Connect any app to UQ Cloud in minutes.

UQ Cloud is a headless media pipeline. Your app POSTs a source URL, we fetch, validate, store, and return a stable public_id. From that moment, any resized, compressed, or format-converted version of the asset is available at a predictable URL — no re-uploads, no batch jobs.

1. 1
   Create a key
   Visit API Keys and generate a key. Copy the secret — it's shown once.
2. 2
   Send your first upload
   Point us at any publicly reachable URL. We fetch it server-side.
3. 3
   Use the returned public_id
   Compose a transform URL and drop it into an <img> tag.

curl -X POST https://cloud.zeni.host/api/public/uploads \
  -H "Authorization: Bearer pfk_XXXX.YYYY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://picsum.photos/1200"}'

Every request must include an Authorization header. Keys are formatted <prefix>.<secret>. The prefix is public (safe to log); the secret is hashed with SHA-256 server-side and compared in constant time.

Authorization: Bearer pfk_9f3a2c.6b41d0…c9e2

Ingest a remote asset. UQ Cloud fetches it server-side (SSRF-guarded and size-capped at 50 MB), validates the MIME type, stores the original, and returns a stable identifier.

Request body

Response · 201

{
  "id": "e8b1…",
  "public_id": "sunset-cliffs-4k",
  "filename": "sunset.jpg",
  "bytes": 482113,
  "kind": "image",
  "drive": "Supabase (built-in)",
  "drive_id": "supabase",
  "storage_path": "uploads/images/2026/07/sunset-cliffs-4k.jpg"
}

Try it live

Route uploads to the built-in Supabase bucket or to any cloud drive configured by your workspace admin — Cloudflare R2, S3, Backblaze B2, Koofr, IDrive Sync, or any WebDAV endpoint. Each drive advertises its own capacity, so external clients can pick the cheapest or emptiest destination programmatically.

List available drives

curl https://cloud.zeni.host/api/public/drives \
  -H "Authorization: Bearer $UQCLOUD_KEY"

Response · 200

{
  "drives": [
    {
      "id": "supabase",
      "label": "Supabase (built-in)",
      "provider": "supabase",
      "enabled": true,
      "max_bytes": null,
      "used_bytes": null,
      "free_bytes": null
    },
    {
      "id": "9f2e6c1a-…",
      "label": "Koofr Main",
      "provider": "webdav",
      "enabled": true,
      "max_bytes": 10737418240,
      "used_bytes": 12345,
      "free_bytes": 10737405895
    },
    {
      "id": "3aa8b4d2-…",
      "label": "R2 Account 1",
      "provider": "r2",
      "enabled": true,
      "max_bytes": 53687091200,
      "used_bytes": 8000,
      "free_bytes": 53687083200
    }
  ]
}

supabase reports null capacity (managed pool). Cloud drives report the quota assigned to the drive.

Upload to a specific drive

curl -X POST https://cloud.zeni.host/api/public/uploads \
  -H "Authorization: Bearer $UQCLOUD_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/photo.jpg",
    "filename": "products/photo.jpg",
    "drive": "koofr"
  }'

Drive selection rules

Storage layout

Drive-specific errors

Compose transforms in the path. Order is irrelevant, unknown keys are rejected, and every response is cached at the edge with immutable.

https://cdn.cloud.zeni.host/t/<transforms>/<user_id>/<public_id>.<ext>

Parameters

Playground

Width800px

Quality80

Blur0σ

Format

webpavifjpgpng

Grayscale

https://cdn.cloud.zeni.host/t/w_800,q_80,f_webp/<user_id>/hero.jpg

Every asset is served through one of two URL shapes. Both are designed for edge delivery — use the transform URL in your app whenever possible, even when you don't need a transform.

1. Transform URL (recommended)

https://cdn.cloud.zeni.host/t/<transforms>/<user_id>/<public_id>.<ext>

• Served by the UQ Cloud edge worker + transform service.
• Cached immutable for 1 year across 200+ Cloudflare POPs.
• Works for every drive — the worker fetches the origin object once, transforms it, and stores the derivative. Subsequent requests hit the edge, not your drive.
• Use /t// (no transforms) to serve the original bytes through the CDN.

2. Raw signed URL (exact original bytes)

Rule of thumb

In any external app, always link the /t/…/public_id.exttransform URL. The drive choice becomes an internal storage detail — end users always get sub-100 ms edge delivery, and you can migrate an asset between drives later without changing the URL your customers embed.

Example

<!-- Same asset, three drives, one URL shape -->
<img src="https://cdn.cloud.zeni.host/t/w_800,f_webp/USER_ID/PUBLIC_ID.jpg" />

Configure endpoints on the Webhooks page. Every delivery includes an X-UQ Cloud-Signature header — an HMAC-SHA256 of the raw JSON body, computed with your endpoint secret.

Verify a signature (Node)

import { createHmac, timingSafeEqual } from "crypto";

export function verify(rawBody, header, secret) {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(header || "", "hex");
  const b = Buffer.from(expected, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

Event catalog

Errors return a JSON body { "error": "message" } with a semantic status code.

Hitting a limit returns 429 with a Retry-After header. Contact us to lift caps.