One POST and the ticket is filed.

curl -X POST https://uniport.sh/api/v1/intake \
  -H "Authorization: Bearer $UNIPORT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name":    "Jane Doe",
    "email":   "jane@example.com",
    "subject": "Export is broken",
    "message": "The export button does nothing on Safari 18.",
    "source":  { "page": "/pricing", "plan": "pro" }
  }'

// lib/uniport.ts — the whole client. No dependency, no install.

export class UniportError extends Error {
  constructor(
    readonly code: string,
    readonly status: number,
    readonly retryAfterSeconds?: number,
    message?: string,
  ) {
    super(message ?? `Uniport ${status}: ${code}`);
    this.name = "UniportError";
  }
}

export interface UniportSubmission {
  email: string;
  message: string;
  name?: string;
  subject?: string;
  /** Free-form context stored on the ticket. Under 4 KB serialized. */
  source?: Record<string, unknown>;
  /** Blob URLs from /api/v1/upload. Nothing else is accepted. */
  attachments?: Array<{
    url: string;
    filename: string;
    contentType?: string;
    sizeBytes?: number;
  }>;
}

export interface UniportTicket {
  ticket_id: string;
  short_code: string;
  /** Public thread link, capability token included. For the customer only. */
  status_url: string;
}

export function createUniport({
  key,
  baseUrl = "https://uniport.sh",
}: {
  key: string;
  baseUrl?: string;
}) {
  return {
    async submit(input: UniportSubmission): Promise<UniportTicket> {
      const res = await fetch(`${baseUrl}/api/v1/intake`, {
        method: "POST",
        headers: {
          Authorization: `Bearer ${key}`,
          "Content-Type": "application/json",
        },
        body: JSON.stringify(input),
        cache: "no-store",
      });

      // Errors are JSON too; a non-JSON body means something in front of the
      // API answered, so fall back to the status rather than throwing on parse.
      const body = await res.json().catch(() => null);

      if (!res.ok) {
        // Body first, header second. Number(null) is 0, so ?? would happily
        // hand you a zero-second backoff on a missing header — || is right here.
        const retryAfter =
          typeof body?.retry_after_seconds === "number"
            ? body.retry_after_seconds
            : Number(res.headers.get("retry-after")) || undefined;

        throw new UniportError(
          body?.error?.code ?? "unknown_error",
          res.status,
          retryAfter,
          body?.error?.message,
        );
      }

      return body as UniportTicket;
    },
  };
}

// app/contact/actions.ts
"use server";

import { createUniport, UniportError } from "@/lib/uniport";

// Module scope: the key never crosses into a client bundle.
const uniport = createUniport({ key: process.env.UNIPORT_KEY! });

export async function submitContact(formData: FormData) {
  try {
    const ticket = await uniport.submit({
      name: String(formData.get("name") ?? ""),
      email: String(formData.get("email") ?? ""),
      subject: String(formData.get("subject") ?? ""),
      message: String(formData.get("message") ?? ""),
      source: { page: "/contact" },
    });
    return { ok: true as const, code: ticket.short_code };
  } catch (e) {
    if (e instanceof UniportError) {
      if (e.code === "rate_limited") {
        const wait = e.retryAfterSeconds ?? 60;
        return { ok: false as const, error: `Too many messages. Try again in ${wait}s.` };
      }
      if (e.code === "flagged_as_spam") {
        return { ok: false as const, error: "That message looked like spam to our filter." };
      }
      console.error("[contact] uniport", e.code, e.status);
    }
    return { ok: false as const, error: "Could not send that. Try again." };
  }
}

<form id="contact">
  <input name="name" placeholder="Your name" />
  <input name="email" type="email" placeholder="you@example.com" required />
  <textarea name="message" placeholder="What went wrong?" required></textarea>
  <button type="submit">Send</button>
</form>

<script>
  document.getElementById("contact").addEventListener("submit", async (e) => {
    e.preventDefault();
    const form = e.target;
    const res = await fetch("/api/contact", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify(Object.fromEntries(new FormData(form))),
    });
    const body = await res.json();
    form.outerHTML = res.ok
      ? "<p>Got it. Your ticket is " + body.short_code + ".</p>"
      : "<p>Sorry, that did not send (" + body.error.code + ").</p>";
  });
</script>

// /api/contact on YOUR server — any runtime, any framework.
// The browser never sees UNIPORT_KEY: a upk_ key in a bundle lets anyone
// on the internet file tickets as your app.
export async function POST(req) {
  const input = await req.json();

  const res = await fetch("https://uniport.sh/api/v1/intake", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.UNIPORT_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      name: input.name,
      email: input.email,
      message: input.message,
      source: { page: req.headers.get("referer") },
    }),
  });

  // Pass the envelope straight through: the codes are already stable and
  // safe to show, and re-inventing them costs you the retry semantics.
  return new Response(await res.text(), {
    status: res.status,
    headers: { "Content-Type": "application/json" },
  });
}

# 1. Your server asks for a short-lived upload token.
curl -X POST https://uniport.sh/api/v1/upload \
  -H "Authorization: Bearer $UNIPORT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "blob.generate-client-token",
    "payload": {
      "pathname": "screenshot.png",
      "multipart": false,
      "clientPayload": null
    }
  }'

# → { "type": "blob.generate-client-token", "clientToken": "vercel_blob_client_…" }

// 2. The file goes straight to Vercel Blob with that token — it never
//    passes through Uniport, so the 4.5 MB serverless body limit is moot.
import { put } from "@vercel/blob/client";

const blob = await put(file.name, file, {
  access: "public",
  token: clientToken, // from step 1, relayed by your own route
});

// blob.url → https://<store>.public.blob.vercel-storage.com/screenshot-9f2c.png

// 3. File the ticket, referencing the blob.
{
  "email": "jane@example.com",
  "message": "Screenshot attached.",
  "attachments": [
    {
      "url": "https://abc123.public.blob.vercel-storage.com/screenshot-9f2c.png",
      "filename": "screenshot.png",
      "contentType": "image/png",
      "sizeBytes": 184320
    }
  ]
}

{
  "error": {
    "code": "invalid_request",
    "message": "Request body failed validation.",
    "details": { "fieldErrors": { "email": ["Invalid email address"] } }
  }
}

// 429 adds retry_after_seconds at the top level, mirroring Retry-After:
{
  "error": { "code": "rate_limited", "message": "Too many submissions…" },
  "retry_after_seconds": 47
}

# Walk every open ticket, one page at a time.
cursor=""
while :; do
  page=$(curl -s "https://uniport.sh/api/v1/tickets?limit=100&cursor=$cursor" \
    -H "Authorization: Bearer $UNIPORT_TOKEN")
  echo "$page" | jq -r '.tickets[] | "\(.short_code)\t\(.customer_email)"'
  cursor=$(echo "$page" | jq -r '.next_cursor // empty')
  [ -z "$cursor" ] && break
done