Authentication

Every API call needs your API key. Send it in a header:

X-API-KEY: YOUR_API_KEY

• Authorization: Bearer YOUR_API_KEY works too.
• Upload and note calls also accept the key as a token form field.
• A key in the query string (?token=...) is refused with 400, so it never ends up in logs.
• Files are saved to the account the key belongs to, and count toward its storage limit.

Quick start

Upload a file and read the link from the answer:

curl -H "X-API-KEY: YOUR_API_KEY" \
     -F "file=@/path/to/report.pdf" \
     https://izfiles.com/api/upload

{
  "success": true,
  "file_hash": "abc123def456",
  "filename": "report.pdf",
  "privacy": "private",
  "share_url": "https://izfiles.com/share/abc123def456",
  "download_url": "https://izfiles.com/download/abc123def456",
  "access": "link"
}

Keep the file_hash: every other call uses it.

Limits and quotas

The administrator can change these limits. A call over a limit answers 429; responses carry X-RateLimit-* headers.

Upload a file

curl -H "X-API-KEY: YOUR_API_KEY" \
     -F "file=@/path/to/photo.png" \
     -F "privacy=public" \
     https://izfiles.com/api/upload

import requests

with open("photo.png", "rb") as handle:
    response = requests.post(
        "https://izfiles.com/api/upload",
        headers={"X-API-KEY": "YOUR_API_KEY"},
        files={"file": handle},
        data={"privacy": "public"},
    )
result = response.json()
print(result["share_url"])
if result.get("direct_url"):
    print("Embed:", result["direct_url"])

const fs = require('fs');

async function uploadFile(path) {
  const form = new FormData(); // Node.js 18 or later
  form.append('file', new Blob([fs.readFileSync(path)]), require('path').basename(path));
  const response = await fetch('https://izfiles.com/api/upload', {
    method: 'POST',
    headers: { 'X-API-KEY': process.env.IZFILES_API_KEY },
    body: form,
  });
  return response.json(); // file_hash, share_url, download_url ...
}

Upload from a URL

The server downloads the file for you. Same endpoint, with url instead of file.

curl -H "X-API-KEY: YOUR_API_KEY" \
     -F "url=https://example.com/file.pdf" \
     https://izfiles.com/api/upload

The download must finish within 5 minutes and stay under your file size limit. The answer also has source_url.

Large files in chunks

For files over about 95 MB: start an upload, send the file in pieces, then complete it. The result is the same as /api/upload, and the same size and storage limits apply.

1. Start

   POST/api/upload/chunked/startform or JSON

   Field	Required	Description
   filename	Yes	Name of the file.
   file_size	Yes	Size in bytes.
   chunk_size	No	Bytes per chunk, 1 MB to 90 MB. Default 50 MB (52428800).
   privacy, access, expires_in	No	As in Upload a file.

   {
     "success": true,
     "upload_id": "3f2a9c...",
     "chunk_size": 52428800,
     "total_chunks": 12,
     "received_chunks": 0,
     "missing_chunks": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11],
     "expires_at": "2026-11-13T10:00:00Z"
   }

2. Send every chunk

   PUT/api/upload/chunked/<upload_id>/<index>multipart, field file

   Indexes run from 0 to total_chunks - 1. Every chunk is exactly chunk_size bytes, except the last one, which is the rest of the file.

   Send each chunk as multipart/form-data in the field file. A raw application/octet-stream body is blocked by the web application firewall.

3. Complete

   POST/api/upload/chunked/<upload_id>/completeoptional md5

   Send the md5 of the whole file to have it checked. The answer has the same fields as /api/upload, plus upload_id and md5.

# 1. Start
curl -X POST -H "X-API-KEY: YOUR_API_KEY" \
     -F "filename=big.zip" -F "file_size=629145600" \
     https://izfiles.com/api/upload/chunked/start

# 2. Split into 50 MB parts and send each one (index 0, 1, 2 ...)
split -b 52428800 -d -a 4 big.zip part_
curl -X PUT -H "X-API-KEY: YOUR_API_KEY" -F "file=@part_0000" \
     https://izfiles.com/api/upload/chunked/UPLOAD_ID/0

# 3. Complete
curl -X POST -H "X-API-KEY: YOUR_API_KEY" -F "md5=$(md5sum big.zip | cut -d' ' -f1)" \
     https://izfiles.com/api/upload/chunked/UPLOAD_ID/complete

const fs = require('fs');
const path = require('path');
const axios = require('axios');

async function uploadLarge(filePath, options = {}) {
  const api = axios.create({
    baseURL: 'https://izfiles.com/api/upload/chunked',
    headers: { 'X-API-KEY': process.env.IZFILES_API_KEY },
    maxBodyLength: Infinity,
  });
  const fileSize = fs.statSync(filePath).size;
  const { data: start } = await api.post('/start', {
    filename: path.basename(filePath), file_size: fileSize, ...options,
  });
  const handle = await fs.promises.open(filePath, 'r');
  try {
    for (let index = 0; index < start.total_chunks; index++) {
      const length = Math.min(start.chunk_size, fileSize - index * start.chunk_size);
      const chunk = Buffer.alloc(length);
      await handle.read(chunk, 0, length, index * start.chunk_size);
      for (let attempt = 1; ; attempt++) {
        try {
          const form = new FormData(); // Node.js 18 or later
          form.append('file', new Blob([chunk]), `part_${index}`);
          await api.put(`/${start.upload_id}/${index}`, form);
          break;
        } catch (err) {
          if (attempt === 3 || err.response?.status === 400) throw err;
        }
      }
    }
  } finally {
    await handle.close();
  }
  const { data } = await api.post(`/${start.upload_id}/complete`);
  return data; // same fields as /api/upload
}

Good to know

• Chunks can be sent in any order and in parallel. Sending a chunk again replaces it, so retry a failed chunk as it is.
• GET /api/upload/chunked/<upload_id> lists missing_chunks, so an interrupted upload can resume. After completion it returns the result.
• Calling complete again returns the same file, not a second copy. If complete answers 400 with missing_chunks, send those and complete again.
• DELETE /api/upload/chunked/<upload_id> cancels an unfinished upload. Uploads are removed 24 hours after start.
• An account can have up to 50 unfinished uploads at once.

Get file info

curl -H "X-API-KEY: YOUR_API_KEY" https://izfiles.com/api/file/abc123def456

{
  "success": true,
  "file_hash": "abc123def456",
  "filename": "example.png",
  "privacy": "public",
  "access": "link",
  "file_size": 1024000,
  "file_type": "png",
  "is_image": true,
  "upload_date": "2026-11-12T10:30:00",
  "download_count": 5,
  "has_password": false,
  "share_url": "https://izfiles.com/share/abc123def456",
  "direct_url": "https://izfiles.com/direct/abc123def456"
}

For a signed file, only its owner or an admin gets an answer, and the plain links are left out.

List files

curl -H "X-API-KEY: YOUR_API_KEY" \
     "https://izfiles.com/api/files?privacy=public&type=image&per_page=10"

{
  "success": true,
  "files": [
    { "file_hash": "abc123def456", "filename": "example.png", "privacy": "public", "access": "link", "...": "..." }
  ],
  "pagination": { "page": 1, "per_page": 10, "total": 50, "pages": 5, "has_next": true, "has_prev": false }
}

Delete a file

curl -X DELETE -H "X-API-KEY: YOUR_API_KEY" https://izfiles.com/api/file/abc123def456

async function deleteIzfile(fileHash) {
  try {
    await axios.delete(`https://izfiles.com/api/file/${fileHash}`, {
      headers: { 'X-API-KEY': process.env.IZFILES_API_KEY },
    });
  } catch (err) {
    // 404: already deleted, or not a file of this API key.
    if (err.response?.status !== 404) throw err;
  }
}

{ "success": true, "file_hash": "abc123def456", "deleted": true }

• Only the owner or an admin can delete a file. It cannot be undone, and every link stops working at once, signed links included.
• 404: the file does not exist or is not yours. When retrying a delete, treat it as already deleted.
• 503 with Retry-After: the server is busy and nothing was deleted. Retry later.

Download links

Each file has three links. No login or API key is needed to use them.

curl -L -o report.pdf https://izfiles.com/download/abc123def456

# Password-protected file
curl -L -H "X-File-Password: the-file-password" -o report.pdf \
     https://izfiles.com/download/abc123def456

Direct links (image, video)

Serves images and videos inline, so other websites can show them with <img>, <video> or CSS. It works for public and private files.

<img src="https://izfiles.com/direct/abc123def456" alt="Product photo">

<video src="https://izfiles.com/direct/def456abc123" controls preload="metadata"></video>

![Product photo](https://izfiles.com/direct/abc123def456)

.hero {
  background: url('https://izfiles.com/direct/abc123def456') center / cover;
}

How it behaves

• Video answers 206 Partial Content to Range requests, so players can start fast and seek. Each answer carries at most 8 MB; players ask for the next part by themselves.
• Signed files need the expires and sig of a signed link; the cache then ends with the link.
• Password-protected files need X-File-Password, which an <img> tag cannot send, so they cannot be embedded.
• Other file types answer 403. See supported formats.

Signed download links

For files that must not be downloadable with a plain link, such as paid content. Such a file opens only with a valid, expiring signed link, or for its owner or an admin who is logged in. Other files are not affected.

1. Upload with access=signed

   curl -H "X-API-KEY: YOUR_API_KEY" \
        -F "file=@/path/to/course.pdf" \
        -F "privacy=private" -F "access=signed" \
        https://izfiles.com/api/upload

   Save the file_hash. The answer has "access": "signed" and no plain links. To change an existing file, see turn signed access on or off.

2. Request a link when a visitor downloads

   POST/api/file/<file_hash>/signed-urlJSON or form

   Field	Required	Description
   expires_in	No	Seconds the link stays valid, 60 to 604800. Default 3600.

   curl -X POST -H "X-API-KEY: YOUR_API_KEY" -H "Content-Type: application/json" \
        -d '{"expires_in": 300}' \
        https://izfiles.com/api/file/abc123def456/signed-url

   {
     "success": true,
     "file_hash": "abc123def456",
     "url": "https://izfiles.com/download/abc123def456?expires=1793927000&sig=...",
     "expires_at": 1793927000,
     "expires_in": 300,
     "access": "signed",
     "has_password": false
   }

   expires_at is a Unix time in seconds. The same expires and sig also work on /direct/<file_hash>.

3. Send the visitor to the link

   app.get('/orders/:id/download', requireLogin, async (req, res) => {
     const order = await findPaidOrder(req.user.id, req.params.id);
     if (!order) return res.sendStatus(403);
     const { data } = await axios.post(
       `https://izfiles.com/api/file/${order.fileHash}/signed-url`,
       { expires_in: 300 },
       { headers: { 'X-API-KEY': process.env.IZFILES_API_KEY } },
     );
     res.set('Cache-Control', 'no-store');
     res.redirect(302, data.url);
   });

Turn signed access on or off

curl -X POST -H "X-API-KEY: YOUR_API_KEY" -H "Content-Type: application/json" \
     -d '{"access": "signed"}' \
     https://izfiles.com/api/file/abc123def456/access

• access is signed or link. Only the owner or an admin can change it.
• Turning it on stops every plain link already given out; setting link makes them work again.
• A public file cannot be signed. Making a signed file public on its edit page turns signed access off.
• A signed link cannot be cancelled before it expires. A download already running is not cut off at expiry.

Create a note

curl -H "X-API-KEY: YOUR_API_KEY" \
     -F "title=Release notes" \
     -F "body=Version 2 is out." \
     https://izfiles.com/api/notes

# Code note from a file
curl -H "X-API-KEY: YOUR_API_KEY" \
     -F "title=Deploy script" -F "type=code" \
     -F "file=@/path/to/deploy.sh" \
     https://izfiles.com/api/notes

{
  "success": true,
  "note_id": 123,
  "title": "Release notes",
  "type": "content",
  "privacy": "private",
  "created_at": "2026-11-12T10:30:00",
  "share_url": "https://izfiles.com/view_shared_note/abc123..."
}

Responses

A successful call answers with "success": true. Upload answers carry these fields:

A failed call answers with an HTTP error status and an error message:

{ "error": "Invalid token" }

Errors

Direct link formats

Any file type that is not blocked can be uploaded and downloaded. /direct serves these:

Script and web page files (for example PHP, JS, HTML, SVG, EXE) cannot be uploaded.

Troubleshooting

Still stuck? Write to [email protected].