documentation / build
Security
Keep your identity, your organization's access, and your application credentials separate.
- Verify the email address you sign up or accept an invitation with.
- Two-factor authentication and passkeys are optional. Once you turn one on, Uploadfile checks it at every sign-in.
- Store recovery codes privately. Each code works once.
- Review active sessions and revoke devices you no longer use.
- Ownership and billing changes need a sign-in within the last hour, or a fresh second-factor check if you use one.
Owners control ownership, privileged roles, application transfer, deletion, and closure. Admins and developers manage application files and keys. Billing members manage payments and plans and can't open file contents. Viewers see metadata only.
The backend checks membership and permissions on every request, so a hidden dashboard button is never the only thing stopping an action.
Keep UPLOADFILE_TOKEN in your server's secret store, never in client code or source control. Create a separate key for each integration, and rotate keys after any exposure or application transfer.
Keep signed file URLs, upload URLs, callback signatures, and recovery codes out of analytics and support logs.
Uploadfile signs every completion and error callback with HMAC-SHA256 over the raw request body, using your API key. The uploadfile-hook header is callback or error, and x-uploadfile-signature carries hmac-sha256=<hex>.
The SDK route handlers verify the signature before your onUploadComplete runs. You only need to check it yourself if you write your own callback handler.