REST API
Programmatic access to shares and groups. Authenticate with an API key or your session cookie.
Authentication
Create an API key in your Account page, then send it as a Bearer token:
Authorization: Bearer bxk_<your-key>
Session cookies also work for browser-based requests.
Base URL
https://boxie.to/api/v1
All endpoints return JSON. Upload endpoints accept multipart/form-data. Delete endpoints return 204 No Content on success.
Shares
/api/v1/shares
List your shares
Returns all shares owned by you. Admins can pass ?all=1 to list everyone's shares.
curl -H "Authorization: Bearer bxk_…" \ https://boxie.to/api/v1/shares
/api/v1/shares/{token}
Get a share
Token can be the hex token or a custom slug.
/api/v1/shares
Upload a file
Multipart form fields:
| Field | Required | Notes |
|---|---|---|
| file | yes | The file to upload |
| share_type | no | permanent · 7day (default) · 24hour · pickup |
| description | no | Optional note |
| allowed_cidrs | no | Comma-separated IP/CIDR allowlist |
| custom_slug | no | Vanity URL slug (lowercase, hyphens, 3–50 chars) |
curl -H "Authorization: Bearer bxk_…" \ -F "file=@photo.jpg" \ -F "share_type=permanent" \ https://boxie.to/api/v1/shares
Returns 201 Created with the share object including a url field.
/api/v1/paste
Create a paste
JSON body fields:
| Field | Required | Notes |
|---|---|---|
| content | yes | The text or code to paste |
| language | no | UI label: "Go", "Python", "Auto-detect" (default), etc. |
| share_type | no | permanent · 7day (default) · 24hour · pickup |
| description | no | Optional note |
| custom_slug | no | Vanity URL slug (lowercase, hyphens, 3–50 chars) |
curl -H "Authorization: Bearer bxk_…" \
-H "Content-Type: application/json" \
-d '{"content":"package main\n\nfunc main() {}","language":"Go"}' \
https://boxie.to/api/v1/paste
Returns 201 Created with the share object including a url field.
/api/v1/shares/{token}
Delete a share
Deletes the share and its stored file. Returns 204 No Content.
Groups
/api/v1/groups
List your groups
Returns all groups owned by you. Admins can pass ?all=1.
/api/v1/groups
Create a group
JSON body: {"name":"…","description":"…","allowed_cidrs":"…"}
curl -H "Authorization: Bearer bxk_…" \
-H "Content-Type: application/json" \
-d '{"name":"My Group"}' \
https://boxie.to/api/v1/groups
/api/v1/groups/{token}
Delete a group
/api/v1/groups/{token}/members/{share_token}
Add share to group
/api/v1/groups/{token}/members/{share_token}
Remove share from group
Share object
{
"token": "bright-crane-42",
"name": "photo.jpg",
"mime_type": "image/jpeg",
"size": 2048576,
"share_type": "permanent",
"created_at": "2026-03-03T12:00:00Z",
"expires_at": null,
"download_count": 0,
"custom_slug": "my-photo", // omitted when not set
"url": "https://boxie.to/s/bright-crane-42" // upload response only
}