Anya File Hosting API

#Overview

Three endpoints cover most needs: upload a file, import one from a link, and open it again from its direct URL.

• POST/upload
  Multipart upload, up to about 4.5 MB per request.
• GET/hosturl?url={media_url}
  Copy a file from a public link.
• GET/{timestamp}.{ext}
  Open a stored file by its direct link.

#Quick start

1. Send a file.Post it as multipart/form-data to /upload.
2. Read the link.The JSON answer holds the link in url.
3. Share it.Open it, embed it or hot-link it anywhere.

curl -X POST https://anya-file-host.vercel.app/upload \
  -F "file=@path/to/file.jpg"

#Upload a file

Send the file as multipart/form-data. Vercel limits one request body to about 4.5 MB, so use this for small files. For anything bigger, see Large files.

curl -X POST https://anya-file-host.vercel.app/upload \
  -F "file=@path/to/file.jpg"

#Import from a link

We download the remote file on our server and store it for you. It works for files up to the 100 MB limit, which makes it handy for copying images that already live somewhere else.

curl "https://anya-file-host.vercel.app/hosturl?url=https://example.com/image.jpg"

#Large files

The website cuts each file into pieces of at most 4,000,000 bytes, uploads every piece, and then asks the server to save the result. You can do the same from your own code, for files up to 100 MB.

The body is the raw bytes of one piece. You get back a signed record for that piece.

Send JSON with the records from the step above. The response is the normal success JSON.

const CHUNK = 4_000_000;
const uploadId = crypto.randomUUID().replaceAll('-', '');
const chunks = [];

for (let i = 0; i * CHUNK < file.size; i++) {
  const res = await fetch('https://anya-file-host.vercel.app/api/upload/chunk', {
    method: 'POST',
    headers: {
      'x-upload-id': uploadId,
      'x-chunk-index': String(i),
      'x-file-name': encodeURIComponent(file.name),
    },
    body: file.slice(i * CHUNK, (i + 1) * CHUNK),
  });
  chunks.push(await res.json());
}

const done = await fetch('https://anya-file-host.vercel.app/api/upload/complete', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ uploadId, name: file.name, type: file.type, chunks }),
});
console.log((await done.json()).url);

#Open a file

Every upload returns a direct link such as https://anya-file-host.vercel.app/1753020712833.png. Open it in a browser, put it in an <img> tag, or hot-link it anywhere. The file is decrypted as it is sent, and range requests work, so video and audio can seek. Types that can run code in a browser (html, js, css, xml and svg) always download.

#Responses

{
  "data": "https://anya-file-host.vercel.app/1753020712833.png",
  "url": "https://anya-file-host.vercel.app/1753020712833.png",
  "id": "1753020712833.png",
  "filename": "sample.png",
  "size": 83638,
  "uploaded_on": "2025-07-20T14:11:52.833Z",
  "media_type": "image/png"
}

data and url

The direct link to the stored file.

id

The file key, which is the last part of the link.

filename

The original file name.

size

File size in bytes.

uploaded_on

Upload time as an ISO 8601 timestamp.

media_type

The MIME type of the file.

{
  "error": "Failed to download file from URL"
}

#Errors

A failed request returns an HTTP status code and a JSON body with a readable error message.

#Limits

Largest file

Up to 100 MB by default. The site owner can change it.

Piece size

At most 4,000,000 bytes per piece for large uploads.

Single request

POST /upload takes about 4.5 MB per request on Vercel.

File links

A timestamp and an extension, such as 1753020712833.png.

#Encryption

Every file is split into pieces and each piece is encrypted on our server before it is sent to Telegram. The pieces are saved with random names, so the people who can see the Telegram chat only find unreadable data.

When someone opens your link, the pieces are fetched, checked and decrypted on the fly. If a piece was changed in storage, the download stops instead of serving damaged data. Files uploaded before encryption was added keep working as they are.

#Admin access

The admin dashboard has its own sign in page at /admin. For scripts, the same routes also accept HTTP Basic credentials built from the USERNAME and PASSWORD environment variables.

Browse, preview, copy and delete everything that has been uploaded.

curl -X POST https://anya-file-host.vercel.app/delete-images \
  -u admin:YOUR_PASSWORD \
  -H "Content-Type: application/json" \
  -d '["https://anya-file-host.vercel.app/1753020712833.png"]'

#Good to know

• Use POST /upload for small files and /hosturl for files that already exist online.
• If the site owner turns on ENABLE_AUTH, uploads need the admin credentials too.
• For each upload we keep the file name, size, type and, for images and video, the dimensions and duration.
• We also keep the IP address that made the upload, for abuse protection. Only site administrators can see it, and it is never part of a response.