API documentation

Upload files, manage account files, and create shareable albums.

Upload

POST /up · multipart/form-data

• file — required file field. One file per request, up to 95MB.
• Accept: application/json — send this exact header value for JSON; otherwise the response is HTML.
• x-api-key — optional header to associate uploads with your account. Get your key from Profile & settings.
• length — optional form field for the file ID length on JSON uploads. Default 8; values are clamped to 8–32.

A successful JSON response contains link, the public file URL, and destroy, the private deletion URL. Keep the deletion URL if you want to remove the file later.

Without a recognized API key or signed-in session, uploads are anonymous. A signed-in session takes precedence over the API key.

Supported file extensions

.png, .jpeg, .jpg, .gif, .bmp, .tiff, .mp4, .flac, .mp3, .aac, .wav, .ogg, .opus, .avif, .jxl, .ico, .webm, .webp, .mkv, .m4a, .svg, .raw, .arw, .dng, .heif, .heic, .tga, .mov, .mka

Permanent deletion

DELETE, POST, or GET /destroy/{destroyToken}

The 48-character destroy token authorizes deletion without an API key or account session. Success returns a JSON status of Success.

Deletion is immediate and permanent, including files in trash. Keep the destroy URL private; opening it also deletes the file.

Account actions

Trash and album changes require a signed-in account session and Content-Type: application/json. Send an empty JSON object when no fields are needed. Cross-origin requests are rejected; API keys do not authorize these actions.

Trash & restore

• POST /trash/{fileId} — move an owned file to trash.
• POST /trash/{fileId}/restore — restore it within seven days.

Use the public file ID without its extension. Trashed files lose public access; restoring reactivates the original link. Expired files are permanently deleted by automatic cleanup. View trash.

Albums

Albums are private by default. Sharing creates a link anyone can use to view active album files. Deleting an album preserves its files.

Album endpoints

• POST /albums — create an album with a name of 1–100 characters.
• PATCH /albums/{id} — rename it using name.
• POST /albums/{id}/files — add a fileIds array of 1–100 owned, active file IDs.
• DELETE /albums/{id}/files/{fileId} — remove a file from the album.
• POST /albums/{id}/share — enable sharing or replace the current link; returns url.
• DELETE /albums/{id}/share — revoke sharing.
• DELETE /albums/{id} — delete the album.

Album and trash GET endpoints return HTML pages. Shared albums use /album/{token}.

Errors

Check the HTTP status. Application errors usually include a JSON error message; proxies and rate limits may return plain text or HTML.

• 400 — invalid request, unsupported file, or file over the size limit.
• 401 / 403 — missing account session or rejected cross-origin request.
• 404 / 409 — resource unavailable or trash state conflict.
• 415 — account action requires JSON.
• 429 — rate limit reached; wait before retrying.
• 500 / 503 — server failure; try again later.

---