GoDrop

Upload a file, get a hard-to-guess URL.
Written in Go: one binary, no database.

Uploading photo.jpg with curl and getting back a hard-to-guess URL

Install

curl -fsSL https://godrop.sh/install.sh | sh

The script verifies the release checksum before installing anything, then hands over to godrop init, which writes the configuration, creates your first token and checks that the internet can actually reach your server.

Use it

1 Upload, with a token

curl -X POST -H "Authorization: Bearer $GODROP_TOKEN" \
  -F "file=@photo.jpg" https://files.example.com/upload

and back comes the URL

{
  "files": [{ "url": "https://files.example.com/f/20260815-143022-8f4e…/photo.jpg",
             "name": "photo.jpg", "size_bytes": 12345 }]
}

2 Share it, no token needed

curl -O https://files.example.com/f/20260815-143022-8f4e…/photo.jpg

The 128 random bits in the name are the only key. Anyone with the link can read it; nobody can find it by guessing.

3 Delete it when you are done

curl -X DELETE -H "Authorization: Bearer $GODROP_TOKEN" \
  https://files.example.com/f/20260815-143022-8f4e…/photo.jpg

Or set GODROP_RETENTION=30d and let it clean up after itself.

HTTPS, without a proxy

On a public domain GoDrop gets its own certificate from Let's Encrypt and renews it. Two lines, no Caddy, no nginx, no certbot: 

GODROP_TLS=auto
GODROP_BASE_URL=https://files.example.com

Open ports 443 and 80 on the server and in your cloud provider's firewall: 80 is where the certificate challenge is answered. Already have a certificate? Point GODROP_TLS_CERT and GODROP_TLS_KEY at it instead. Behind a proxy or on a private network, leave TLS off and nothing changes.

What it does

Unguessable URLs128 random bits per file. No listing endpoint, by design.
No databaseFiles on disk, identifiers that carry their own location.
Public downloadsUploads and deletes need a token; reading never does.
Real limitsSize, quota, retention and rate limits, all configurable.
Agent-nativeEvery command speaks --json; the server serves /llms.txt.
HTTPS built inGODROP_TLS=auto and the certificate looks after itself.
Diagnosablegodrop doctor checks storage, firewall, TLS and reachability.

For AI agents

Give an agent two values, a base URL and a token, and it can work out the rest by itself. Every instance describes its own API, with the limits that instance actually enforces: 

curl https://files.example.com/llms.txt      # the whole API in plain text
curl https://files.example.com/openapi.yaml  # machine-readable schema

This site has one too, describing the project rather than an instance: godrop.sh/llms.txt.

There is a ready-made agent skill, which GoDrop installs itself: 

godrop skill install --scope user
# or, for any of the other agents:
gh skill install fatihbaltaci/GoDrop godrop --scope user

Run it anywhere