API Authentication

Unsigned Requests

To send unsigned requests, include your public key in the "Authorization" header of the request, preceded by the word "public":

Authorization: public MY_PUBLIC_KEY

Reading files, images and videos needs no authorization unless the app requires signed URLs.

Unsigned requests are appropriate for client-side operations, but may have reduced permissions depending on your app settings.

Signed Requests

Generating an authentication token is a four step process:

1. Generate a random token (string), this string should be:
   • at least then 16 characters in length
   • can not contain any "$" symbols
   • unique per request
2. Using JWT, encrypt the generated token using your private key.
3. The authentication string can now be formed by concatenating your public key, token and encrypted token:

   publicKey$token$encryptedToken

4. Send this new string in the "Authorization" header of your fileboy requests, preceded by the word "token":

   Authorization: token MY_AUTH_STRING

Example

An example implementation could be:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
function generateAuthorizationHeader(publicKey, privateKey) {
  const token = random.string(32)
  const encryptedToken = JWT.sign(token, privateKey)
  return "token " + [publicKey, token, encryptedToken].join("$")
}

// make an API request to fileboy sending the authentication header
httpRequest(
  "https://api.fileboy.io/files/delete/1234-1234-1234",
  {
    headers: {
      Authorization: generateAuthorizationHeader(YOUR_PUBLIC_KEY, YOUR_PRIVATE_KEY)
    }
  }
)

Pre-made Authentication Tokens

In addition to generating your own tokens as described above, you may also want to make use of authentication tokens obtained from one of our libraries or an API response.

You can use a valid authentication token to authorize a request by including it in the "Authorization" header in the same way:

Authorization: token MY_PREMADE_TOKEN