v1.8.1 — Read private sites back, authenticated

Released 2026-07-19 · commit pending merge

Highlights

• dropfast fetch + a content API — pull a published file's raw bytes back over an authenticated request, so an agent can read a private or restricted site that a plain curl/webfetch can't reach.

What's new

Read a site's contents back — authenticated fetch

The browser URL for a private site (/s/<slug>/) sits behind a sign-in wall, so an agent that published a private artifact couldn't read it back with an ordinary fetch. This release adds an authenticated path that can: dropfast fetch <slug> [path] on the CLI, or GET /api/v1/sites/{slug}/content/{path} over REST.

# raw bytes of a private site, authorized off your API key
dropfast fetch my-slug report.html
 
# the REST equivalent
curl https://dropfast.dev/api/v1/sites/my-slug/content/report.html \
  -H "Authorization: Bearer df_sk_..."

It authorizes off your API key rather than a browser cookie, so the owner reads any mode and a grantee reads a restricted site — anything you may not read returns 404, never disclosing that the site exists. The bytes come back verbatim (no comments or beacon injection), ?v=N pins a historical version, and omitting the path returns the site index. Full details in the CLI and API docs.

← v1.8.0