How to upload files via API (web → CDN)

Authorization: <YOUR_API_KEY>

# Step 1 — ask for a presigned upload URL
curl -X POST https://api.cdn22.net/v1/files/<FOLDER_ID> \
  -H "Authorization: <YOUR_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "filesMetadata": [
      { "name": "report.pdf", "size": 248173, "type": "application/pdf" }
    ]
  }'

# Response
# {
#   "success": true,
#   "urls": [
#     {
#       "url": "https://<bucket>.s3.<region>.amazonaws.com/...&X-Amz-Signature=...",
#       "id": "1b9d6bcd-bbfd-4b2d-9b5d-ab8dfbbd4bed",
#       "key": "<owner>/<folder>/report.pdf",
#       "private": false,
#       "duplicate": false
#     }
#   ]
# }

# Step 2 — PUT the raw bytes straight to the presigned URL.
# No Authorization header here — the signature is baked into the URL.
curl -X PUT "https://<bucket>.s3.<region>.amazonaws.com/...&X-Amz-Signature=..." \
  -H "Content-Type: application/pdf" \
  --data-binary @report.pdf

# Step 3 — confirm the upload with the id from step 1.
curl -X POST https://api.cdn22.net/v1/files/confirm-upload \
  -H "Authorization: <YOUR_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{ "ids": ["1b9d6bcd-bbfd-4b2d-9b5d-ab8dfbbd4bed"] }'

# Your public file is now live at:
# https://cdn.cdn22.net/<owner>/<folder>/report.pdf

// Your backend (Node 18+, any framework). The API key lives here and
// only here — it is never sent to the browser.
const API = "https://api.cdn22.net/v1";
const API_KEY = process.env.CDN22_API_KEY;   // server env only
const FOLDER_ID = process.env.CDN22_FOLDER_ID;

// POST /api/upload-url  { name, size, type } -> { url, id, key }
export async function createUploadUrl({ name, size, type }) {
  // Authenticate the caller and validate name/size/type here — this
  // endpoint mints upload credentials on your account.
  const res = await fetch(`${API}/files/${FOLDER_ID}`, {
    method: "POST",
    headers: {
      Authorization: API_KEY, // raw key, no "Bearer" prefix
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ filesMetadata: [{ name, size, type }] }),
  });
  if (!res.ok) throw new Error(`create failed: ${res.status}`);
  const { urls } = await res.json();
  return urls[0]; // { url, id, key } — short-lived, safe to hand to the browser
}

// POST /api/confirm-upload  { id } -> { ok: true }
export async function confirmUpload(id) {
  const res = await fetch(`${API}/files/confirm-upload`, {
    method: "POST",
    headers: {
      Authorization: API_KEY,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ ids: [id] }),
  });
  if (!res.ok) throw new Error(`confirm failed: ${res.status}`);
  return { ok: true };
}

// Browser — no cdn22.net API key anywhere in this file. The page only
// ever holds a short-lived presigned URL minted by your backend.
async function uploadFile(file) {
  // 1. Ask YOUR backend for a presigned URL for this exact file.
  const res = await fetch("/api/upload-url", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ name: file.name, size: file.size, type: file.type }),
  });
  const { url, id, key } = await res.json();

  // 2. PUT the File object straight to storage. The browser streams the
  //    bytes directly — they never touch your server.
  await fetch(url, {
    method: "PUT",
    headers: { "Content-Type": file.type || "application/octet-stream" },
    body: file,
  });

  // 3. Confirm via your backend (unconfirmed uploads are cleaned up).
  await fetch("/api/confirm-upload", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ id }),
  });

  // Public file → permanent CDN URL.
  return `https://cdn.cdn22.net/${key}`;
}

// Usage:
document.querySelector("#file").addEventListener("change", async (e) => {
  const cdnUrl = await uploadFile(e.target.files[0]);
  console.log("Live at:", cdnUrl);
});

// Node.js (server-side) upload. Requires Node 18+ for global fetch.
import { readFile } from "node:fs/promises";
import { basename } from "node:path";

const API = "https://api.cdn22.net/v1";
const API_KEY = process.env.CDN22_API_KEY; // keep keys in env, never in code
const FOLDER_ID = process.env.CDN22_FOLDER_ID;

export async function upload(path, contentType) {
  const bytes = await readFile(path);

  // 1. Presigned URL
  const createRes = await fetch(`${API}/files/${FOLDER_ID}`, {
    method: "POST",
    headers: {
      Authorization: API_KEY,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      filesMetadata: [
        { name: basename(path), size: bytes.length, type: contentType },
      ],
    }),
  });
  if (!createRes.ok) throw new Error(`create failed: ${createRes.status}`);
  const { urls } = await createRes.json();
  const { url, id, key } = urls[0];

  // 2. PUT the bytes
  const putRes = await fetch(url, {
    method: "PUT",
    headers: { "Content-Type": contentType },
    body: bytes,
  });
  if (!putRes.ok) throw new Error(`put failed: ${putRes.status}`);

  // 3. Confirm
  const confirmRes = await fetch(`${API}/files/confirm-upload`, {
    method: "POST",
    headers: {
      Authorization: API_KEY,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ ids: [id] }),
  });
  if (!confirmRes.ok) throw new Error(`confirm failed: ${confirmRes.status}`);

  return `https://cdn.cdn22.net/${key}`;
}

// const cdnUrl = await upload("./report.pdf", "application/pdf");