> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://uploadcare.com/docs/llms.txt.

# Signed uploads with a signature

> Sign Uploadcare upload requests with a signature and expire pair generated on your backend.

> **Note**
>
> **Note:** Signatures are the legacy credential. They are still supported and run against the same project setting as [auth tokens](/docs/security/secure-uploads/), which new integrations should use: tokens travel in a header and can be limited to particular endpoints and a number of operations.

A [signature](/docs/api/upload/authentication/#signature) restricts who can upload files to your Uploadcare project, and for how long. Your backend signs an expiry timestamp with the project secret key, and both values travel with the request as the `signature` and `expire` parameters. This works with [File Uploader](/docs/file-uploader/), [jQuery File Uploader](/docs/uploads/file-uploader/) (deprecated), and [Upload API](https://uploadcare.com/docs/api/upload/).

The [Upload API authentication reference](/docs/api/upload/authentication/#signature) has the wire format. This page is how you generate one and wire it in.

## Enable signed uploads \[#enable]

Turn on **Signed Uploads** as described in [Turn it on](/docs/security/secure-uploads/#enable). The same setting covers signatures and auth tokens, so once it's on, every Upload API request must carry one of them.

## Generate a signature \[#make-signature]

Generate the [`signature` and `expire` pair](/docs/api/upload/authentication/#signature) on your backend, never in the browser: it needs your project's secret key. In Node, use `generateSecureSignature` from `@uploadcare/signed-uploads`. In other languages, any HMAC-SHA256 library works. The [reference](/docs/api/upload/authentication/#signature-generate) has the inputs, the seconds-not-milliseconds rule for `expire`, and samples for JavaScript, Node, Python, Ruby and Elixir.

Send both values with the upload request, as in the reference's [upload example](/docs/api/upload/authentication/#signature-example). When a signature is refused, the [signature errors](/docs/api/upload/authentication/#signature-errors) table names the cause.

## File Uploader integration

For [File Uploader](/docs/file-uploader/), set the [secure signature](/docs/file-uploader/options/#secure-signature) and [secure expire](/docs/file-uploader/options/#secure-expire) options directly, or use [`secureUploadsSignatureResolver`](/docs/file-uploader/options/#secure-uploads-signature-resolver) to fetch a fresh signature automatically as it nears expiration.

> **Note**
>
> **Note:** jQuery File Uploader was deprecated on September 1, 2025. The signed uploads integration still works, but we recommend migrating to [File Uploader](/docs/file-uploader/).

## Moving to auth tokens \[#migrating]

You can move a piece at a time: a request that carries a `signature` is still checked the old way. See [moving from signatures](/docs/security/secure-uploads/#migrating) for the gradual path and how File Uploader switches.