.yaml      the same API, machine readable

## The answer to an upload

    {"files":[{"url":"...","name":"report.pdf","size_bytes":12345}]}

Read .files[0].url. The shape is the same whatever you sent, so there is no
branching to do. The same URL is in the Location header.

## Limits

Largest file: 100 MB
Files per multipart request: 20
Anonymous uploads live for: 2 hours
Uploads with a token live for: 90 days

## Expiry

Ask for a shorter life with a header or a query parameter:

    -H "X-Expires-In: 30m"      or      ?expires=30m

Accepted: 30m, 12h, 7d. An anonymous upload cannot ask for longer than two
hours.

## What this is not

There is no listing endpoint. The identifier carries 128 bits of entropy and
is the only way to reach a file; if you lose the URL, the file is gone.