Documentation

Everything you need to build and ship

Practical guides for the workspace and the API. Start with the quickstart, then dive into the area you're working in.

Guides

Quickstart

Create an account, start your 3-day trial, upload your first file and copy a share link in under two minutes.

→Sign up with email or Google
→Create a folder
→Drag files in
→Copy the share URL

Uploading & organising

Chunked, resumable uploads for large media, plus folders, starred items, recents, versions and trash.

→Drag-and-drop or pick files
→Resume interrupted uploads
→Move, rename, star, restore

Editing & converting

Crop, resize, rotate and compress images; trim video, generate thumbnails and convert between formats — originals are never overwritten.

→Open a file
→Choose a tool
→Preview
→Save as a new version

Sharing, embedding & streaming

Direct, embed, stream and download URLs for every file, with passwords, expiry dates, revoke and QR codes.

→Set visibility
→Add a password or expiry
→Copy embed code
→Revoke any time

API keys & signed requests

Create scoped keys in your workspace, sign every request with HMAC-SHA256 and stay inside your plan's per-minute allowance.

→Create a key
→Sign the request
→Read the response
→Handle 429 retries

Billing & plans

Trials, upgrades, Pesepay checkout, receipts and what happens when a quota is reached.

→Start a trial
→Upgrade or downgrade
→Download receipts

API reference

Base URL & authentication

Every partner request goes to POST https://shannonsharecloud.lovable.app/api/public/media with a JSON body. Requests are signed rather than bearer-authenticated: compute an HMAC-SHA256 of {timestamp}.POST.{path}.{body} using your key secret, lowercase hex. Timestamps older than 5 minutes are rejected, and the body must be byte-identical to what you signed.

X-SSC-Key

Your key id, e.g. ssc_live_…

X-SSC-Timestamp

Unix seconds, within 5 minutes

X-SSC-Signature

Lowercase hex HMAC-SHA256 digest

Signing a request (Node)

import { createHmac } from "node:crypto";

const path = "/api/public/media";
const body = JSON.stringify({ action: "list", limit: 25 });
const ts = Math.floor(Date.now() / 1000).toString();
const signature = createHmac("sha256", process.env.SSC_SECRET)
  .update(`${ts}.POST.${path}.${body}`)
  .digest("hex");

const res = await fetch("https://shannonsharecloud.lovable.app" + path, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-SSC-Key": process.env.SSC_KEY_ID,
    "X-SSC-Timestamp": ts,
    "X-SSC-Signature": signature,
  },
  body,
});

Endpoints

One signed endpoint with three actions. All responses are JSON and never cached.

POST /api/public/mediaaction: listscope: read

List media

Returns the newest files on the key owner's account, optionally filtered by name.

Request body

{
  "action": "list",
  "limit": 25,
  "search": "trailer"
}

Response 200

{
  "files": [
    {
      "id": "8f1c…",
      "name": "trailer-4k.mp4",
      "mime_type": "video/mp4",
      "size_bytes": 184320512,
      "is_public": true,
      "created_at": "2026-09-01T10:22:11.000Z"
    }
  ]
}

→ limit — optional integer, 1–100, defaults to 25
→ search — optional string up to 120 characters, matches the file name

POST /api/public/mediaaction: filescope: read

Get one file

Metadata for a single file. Storage paths are never returned.

Request body

{
  "action": "file",
  "id": "8f1c0f5e-…-a91b"
}

Response 200

{
  "file": {
    "id": "8f1c…",
    "name": "trailer-4k.mp4",
    "mime_type": "video/mp4",
    "size_bytes": 184320512,
    "is_public": true,
    "created_at": "2026-09-01T10:22:11.000Z"
  }
}

→ id — required UUID of a file on the key owner's account

POST /api/public/mediaaction: signed_urlscope: read

Create a temporary URL

A short-lived playback or download URL for streaming and embedding.

Request body

{
  "action": "signed_url",
  "id": "8f1c0f5e-…-a91b",
  "expires_in": 3600
}

Response 200

{
  "id": "8f1c…",
  "name": "trailer-4k.mp4",
  "mime_type": "video/mp4",
  "url": "https://…/user-files/…?token=…",
  "expires_in": 3600
}

→ id — required UUID of a file on the key owner's account
→ expires_in — optional seconds, 60–86400, defaults to 3600

Rate limits

Counted per key over a rolling minute. Over the limit you get a 429 with Retry-After, X-RateLimit-Limit and X-RateLimit-Remaining headers — wait, then retry.

Plan	Requests / minute	Calls / month
free	30	1,000
starter	120	25,000
pro	600	250,000
studio	1,200	1,000,000
enterprise	6,000	5,000,000

Errors

400 — the body could not be understood.
401 — missing headers, stale timestamp, unknown or revoked key, or a signature that does not match.
403 — the key is missing the read scope.
404 — no such file on this account.
429 — the key's per-minute allowance is used up; wait for the seconds in the Retry-After header, then retry.
500 — temporary failure, safe to retry.

{ "error": "Invalid signature." }

Live test

Run a genuinely signed request against the live endpoint with one of your own keys. The signature is computed for you and the exact request and response are shown below.

Open the partner portal More examples Get help

Apps for every device

Shannon Share Cloud installs as an app on Windows, macOS, Linux, Android and iOS. The installers are produced from this project's native shell (version 1.0.0) and always open the live site, so the app never falls behind the web.