A developer API you can reason about
Everything the widget does goes through the same documented API, so you can build your own UI or automate around uploads. Errors have stable codes, every response carries a request ID, and lists use cursor pagination.
The problem
- Polling a storage bucket to find out whether a visitor finished is slow and brittle.
- Unsigned webhooks and at-most-once delivery lose events precisely when you need them.
How CrossUpload helps
Scoped credentials
Server API keys, desktop session capabilities and phone upload capabilities are separate credential classes with separate permissions.
Realtime that survives reconnects
Events are stored durably; the SSE stream resumes from Last-Event-ID, so restarts never lose a completion.
Signed webhooks
file.ready, file.rejected, session.completed and file.deleted, signed with timestamped HMAC-SHA256 and retried with exponential backoff.
Idempotency
Session creation accepts an Idempotency-Key header. Duplicate completion calls and webhook retries never double-count usage.
Questions
Is there an OpenAPI spec?
Yes — /openapi.yaml describes the implemented endpoints.