Developers

HTTP API

Version 2 · updated 4 September 2026

The API is available on Plus and Team plans. Keys are created on the account page; each key is scoped to one workspace and can be revoked without touching the others.

Authentication

curl https://dropbin.example/v2/transfers \
  -H "Authorization: Bearer db_live_9f2c…" \
  -H "Content-Type: application/json"

Create a transfer

POST /v2/transfers reserves a transfer and returns upload targets. Files are sent directly to storage with short-lived signed URLs, so the API never buffers payloads.

{
  "name": "q3-drawings",
  "expires_in": 604800,
  "max_downloads": 0,
  "password": null
}

Objects

Field	Type	Notes
id	string	Stable transfer id, also used in the public URL.
state	string	pending, ready, expired or deleted.
expires_at	timestamp	Unix seconds. Maximum 90 days on Team.
bytes	integer	Sum of stored object sizes.
downloads	integer	Incremented on the first byte of each response.

Rate limits

60 requests per minute per key, burst 120. Exceeding the window returns 429 with a Retry-After header. Upload and download traffic is not counted.

Webhooks

Team workspaces can subscribe to transfer.ready, transfer.expired and transfer.downloaded. Deliveries are signed with HMAC-SHA256 over the raw body using the workspace secret.

Errors

Errors are JSON with a stable machine code and a human message. Nothing is returned in the body of a 5xx that could leak storage internals.