feat: mint workspace tokens from the developers page

[Zach Dunn (zachdunn)]

In plain terms

A signed-in developer can mint a workspace token from /account/developers and use it in curl, CI, or scripts without running uploads login. It is the same up_<workspace>_ token the CLI already mints, not a second credential type.

What it does / what it is not

• /account/developers mints, lists, and revokes tokens the signed-in user created. The secret is shown once.
• Tokens start with up_<workspace>_ and last 90 days by default, or 1 year. The CLI reads the workspace from the token.
• Members only see tokens they minted. Workspace admins still list every token on a workspace through the existing admin surface.
• This replaces the earlier Better Auth upl_sk_ key path. There is no second prefix or user-level key.
• uploads login is unchanged.

How to try it

After API deploy (or pnpm dev:stack locally):

1. Sign in and open /account/developers.
2. Pick a workspace, a label, and 90 days or 1 year. Create the token and copy it.

export UPLOADS_TOKEN=up_<workspace>_...
uploads put ./shot.png

Curl still names the workspace in the path:

curl -H "Authorization: Bearer up_<workspace>_..." \
  https://api.uploads.sh/v1/<workspace>/files/...

Technical notes

• Mint stays on session-authenticated POST /v1/tokens. New GET /v1/tokens/issued and DELETE /v1/tokens/:id are filtered by minting_user_id.
• /v1/tokens now uses credentialed CORS so the browser can send the session cookie, same as /v1/workspaces.
• No auth D1 migration ships. The previous apikey table migration is gone.

Test plan

• Token mint / issued list / own-token revoke tests
• Credentialed CORS tests for /v1/tokens
• Web parse helpers for mintable workspaces and issued tokens
• Auth revert tests (internal routes + retention)
• Typecheck for auth, API, web, and CLI
• Create a token on /account/developers against a running stack and PUT a file with it

[changeset-bot]

🦋 Changeset detected

Latest commit: 8839a23

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@buildinternet/uploads	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (2)

• coderabbit:review
• review

🚫 Excluded labels (none allowed) (1)

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 49cff471-ab09-419d-8165-4495fdaa3c76

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}