Your files.
One API away.

Two requests, one shareable URL. This example uploads hello.txt as a guest, then prints its public link.

set -eu
printf 'Hello, Yoink!\n' > hello.txt

response=$(curl --fail-with-body --silent --show-error --retry 2 \
  https://yoink.zip/api/v1/presign \
  -H 'Content-Type: application/json' \
  -d '{"filename":"hello.txt","contentType":"text/plain"}')

curl --fail-with-body --silent --show-error --retry 2 \
  --request PUT "$(printf '%s' "$response" | jq -er '.uploadUrl')" \
  -H "Content-Type: $(printf '%s' "$response" | jq -er '.contentType')" \
  --data-binary @hello.txt

printf '%s' "$response" | jq -er '.publicUrl'

Using this from another website? Send uploads from your backend. Direct browser PUT uploads aren’t enabled for other origins.

Guest uploads work without credentials. To attribute uploads to a signed-in Yoink account, send its current Firebase ID token with the presign request.

Authorization: Bearer <FIREBASE_ID_TOKEN>

Request a short-lived URL for one file. Send JSON with Content-Type: application/json. This step doesn’t upload any bytes.

Request body

filenamestringrequired

The file’s name. Yoink strips directory components, cleans unsupported filename characters, and limits the name to 200 characters.

contentTypestring

The MIME type to store, such as image/png. Defaults to application/octet-stream.

sizenumber

File size in bytes, when known. Accepted range: 0–5,368,709,120 (5 GiB). This is a declaration, not a verification of the uploaded bytes.

{
  "filename": "hello.txt",
  "contentType": "text/plain",
  "size": 14
}

Response 200 OK

{
  "uploadUrl": "https://<account>.r2.cloudflarestorage.com/<signed-path>",
  "path": "anon/<timestamp>/<id>/hello.txt",
  "publicUrl": "https://files.yoink.zip/anon/<timestamp>/<id>/hello.txt",
  "contentType": "text/plain",
  "expiresIn": 900
}

uploadUrlstring

Temporary, signed PUT URL. Use the full returned value unchanged, including its query string. Keep it private until you’ve finished uploading.

publicUrlstring

Ready-to-use, encoded public link. Share it only after the PUT succeeds.

pathstring

Generated storage key, with an account or guest prefix, timestamp, random ID and cleaned filename. Save the returned value rather than constructing it.

contentTypestring

The exact Content-Type header to send with your PUT.

expiresInnumber

Always 900 seconds (15 minutes). This is the upload URL’s lifetime, not the file’s lifetime.

Send the raw file as the request body, using the returned contentType. The signed URL already authorizes this request: leave out the Firebase bearer token.

curl --fail-with-body --request PUT "$UPLOAD_URL" \
  -H "Content-Type: $CONTENT_TYPE" \
  --data-binary @hello.txt

Set UPLOAD_URL and CONTENT_TYPE to the values returned by presign, or use the complete quickstart.

After a successful upload, use publicUrl to fetch the file directly from files.yoink.zip. No download token or viewer page in the way.

Public links don’t inherit the signed upload URL’s 15-minute expiry. There’s no file-expiration setting or permanence guarantee. Keep your own copy.

A single-request alternative for small files. It buffers the full body in the Worker and is subject to lower platform limits. Use presign for larger files.

curl --fail-with-body --silent --show-error \
  https://yoink.zip/api/v1/upload \
  -H 'Content-Type: text/plain' \
  -H 'x-filename: hello.txt' \
  --data-binary @hello.txt

{
  "success": true,
  "path": "anon/<timestamp>/<id>/hello.txt",
  "url": "https://files.yoink.zip/anon/<timestamp>/<id>/hello.txt"
}