File Upload with curl

files.link's upload API is designed to be curl-able end to end — no SDK, no multipart form gymnastics, just three HTTP calls in a specific order. Here's the full walkthrough you can paste into a shell. Throughout, the auth header is your raw API key with no Bearer prefix: Authorization: $FILESLINK_KEY.

Step 1 — ask for a place to put the bytes. POST your file's metadata to the folder endpoint: curl -s -X POST -H "Authorization: $FILESLINK_KEY" -H 'Content-Type: application/json' -d '{"filesMetadata":[{"name":"report.pdf","size":102400,"type":"application/pdf"}]}' https://api.files.link/v1/files/FOLDER_ID The response shape is { success: true, urls: [{ url, id, ... }] }. The url is a presigned target valid for a short window; id is the file's identifier you'll confirm later.

Step 2 — upload the actual bytes. PUT the file directly to that presigned url — this call goes to storage, not to the API, and carries no auth header (the signature in the URL is the auth): curl -s -X PUT --upload-file ./report.pdf 'PRESIGNED_URL' Add -# if you want a progress bar for a large file.

Step 3 — finalize. Tell the API the bytes landed so the file becomes live and gets its delivery URL: curl -s -X POST -H "Authorization: $FILESLINK_KEY" -H 'Content-Type: application/json' -d '{"ids":["ID"]}' https://api.files.link/v1/files/confirm-upload

To chain it without copy-pasting IDs by hand, capture step 1's output with jq: resp=$(curl -s -X POST ... ); url=$(echo "$resp" | jq -r '.urls[0].url'); id=$(echo "$resp" | jq -r '.urls[0].id'), then run steps 2 and 3 against $url and $id. That's a self-contained uploader in a handful of lines. Wrap those lines in a shell function in your .bashrc or zshrc and you have a portable upload report.pdf command on any machine that has curl and jq.

For unreliable networks, add --retry 3 --retry-connrefused to the step-2 PUT so a dropped connection re-attempts the byte transfer instead of failing the whole pipeline, and -f to the API calls so a non-2xx response sets a non-zero exit code your CI job can catch. Because every call is plain HTTPS over 443, it sails through corporate proxies that block scp and rsync, and it needs no credentials file — unlike aws s3 cp, the only secret is the one API key already in your environment.