FiveM SDK — presigned URLs

A presigned URL is a one-time, short-lived (5-minute TTL) upload link minted by your server. Whoever holds it can upload exactly one file — no API token involved — which makes it the only safe way to let clients or NUI pages upload directly.

Server: mint one

local url = exports.spawnbase:requestPresignedUrl("image") -- "image" | "audio" | "video"

if url then
    TriggerClientEvent("myresource:uploadUrl", source, url)
end

Signature: requestPresignedUrl(fileType) → string | nil.

Client / NUI: upload to it

Multipart POST with the file in the file field — the response is the stored file record:

async function upload(url, file) {
  const body = new FormData();
  body.append("file", file, file.name);
  const res = await fetch(url, { method: "POST", body });
  const out = await res.json();
  return out.data.url; // { status: "ok", data: { id, url, originalUrl } }
}

A raw PUT with the file bytes as the body (and a filename query parameter) works too.

Rules

• One URL = one upload, claimed atomically: reuse is rejected, and a failed upload burns the URL — mint a fresh one per attempt.
• Expired URLs are rejected — mint a fresh one per upload; never cache.
• The URL already encodes the team and token it was minted from; the uploader cannot redirect it to another account.
• Asking for a new URL costs nothing until it’s used.