Presigned uploads

A presigned URL is a signed, expiring, single-use grant. Your server mints one; the client uploads straight to it with no Authorization header.

1. Mint (server, token required)

curl "https://api.spawnbase.gg/api/v1/file/presigned-url?expiresAt=1760000000" \
  -H "Authorization: YOUR_TOKEN"

expiresAt is unix seconds; omitted or farther in the future = 5 minutes from now. A past value is 400 bad_query.

2. Upload (client, no token)

Multipart POST (field file) or a raw PUT to the returned presignedUrl:

curl -X POST "<presignedUrl>" -F "file=@screenshot.jpg"

Multipart requests are limited to 8 MiB including the envelope. For larger files, send a raw PUT with Content-Length (curl sets it automatically for a regular file):

curl -X PUT "<presignedUrl>" --data-binary @clip.mp4 -H "Content-Type: video/mp4"

Raw PUT supports up to 100,000,000 bytes and streams into private storage. The earlier 512 MB claim was unsupported by the default Cloudflare zone limit. A file’s bytes must match an expected hash when the grant binds one. Bound filename, path and metadata values take precedence over client values.

A retry after successful completion returns the original file result and does not overwrite it. Concurrent use while the first upload is still running returns 403 forbidden; a failed claimed grant requires a new grant. Tampered, expired or revoked-token grants return 401 unauthorized.

In FiveM this is what the SDK does for you — see FiveM presigned URLs.