A file upload API that keeps bytes off your servers

What a file upload API is for

Almost every app ends up accepting files: profile pictures, receipts, voice notes, PDFs, videos. Handling them yourself means streaming large request bodies through your web servers, enforcing size limits, storing the bytes somewhere durable, generating links, cleaning up abandoned uploads and serving the result quickly around the world. A file upload API takes that whole job and leaves you with two small pieces of code: an endpoint that says who may upload what, and a line in the client that sends the file.

The Rapidfile Upload API is that service. Your server talks to a small REST API with a secret key. Your users' browsers and apps send files straight to Rapidfile with short-lived signed URLs. Finished files get a permanent CDN link on cdn.rapidfile.cc, and your backend receives a signed webhook so it can store the link next to the user's record.

The direct upload pattern

Routing uploads through your own server is the simplest design and the most expensive one. Every byte crosses your network twice, long uploads tie up workers, and serverless platforms often cap request bodies at a few megabytes. The direct upload pattern avoids all of that:

1. Authorize

   The client tells your server it wants to upload cat.jpg, 48 KB, image/jpeg. Your server checks the session, the type and the size.

2. Sign

   Your server calls POST /v1/uploads with its secret key and passes the JSON response (a signed URL valid for one hour) back to the client.

3. Upload

   The client PUTs the file to the signed URL. Large files are split into parts that upload in parallel. When the last byte lands, the file is ready.

Your server only ever handles a few hundred bytes of JSON per upload. Here is the server side in four common stacks:

// app/api/upload/route.ts: runs on your server, so the secret key stays private
import { auth } from '@/lib/auth'; // your own session check

export async function POST(req: Request) {
  const user = await auth(req);
  if (!user) return Response.json({ error: 'unauthorized' }, { status: 401 });

  const { name, size, type } = await req.json();
  const res = await fetch('https://api.rapidfile.cc/v1/uploads', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.RAPIDFILE_SECRET_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ name, size, type, metadata: { userId: user.id } }),
  });
  return Response.json(await res.json(), { status: res.status });
}

// server.js: Express creates the upload, the browser sends the bytes
import express from 'express';

const app = express();
app.use(express.json());

app.post('/api/upload', requireUser, async (req, res) => {
  const { name, size, type } = req.body;
  const r = await fetch('https://api.rapidfile.cc/v1/uploads', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.RAPIDFILE_SECRET_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ name, size, type, metadata: { userId: req.user.id } }),
  });
  res.status(r.status).json(await r.json());
});

app.listen(3000);

// In the browser: no SDK, no API key
const picked = document.querySelector('input[type=file]').files[0];

// 1. Ask your own server for an upload URL
const { upload } = await fetch('/api/upload', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ name: picked.name, size: picked.size, type: picked.type }),
}).then((r) => r.json());

// 2. Send the bytes straight to Rapidfile (files up to 95 MB use one PUT)
const res = await fetch(upload.url, { method: 'PUT', body: picked });
const { file } = await res.json();
console.log(file.url); // https://cdn.rapidfile.cc/<id>/<name>

# 1. Create an upload (server side, with your secret key)
curl https://api.rapidfile.cc/v1/uploads \
  -H "Authorization: Bearer $RAPIDFILE_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"cat.jpg","size":48213,"type":"image/jpeg"}'

# 2. PUT the bytes to upload.url from the response (no key needed)
curl -T cat.jpg "$UPLOAD_URL"

# Or upload from your server in one request (up to 95 MB)
curl -T cat.jpg -H "Content-Type: image/jpeg" \
  -H "Authorization: Bearer $RAPIDFILE_SECRET_KEY" \
  "https://api.rapidfile.cc/v1/files?name=cat.jpg"

Large files and unreliable networks

Single requests are fine for photos, but a 4 GB screen recording on a train connection needs more care. For files above 95 MB the API answers with a MULTIPART plan: a part size, a part count and a signed URL template. The browser SDK slices the file, uploads several parts at once, retries any part that fails with exponential backoff, reports combined progress and finishes the upload. Without the SDK it is about fifteen lines of fetch; the multipart docs show them. Depending on your plan, single files can be up to 512 MB (Free), 4 GB (Starter), 16 GB (Growth), 50 GB (Scale).

Delivery, privacy and webhooks

Public files are served at https://cdn.rapidfile.cc/<id>/<name>, so you can drop the URL straight into an <img>, <video> or download button. For documents that should not be public (contracts, IDs, invoices), create the upload with "acl": "private". Private files have no public URL; your server requests a signed URL that expires after the time you choose, up to seven days.

When a file is ready or deleted, Rapidfile POSTs a file.uploaded or file.deleted event to your webhook URL. Each request carries a Rapidfile-Signature header, an HMAC-SHA256 over the timestamp and raw body, so you can prove it came from us. Verification code for Node and Python is in the docs.

Fixed pricing, no bandwidth meter

Usage-based storage bills are hard to predict because the expensive part, egress, depends on how popular your users' files become. Rapidfile plans are flat: each plan includes storage, a daily number of CDN requests and a maximum file size, and bandwidth is not billed. The free plan includes 2 GB and 100,000 CDN requests a day; paid plans are Starter at $5/month (100 GB), Growth at $15/month (500 GB), Scale at $49/month (2 TB). The calculator picks a plan for your numbers.

Checklist for production uploads

• Keep the secret key on the server only; rotate it with a second key when people leave the team.
• Validate type and size in your endpoint before creating the upload, so a client cannot store anything it likes.
• Save file.id with your record and delete files when users delete their content.
• Verify webhook signatures and make your handler idempotent.
• Use private files plus signed URLs for anything personal.

Frequently asked questions

Keep reading