Ah no dice, there's no files scope for OAuth:
GET https://redacted.myshopify.com/admin/files.json HTTP 403 Forbidden: {"errors":"Scope undefined for API access: files. Valid scopes: content, themes, products, customers, orders, script_tags, shipping, fulfillments, and gift_cards"}
Inspecting the request in the admin shows:
POST https://redacted.myshopify.com/admin/files/batch_create.json name="files[]"; filename="test.jpg" {"files":[{"key":"files/test.jpg","public_url":"http://cdn.shopify.com/s/files/1/0392/3962/files/test.jpg?7","created_at":"2014-03-28T11:43:25-04:00","updated_at":"2014-03-28T11:43:25-04:00","content_type":"image/jpeg","size":124210,"token":"WyJmaYxlIiwiZmlsZXMvdGVzdC5qcGciLDM5MjM5Njld--2c6f0c618c91b9401c248932a5b1f30299d"}]}
Looks like we'll need to wait until Shopify opens that API up. thanks for your help HunkyBill & HJ!