Zaulto API – for uploaders

Your token = your access. Treat it like a password.

An API token is shown exactly once at creation time and cannot be retrieved afterwards. Save it immediately in a safe place (e.g. a password manager) and never commit it to a repository or frontend code.

Always pass the token in the Authorization header – never in the URL, since URLs end up in logs and browser history. If you suspect it has leaked, revoke it in your account right away and create a new one. Every token is limited to the “upload” scope and to your own account: it can only create containers on your behalf – it cannot read, change or delete anyone else's containers.

Authentication & creating a token

The upload API authenticates with a personal bearer token. Here's how to get one: sign in, open the “API tokens” area in your account, give it a descriptive label (e.g. “My upload script”) and optionally a lifetime in days. The token is shown once in clear text – copy it immediately.

On every request send the header Authorization: Bearer <YOUR_TOKEN>. If the header is missing or the token is invalid or revoked, the API responds with 401.

Header
Authorization: Bearer ztk_live_xxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/json

Manage tokens in your account

Create a container

A POST to /api/v1/containers creates a new link container. Only a title and at least one link are required; every other field is optional with sensible defaults. Only http and https links are accepted.

Optionally you enable access protection right away: a password, a captcha (captchaRequired) and an expiry date or access limit (expiresAt, maxDownloads). With urlMasking the real hoster URL also stays hidden.

The response contains the container ID and the ready-to-share public URL – so you can hand out the link right away.

Request (curl)
curl -X POST https://zaulto.com/api/v1/containers \
  -H "Authorization: Bearer $ZAULTO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "My release",
    "links": [
      { "url": "https://filer.net/get/abc123", "filename": "part1.rar" },
      { "url": "https://ddownload.com/abc123xyz", "filename": "part2.rar" }
    ]
  }'

Response (201)
{
  "id": "AB12CD34",
  "slug": null,
  "url": "https://zaulto.com/#/c/AB12CD34",
  "shortUrl": null
}

Read status & hoster label

A GET to /api/c/:id returns the public view of a container. If the container requires neither a password nor a captcha, you can read its state without unlocking it. Per link you see the status (online, offline, pending or unknown) and – if enabled for the container – the hoster name. That lets you detect automatically what is offline where.

Note: with a password/captcha or URL masking enabled, the actual links are only delivered after unlocking; the plain status is still visible through the public view. Zaulto keeps the status current via its built-in, regular link check.

Request (curl)
curl https://zaulto.com/api/c/AB12CD34

Which hosters are detected especially precisely

Limits & error codes

Each container allows up to 40 links. Mirror tiers hold up to 200 links per tier and at most 20 tiers. Titles are capped at 200, descriptions at 2000 characters. There is no fixed upper limit on the number of your containers.

The API responds with clear HTTP status codes – evaluate them instead of only looking at the body.

Security – keeping your access tight

Store the token server-side or in a secret store only, never in browser code or public repositories. Create a separate token with its own label per app/script – that way you can revoke a single one precisely without affecting the others.

Set a lifetime where it makes sense so a forgotten token expires automatically. Send requests over HTTPS only. And if a token ever does leak: revoke it in your account immediately – a revoked token is worthless instantly.

More on security & privacy

Zaulto roadmap

From the first concept to the finished platform – how Zaulto evolves step by step.