> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openinary.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign Upload

> Mint a short-lived signature so a browser can upload directly to POST /upload without exposing your API key

Call this from a trusted backend with your API key. Hand the returned signature to the untrusted client, which uses it to upload.

```
POST /upload/sign
```

```bash theme={null}
curl -X POST https://cdn.openinary.dev/upload/sign \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{"folder": "photos", "expiresIn": 300}'
```

**Auth:** API Key required

## Body parameters

| Param | Type | Default | Description |
| - | - | - | - |
| `folder` | `string` | root folder | Folder the signature is scoped to. Must match the `folder` field sent with the eventual `POST /upload` |
| `expiresIn` | `number` | `300` | Signature lifetime in seconds, clamped between `1` and `3600` |

## Response

```json theme={null}
{
  "success": true,
  "signature": "a1b2c3d4e5f6...",
  "expires": 1735689600,
  "folder": "photos"
}
```

| Field | Type | Description |
| - | - | - |
| `success` | `boolean` | `true` if a signature was generated |
| `signature` | `string` | The presigned signature to pass alongside the upload |
| `expires` | `number` | Unix timestamp (seconds) after which the signature is no longer valid |
| `folder` | `string` | The folder the signature is scoped to |

**Status codes:** `200` success · `500` `API_SECRET` not configured on the server

## Related

> [card] [Upload Files](https://docs.openinary.dev/api-reference/files/upload.md)
>
> Use the resulting signature to upload without an API key.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.