Skip to main content
Everything is relative to your instance URL, and protected endpoints take an API key as a Bearer token.
Create keys from the dashboard at /api-keys or through the API Keys API. In API-only mode the first key is printed to the server logs at startup. Every API-key endpoint also accepts a dashboard session cookie, which is how the dashboard calls storage and upload without minting a key for itself. These endpoints work on both Cloud and self-hosted, with the same request and response shapes. The pages that do not are marked Self-hosted only at the top. On Cloud the delivery URL carries a bucket prefix and keys travel as x-api-key or Authorization, see what differs on Cloud.

​
Endpoints

​
Rate limiting

Public routes are limited by IP: 100 requests per 60 seconds, tunable with PUBLIC_RATE_LIMIT_MAX and PUBLIC_RATE_LIMIT_WINDOW_MS. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Most API-key endpoints sit outside that limiter, but POST /upload and GET /health/database do not, so a burst of uploads can be throttled even with a valid key.

​
Errors

JSON errors carry a short error label and a message:
The delivery routes /t/* and /authenticated/* return plain text, not JSON. Parsing every error body as JSON throws on exactly the routes your users hit most. Check Content-Type first.
Two endpoints add fields on top of that pair: delete returns a details object, and invalidate returns an errors array. Neither is a general envelope.