feat: allow never-expiring workspace tokens

[Zach Dunn (zachdunn)]

In plain terms

CI and scripts often want a workspace token that lives until someone revokes it. After #686 the developers page could only mint 90 days or 1 year. This adds a no-expiry option.

What it does / what it is not

• POST /v1/tokens accepts ttlSeconds: null and writes expires_at as null.
• /account/developers offers No expiry next to 90 days and 1 year.
• Omit ttlSeconds still means 90 days. uploads login is unchanged.
• Admin enrollment stays on the 365-day cap.
• Revoke is the only off switch for a never-expiring token.

Fixes #688.

How to try it

After API + web deploy (or a local stack on .localhost):

1. Sign in and open /account/developers.
2. Create a token with No expiry. Copy it.

export UPLOADS_TOKEN=up_<workspace>_...
uploads put ./shot.png

The list row should say no expiry.

Technical notes

Storage and workspaceAuth already treated a null expires_at as never-expiring. Only the public mint path refused it.

Test plan

• Token mint tests for ttlSeconds: null and rejected 0
• Typecheck for API and CLI
• Mint a no-expiry token on /account/developers after deploy

[changeset-bot]

🦋 Changeset detected

Latest commit: b2504c9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@buildinternet/uploads	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (2)

• coderabbit:review
• review

🚫 Excluded labels (none allowed) (1)

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 74e8d88e-3320-439a-879c-8e607c5b7582

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
🔵 In progress View logs	uploads-auth	06749b4	Aug 17 2026, 10:20 PM