# OTA Updates

SyncKit OTA provides an auto-update server for desktop applications. It implements the Tauri updater protocol, so Tauri apps work out of the box. Non-Tauri apps can use the same HTTP endpoints directly.

## Setup

### 1. Register a Slug

Each app needs a URL slug for the update endpoint. Set it on your SyncKit app:

```
PUT /api/sync/ota/apps/{app_id}/slug
Authorization: Bearer <token>
Content-Type: application/json

{
  "slug": "my-app"
}
```

Slugs must be 3-40 characters, lowercase alphanumeric with hyphens. This slug appears in the public update check URL.

### 2. Create a Release

```
POST /api/sync/ota/apps/{app_id}/releases
Authorization: Bearer <token>
Content-Type: application/json

{
  "version": "1.2.0",
  "notes": "Bug fixes and performance improvements",
  "signature": "<base64-encoded-signature>"
}
```

Response:

```json
{
  "id": "880b1700-...",
  "version": "1.2.0",
  "notes": "Bug fixes and performance improvements",
  "signature": "<base64-encoded-signature>",
  "pub_date": "2026-03-13T12:00:00Z",
  "created_at": "2026-03-13T12:00:00Z"
}
```

Version must be valid semver (`X.Y.Z`, optionally with pre-release or build metadata).

### 3. Upload Artifacts

For each platform/architecture combination, request a presigned upload URL and upload the binary:

```
POST /api/sync/ota/apps/{app_id}/releases/{release_id}/artifacts
Authorization: Bearer <token>
Content-Type: application/json

{
  "target": "darwin",
  "arch": "aarch64",
  "file_size": 52428800
}
```

Response:

```json
{
  "upload_url": "https://s3.example.com/...",
  "s3_key": "ota/my-app/1.2.0/darwin-aarch64"
}
```

Upload the binary directly to the presigned URL with a PUT request.

Target values: `linux`, `darwin`, `windows`. Arch values: `x86_64`, `aarch64`.

## Update Check Endpoint

Public, no authentication required. Compatible with Tauri's built-in updater.

```
GET /api/sync/ota/{slug}/{target}/{arch}/{current_version}
```

Example:

```
GET /api/sync/ota/my-app/darwin/aarch64/1.1.0
```

### Update Available (200)

```json
{
  "version": "1.2.0",
  "url": "https://makenot.work/api/sync/ota/my-app/download/880b1700-.../darwin/aarch64",
  "signature": "<base64-encoded-signature>",
  "notes": "Bug fixes and performance improvements",
  "pub_date": "2026-03-13T12:00:00Z"
}
```

### No Update (204)

Empty response. The current version is already the latest.

The endpoint returns an update only if the latest release version is strictly greater than `current_version` (semver comparison).

## Download Endpoint

```
GET /api/sync/ota/{slug}/download/{release_id}/{target}/{arch}
```

Returns a 302 redirect to a presigned S3 download URL.

## Managing Releases

### List Releases

```
GET /api/sync/ota/apps/{app_id}/releases
Authorization: Bearer <token>
```

### Delete a Release

```
DELETE /api/sync/ota/apps/{app_id}/releases/{release_id}
Authorization: Bearer <token>
```

Deleting a release also removes all its artifacts from S3.

## Tauri Integration

For Tauri 2 apps, configure the updater plugin to point at your OTA endpoint:

```json
{
  "plugins": {
    "updater": {
      "endpoints": [
        "https://makenot.work/api/sync/ota/my-app/{{target}}/{{arch}}/{{current_version}}"
      ]
    }
  }
}
```

Tauri handles the update check, download, signature verification, and restart automatically.

## Signature Verification

The `signature` field is passed through to the update check response. For Tauri apps, this is the Ed25519 signature from `tauri signer sign`, verified against the public key embedded at build time. For non-Tauri apps, use any signature scheme; the server stores and returns the signature without interpretation.

## Publish Script

The `deploy/ota-publish.sh` script automates the full publish flow. See the script for usage details.

## See Also

- [SyncKit Cloud Sync](./synckit.md): data sync for your app
- [API Overview](./api-overview.md): authentication and rate limits