UploadThing API
UploadThing provides file upload infrastructure with a typed file router defined server-side, enabling clients to upload files directly to cloud storage with access control, type validation, and metadata callbacks without exposing storage credentials to the client.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
API key is server-side only by design — the SDK architecture enforces that clients never see storage credentials. However, scope granularity is limited (one API key, no per-operation scopes). Open-source codebase allows security review.
⚡ Reliability
Best When
A Next.js or React application needs to add typed, secure file uploads in minutes without managing S3 buckets, presigned URLs, or file size/type validation infrastructure.
Avoid When
You need image transformations, CDN optimization, or are building outside the JavaScript/TypeScript ecosystem.
Use Cases
- • Uploading user-submitted files (images, documents, videos) from a web app to cloud storage without building custom upload endpoints
- • Enforcing file type and size limits declaratively in a file router before accepting uploads
- • Triggering server-side callbacks after file upload completes to process or persist metadata in the agent workflow
- • Generating presigned upload URLs server-side for secure direct-to-storage client uploads
- • Building file upload flows in Next.js or React apps with minimal infrastructure setup
Not For
- • Non-web or server-to-server file uploads where the client-side SDK adds no value
- • Large-scale media processing pipelines requiring transformation, CDN delivery, or DAM features (use Cloudinary instead)
- • Enterprise file storage requiring detailed access controls, versioning, or compliance workflows
Interface
Authentication
Single API key from uploadthing.com dashboard used server-side only. Client-side upload uses short-lived tokens issued by the server-side file router — storage credentials are never exposed to the browser. The file router also supports custom middleware for per-request auth checks (e.g., validate session before allowing upload).
Pricing
Simple storage + bandwidth pricing model. Free tier is sufficient for development and small projects. Paid plans are straightforward compared to credit-based systems like Cloudinary.
Agent Metadata
Known Gotchas
- ⚠ File router must be deployed server-side — agents cannot use UploadThing in a purely serverless function without a persistent router endpoint
- ⚠ Upload tokens are short-lived and tied to the requesting session — agents cannot pre-generate tokens for later use
- ⚠ No built-in deduplication — uploading the same file twice produces two separate stored objects with different keys
- ⚠ Rate limits are undocumented — high-frequency agent uploads may encounter unspecified throttling
- ⚠ SDK is JavaScript/TypeScript only — non-JS agents must use the raw HTTP API which has less documentation coverage
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for UploadThing API.
Scores are editorial opinions as of 2026-03-06.