EasySend API

Quick Start

Upload a file and get a link. One command, under 60 seconds.

curl -F 'files[][email protected]' \
  https://easysend.co/api/v1/upload

{
  "success": true,
  "short_code": "aB3xZ",
  "share_url": "/aB3xZ",
  "upload_token": "e4f9...64 hex chars",
  "expires_at": "2026-03-29T12:00:00+00:00",
  "files": [{
    "id": 42,
    "name": "photo.jpg",
    "size": 284910,
    "mime_type": "image/jpeg",
    "download_url": "/api/v1/download/42"
  }]
}

Authentication

Anonymous use works for every endpoint documented below. No key, no signup, no setup. The API was built that way and stays that way.

API keys are an optional layer on top. Send one as a Bearer token and you unlock higher limits plus a small set of /my/* endpoints for listing and managing the bundles tied to that key.

Authorization: Bearer es_live_xxxxxxxxxxxxxxxxxxxxxxxx

curl -F 'files[][email protected]' \
  -H "Authorization: Bearer es_live_xxxxxxxxxxxxxxxxxxxxxxxx" \
  https://easysend.co/api/v1/upload

Privacy model

The API has two independent concepts. Ownership and privacy are decoupled on purpose.

By default an uploaded bundle is public and the share URL works for anyone who has it, exactly like an anonymous upload. Set access_password at upload time to make the bundle private. Privacy is enforced consistently across every endpoint that touches bundle content.

The Bearer key that uploaded a bundle bypasses the password gate everywhere. A bot that holds the key can read its own bundles without rotating through the password. This is how the dashboard pattern works: keep the key server side, send Bearer on every API call, render thumbnails using the signed thumbnail_url the API returns.

curl -F 'files[][email protected]' \
  -F 'access_password=hunter2' \
  -H "Authorization: Bearer es_live_xxxxxxxxxxxxxxxxxxxxxxxx" \
  https://easysend.co/api/v1/upload

For users who hold the password but not the key, POST /api/verify-access exchanges {short_code, password} for an HMAC access_token tied to the bundle, the requester IP and a one hour expiry. Send the token back as X-Access-Token: <token> or as ?t=<token> on any subsequent request to that bundle's content endpoints.

When the API returns a file inside a password-protected bundle (only possible via owner Bearer), image entries include a thumbnail_url with an HMAC sig good for one hour. The URL works in an <img> tag directly with no auth header, which lets dashboards embed previews of gated content without proxying bytes through their own backend. The signature only authorizes the preview path, not the full file download.

Endpoints

{
  "success": true,
  "short_code": "aB3xZ",
  "share_url": "/aB3xZ",
  "upload_url": "/u/e4f9a1...64hex",
  "upload_token": "e4f9a1...64hex",
  "expires_at": "2026-03-29T12:00:00+00:00",
  "files": [
    {
      "id": 42,
      "name": "photo.jpg",
      "size": 284910,
      "mime_type": "image/jpeg",
      "download_url": "/api/v1/download/42"
    }
  ]
}

{
  "success": true,
  "short_code": "aB3xZ",
  "share_url": "/aB3xZ",
  "upload_url": "/u/e4f9a1...64hex",
  "files": [
    {
      "id": 43,
      "name": "readme.txt",
      "size": 1024,
      "mime_type": "text/plain",
      "download_url": "/api/v1/download/43"
    }
  ]
}

{
  "success": true,
  "short_code": "aB3xZ",
  "file_count": 2,
  "total_size_bytes": 285934,
  "max_size_bytes": 1073741824,
  "expires_at": "2026-03-29 12:00:00",
  "is_expired": false,
  "is_encrypted": false,
  "created_at": "2026-03-26 12:00:00",
  "files": [
    {
      "id": 42,
      "name": "photo.jpg",
      "size": 284910,
      "mime_type": "image/jpeg",
      "download_url": "/api/v1/download/42"
    }
  ]
}

{
  "success": true,
  "exists": true,
  "is_expired": false,
  "expires_at": "2026-03-29 12:00:00",
  "total_size_bytes": 285934,
  "max_size_bytes": 1073741824,
  "space_remaining": 1073455890
}

Content-Type: image/jpeg
Content-Disposition: attachment; filename="photo.jpg"
Content-Length: 284910

{
  "success": true,
  "deleted_file_id": 42
}

{
  "success": true,
  "bundles": [
    {
      "short_code": "aB3xZ",
      "share_url": "/aB3xZ",
      "created_at": "2026-05-20 09:14:22",
      "expires_at": "2026-05-27 09:14:22",
      "total_size_bytes": 5242880,
      "file_count": 2,
      "view_count": 7,
      "is_encrypted": false,
      "password_protected": true,
      "description": "nightly screenshots",
      "files": [
        {
          "id": 2065,
          "name": "chrome-2026-06-03.png",
          "size": 183204,
          "mime_type": "image/png",
          "download_count": 0,
          "download_url": "/api/v1/download/2065",
          "thumbnail_url": "/d/2065?preview=1&exp=1780743002&sig=2ede3f48..."
        }
      ]
    }
  ]
}

{
  "success": true,
  "key": {
    "label": "ci-runner-prod",
    "prefix": "es_live_abcd1234",
    "created_at": "2026-04-01 12:00:00",
    "last_used_at": "2026-05-28 17:42:09",
    "rate_limit_per_hour": 300,
    "max_bundle_size_bytes": 5368709120,
    "default_expiry_days": 7
  },
  "totals": {
    "bundle_count": 42,
    "total_bytes": 12884901888,
    "total_files": 187
  }
}

{
  "success": true,
  "deleted_short_code": "aB3xZ"
}

Code Examples

Complete working examples to upload a file and print the share URL.

#!/bin/bash
# Upload a file to EasySend

RESPONSE=$(curl -s -F 'files[][email protected]' \
  https://easysend.co/api/v1/upload)

# Print the share URL
echo "$RESPONSE" | python3 -c \
  "import sys,json; d=json.load(sys.stdin); print('https://easysend.co' + d['share_url'])"

# Upload more files to the same bundle
TOKEN=$(echo "$RESPONSE" | python3 -c \
  "import sys,json; print(json.load(sys.stdin)['upload_token'])")

curl -s -F 'files[][email protected]' \
  https://easysend.co/api/v1/upload/$TOKEN

import requests

# Upload a file
with open("photo.jpg", "rb") as f:
    resp = requests.post(
        "https://easysend.co/api/v1/upload",
        files={"files[]": f}
    )

data = resp.json()
print(f"Share URL: https://easysend.co{data['share_url']}")

# Add another file to the same bundle
token = data["upload_token"]
with open("readme.txt", "rb") as f:
    requests.post(
        f"https://easysend.co/api/v1/upload/{token}",
        files={"files[]": f}
    )

# Delete a file
file_id = data["files"][0]["id"]
requests.delete(
    f"https://easysend.co/api/v1/file/{file_id}",
    headers={"Authorization": f"Bearer {token}"}
)

// Upload a file using fetch
const form = new FormData();
form.append("files[]", fileInput.files[0]);

const resp = await fetch("https://easysend.co/api/v1/upload", {
  method: "POST",
  body: form,
});

const data = await resp.json();
console.log(`Share: https://easysend.co${data.share_url}`);

// Delete a file
await fetch(`https://easysend.co/api/v1/file/${data.files[0].id}`, {
  method: "DELETE",
  headers: {
    "Authorization": `Bearer ${data.upload_token}`
  },
});

<?php
// Upload a file using cURL
$ch = curl_init('https://easysend.co/api/v1/upload');

curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POSTFIELDS     => [
        'files[]' => new CURLFile('photo.jpg'),
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

$data = json_decode($response, true);
echo "Share: https://easysend.co" . $data['share_url'] . "\n";

// Delete a file
$ch = curl_init("https://easysend.co/api/v1/file/" . $data['files'][0]['id']);
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST  => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . $data['upload_token'],
    ],
]);
curl_exec($ch);
curl_close($ch);

Try It

Upload Tokens

Separate from API keys, every freshly created bundle gets an upload_token. It is per-bundle, not per-caller, and lets you keep adding files to a bundle you just created without holding any account.

The upload_token is returned when you create a bundle via POST /api/v1/upload. It acts as a bearer token that proves ownership of the bundle. You need it for:

• POST /api/v1/upload/{upload_token} -- adding files (token is in the URL path)
• DELETE /api/v1/file/{file_id} -- deleting files (token via header or query)

Authorization: Bearer e4f9a1b2c3d4e5f6...64 hex characters

DELETE /api/v1/file/42?upload_token=e4f9a1b2c3d4e5f6...64hex

Rate Limits

The API includes rate limit headers in every response:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 59

Two tiers apply:

Anonymous limits are counted per source IP. Keyed limits are counted per key, so the same key used from multiple machines shares one bucket. Send an Authorization: Bearer es_live_... header on any request to get the keyed tier. See the Authentication section for how to get a key.

If you need higher throughput for a specific use case, reach out and we will work with you.

Response Codes

All JSON responses include a "success": true|false field. Error responses also include an "error" message string.