Signed uploads with a signature

Note: Signatures are the legacy credential. They are still supported and run against the same project setting as auth tokens, which new integrations should use: tokens travel in a header and can be limited to particular endpoints and a number of operations.

A signature restricts who can upload files to your Uploadcare project, and for how long. Your backend signs an expiry timestamp with the project secret key, and both values travel with the request as the signature and expire parameters. This works with File Uploader, jQuery File Uploader (deprecated), and Upload API.

The Upload API authentication reference has the wire format. This page is how you generate one and wire it in.

Enable signed uploads

Turn on Signed Uploads as described in Turn it on. The same setting covers signatures and auth tokens, so once it’s on, every Upload API request must carry one of them.

Generate a signature

Generate the signature and expire pair on your backend, never in the browser: it needs your project’s secret key. In Node, use generateSecureSignature from @uploadcare/signed-uploads. In other languages, any HMAC-SHA256 library works. The reference has the inputs, the seconds-not-milliseconds rule for expire, and samples for JavaScript, Node, Python, Ruby and Elixir.

Send both values with the upload request, as in the reference’s upload example. When a signature is refused, the signature errors table names the cause.

File Uploader integration

For File Uploader, set the secure signature and secure expire options directly, or use secureUploadsSignatureResolver to fetch a fresh signature automatically as it nears expiration.

Note: jQuery File Uploader was deprecated on September 1, 2025. The signed uploads integration still works, but we recommend migrating to File Uploader.

Moving to auth tokens

You can move a piece at a time: a request that carries a signature is still checked the old way. See moving from signatures for the gradual path and how File Uploader switches.