---
title: "Generate upload URL"
method: POST
path: "/api/hosting/v1/files/upload-urls"
tags: ["Hosting: Files"]
---

# Generate upload URL

`POST /api/hosting/v1/files/upload-urls`

Generate a file browser upload URL with authentication credentials
for uploading files directly to a website's file storage.

Returns `url`, `auth_key` and `rest_auth_key`. Use these to upload a file to the
website's `public_html` directory via the TUS resumable upload protocol (TUS 1.0.0).
Send `X-Auth: {auth_key}` and `X-Auth-Rest: {rest_auth_key}` headers on every request
below.

1. Create the upload: `POST` to `{url}/{relative_file_path}?override=true` with headers
   `upload-length: {file size in bytes}` and `upload-offset: 0`. Expect `201 Created`.
2. Upload the file: send the file bytes to the same location (any TUS 1.0.0 client, or
   `PATCH` requests with an `upload-offset` header tracking progress) until complete.

`relative_file_path` is the destination path inside `public_html`, e.g. `app.zip`.

Instead of a TUS client, plain `curl` also works:
```
FILE=app.zip
SIZE=$(stat -f%z "$FILE")   # stat -c%s on Linux

curl -i -X POST "{url}/${FILE}?override=true" \
  -H "X-Auth: {auth_key}" \
  -H "X-Auth-Rest: {rest_auth_key}" \
  -H "Tus-Resumable: 1.0.0" \
  -H "Upload-Length: ${SIZE}" \
  -H "Upload-Offset: 0"
# -> 201 Created

curl -i -X PATCH "{url}/${FILE}?override=true" \
  -H "X-Auth: {auth_key}" \
  -H "X-Auth-Rest: {rest_auth_key}" \
  -H "Tus-Resumable: 1.0.0" \
  -H "Content-Type: application/offset+octet-stream" \
  -H "Upload-Offset: 0" \
  --data-binary "@${FILE}"
# -> 204 No Content, Upload-Offset response header equals SIZE when done
```

## Request body

- HostingV1FilesGenerateUploadUrlRequest
  - `username` string, required — Account username
  - `domain` string, required — Website domain

## Response `200`

Success response

- HostingV1FilesUploadUrlResource
  - `url` string, required — The TUS upload endpoint URL to send upload requests to
  - `auth_key` string, required — Authentication token to pass as the `X-Auth` header in TUS upload requests
  - `rest_auth_key` string, required — Authentication token to pass as the `X-Auth-Rest` header in TUS upload requests

## Other responses

- `401` — Unauthenticated response
- `422` — Validation error response
- `500` — Error response

---

[API](https://skmtc.net/hostinger/apis/hostinger-api.md) · [All operations](https://skmtc.net/hostinger/apis/hostinger-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hostinger/hostinger-api/revisions/2d2a2dc172ed/schema)