A device identity instead of a mandatory user identity
On the first upload, the server creates a random claim token. The skill stores that token in its local InstaShare credentials file and sends it with later uploads from the same machine. The server stores a SHA-256 hash rather than the plaintext token.
Before the token is claimed, it groups shares without identifying a person. Once claimed through Google sign-in, the same token can associate past and future uploads with the account’s My shares page.
What claiming changes
Claiming does not make existing public URLs private. It adds account-level management: a list of owned shares, signed-in deletion, and a device list that shows where uploads originated.
- Earlier shares made with that device token are attached to the account.
- Later shares from the device appear automatically.
- The device can be revoked from the account page.
- Existing public links keep working until they are deleted.
Know which local files matter
The claim token is stored in a small credentials file under the local Claude/InstaShare directory. A separate sidecar next to each session remembers its public URL and delete token so re-sharing can update the same page.
Anyone who obtains one of these plaintext control tokens may be able to act with its authority. Keep credentials and sidecar files out of source control and avoid pasting them into conversations.