Upload files yourself

From the panel

Files, then Upload a file. Whatever you pick lands in the folder you are looking at and you get the link back. Identical bytes are stored once, so re-uploading the same file costs nothing.

Mint a token

Tokens, then New token. Bind it to one server rather than the whole workspace, so a key that leaks cannot write everywhere. The secret is shown once.

The API token starts with fd_live_. It is not the fda_live_ agent key that goes in server.cfg: that one only connects the fivedock resource, and the upload API does not accept it.

files:write uploads, files:read reads back, files:delete removes, folders:write makes folders, usage:read reads your storage and traffic. logs:write is for sending errors from an app, not for files.

Upload over HTTP

Send the file as multipart/form-data to POST /api/v3/file, the address Fivemanage uses too. path is the folder, made on demand, and filename overrides the name of the file part.

curl -X POST https://api.fivedock.dev/api/v3/file \
  -H "Authorization: Bearer fd_live_…" \
  -F "[email protected]" \
  -F "path=/branding"

{
  "status": "ok",
  "data": { "id": "8Kq2nR4t", "url": "https://cdn.fivedock.dev/f/8Kq2nR4t.png" },
  "url": "https://cdn.fivedock.dev/f/8Kq2nR4t.png",
  "filename": "logo.png",
  "mime_type": "image/png",
  "size": 48213,
  "fivedock": {
    "fileUrl": "https://cdn.fivedock.dev/f/8Kq2nR4t.png",
    "deduplicated": false,
    "folder": "/branding"
  }
}

url is the CDN link, ready to paste into a loading screen or a Discord embed, and it works as soon as the answer arrives. fivedock.deduplicated tells you the bytes were already stored, so nothing new was billed. The answer above is shortened.

Named files and stable links

Give a file a key, such as items/burger.png, and it is served at a link that never changes: https://cdn.fivedock.dev/o/my-city/items/burger.png, where my-city is your workspace’s short name. Upload to the same key again and the file behind the link is replaced, so an inventory icon or a loading-screen image can change without touching a script or a database.

curl -X POST https://api.fivedock.dev/api/v3/file \
  -H "Authorization: Bearer fd_live_…" \
  -F "[email protected]" \
  -F "key=items/burger.png"

# served at https://cdn.fivedock.dev/o/my-city/items/burger.png
# run it again with a new burger.png and the same link shows the new file

Keys come from the key field of the upload API, from Keep file names in the panel, from archives and from the S3 endpoint, where an object at s3://my-city/items/burger.png is the keyed file items/burger.png. In the panel, a keyed file shows in its key’s folder, /items here.

The file you replace is kept for 7 days, then purged. Keyed links are cached for 5 minutes, so players see a new version within about 5 minutes. Every file also keeps its own /f/ link, whose content never changes.

Keys made from file names are cleaned up for you: spaces become -, and any other character a key cannot hold becomes _. A key you send to the API yourself has to follow the rules already, or it is refused.

Upload a whole folder as .zip or .rar

Drop a .zip or .rar on the upload box in the panel, or send it to POST /api/v3/file/archive, and every file in it is stored. Keep file names is on by default for archives, so burger.png unpacked into items gets the stable link …/o/my-city/items/burger.png. Folders inside the archive are kept.

curl -X POST https://api.fivedock.dev/api/v3/file/archive \
  -H "Authorization: Bearer fd_live_…" \
  -F "[email protected]" \
  -F "path=items"

An archive can be up to 512 MiB, with at most 5,000 files and 4 GiB unpacked. Files we cannot store, such as a type we do not accept or a password-protected entry, come back in a list with the reason. For bigger sets, sync over the S3 endpoint.

From your own uploader in HTML and JS

Never put a token in client-side JavaScript: anyone who opens the page can read it and upload into your workspace. Take the file on your own server, and let it hold the token.

// your server, never the browser: the token stays here
app.post('/upload', upload.single('file'), async (req, res) => {
  const body = new FormData();
  body.append('file', new Blob([req.file.buffer]), req.file.originalname);
  body.append('path', '/player-shots');

  const answer = await fetch('https://api.fivedock.dev/api/v3/file', {
    method: 'POST',
    headers: { Authorization: `Bearer ${process.env.FIVEDOCK_TOKEN}` },
    body,
  });
  res.json(await answer.json());
});

// your page talks to your server, which holds the token
const body = new FormData();
body.append('file', input.files[0]);

const answer = await fetch('/upload', { method: 'POST', body });
const file = await answer.json();
image.src = file.url;

If the file starts in a browser or a FiveM NUI page, your server can mint a one-time upload link instead and hand that over. The browser uploads straight to FiveDock and never sees the token.

If what you want is players sending you files without any code of your own, use an upload portal instead: it is a public page, rate limited per address, with a daily cap and moderation in front of it.

The S3-compatible endpoint

The same token is also an S3 credential, so rclone, the aws CLI and most backup tools can write to it. Use path-style addressing.

rclone config create fivedock s3 \
  provider=Other \
  endpoint=https://s3.fivedock.dev \
  access_key_id=AKFD… \
  secret_access_key=… \
  force_path_style=true \
  region=auto

rclone copy ./branding fivedock:my-city/branding

aws --endpoint-url https://s3.fivedock.dev \
  s3 cp logo.png s3://my-city/branding/logo.png

Every object you put is a keyed file, so s3://my-city/branding/logo.png is served at https://cdn.fivedock.dev/o/my-city/branding/logo.png.

Folders and retention

Make folders in the panel and move files between them. A keyed file’s key moves with it: items/a.png moved to /icons becomes icons/a.png, and if that key is taken, the move is refused for that file. The file list has a list and a grid view, search by name, and filters for type and for when a file was added: the last 24 hours, 7 days, 30 days or all time.

Each folder has a retention policy that decides when its files are deleted.

Serving what you uploaded

Every file gets a CDN link that works as soon as the upload answers. Files are approved on upload; if moderation takes one down later, its link answers 404. Restrict which sites may embed your files with the hotlink allowlist under Settings.