Sign Upload

Minting a signature itself requires an API key, only a trusted backend should call this endpoint. The resulting signature is what you hand to the untrusted client (e.g. a browser).

Endpoint

POST /upload/sign

Auth: API Key required

Body parameters

string

Destination folder the signature will be scoped to. Must match the folder field sent with the eventual POST /upload request.Defaults to the root folder if omitted.

number

Lifetime of the signature in seconds. Clamped between 1 and a server-configured maximum.Defaults to a server-configured value if omitted.

Response

{
  "success": true,
  "signature": "a1b2c3d4e5f6...",
  "expires": 1735689600,
  "folder": "photos"
}

boolean

true if a signature was generated.

string

The presigned signature to pass alongside the upload.

number

Unix timestamp (seconds) after which the signature is no longer valid.

string

The folder the signature is scoped to.

Status codes: 200 success · 500 API_SECRET not configured on the server

Example

curl -X POST http://localhost:3000/upload/sign \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{"folder": "photos", "expiresIn": 300}'

Upload Files

Use the resulting signature to upload without an API key.

Overview

Media

Files

Storage

Cache

Video Processing

API Keys

System

Endpoint

Body parameters

Response

Example

Upload Files

​Endpoint

​Body parameters

​Response

​Example

​Related

Upload Files

Endpoint

Body parameters

Response

Example

Related