> ## Documentation Index
> Fetch the complete documentation index at: https://www.dropfans.io/developers/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /api/external/vault/video-upload — Start a video upload (step 1 of 3)

> Starts a direct-to-CDN video upload and returns presigned TUS credentials.

- Source: https://www.dropfans.io/developers/reference/start-video-upload
- Section: API reference
- OpenAPI: https://www.dropfans.io/developers/openapi.json

Starts a direct-to-CDN video upload and returns presigned TUS credentials.

Videos cannot ride through [POST /api/external/vault](https://www.dropfans.io/developers/reference/upload-vault-item.md) — the platform rejects request bodies over ~4MB before the app even runs. Instead: **(1)** call this to create the video and get credentials, **(2)** upload the raw bytes straight to the returned `tusEndpoint` with any TUS client, sending `AuthorizationSignature`, `AuthorizationExpire`, `VideoId` and `LibraryId` as TUS headers, **(3)** call [complete](https://www.dropfans.io/developers/reference/complete-video-upload.md) with the `completionToken`. The full sequence with code is in the [upload guide](https://www.dropfans.io/developers/guides/upload-media.md).

The CDN API key itself is never exposed — only a sha256 signature valid ~6 hours. The completion token is valid 8 hours.

## Authentication

`Authorization: Bearer dpfn_...` — an API key generated in the creator's dashboard (Vault → API Connect). One key = one creator. Missing or invalid keys return 401 `{"error":"Unauthorized","code":"unauthorized"}`.

## Request body (application/json)

| Field | Type | Required | Description |
|---|---|---|---|
| `originalName` | string | yes | The video file name, stored as fileName. |
| `fileSize` | integer |  | Optional advisory byte count — obvious oversizes are rejected up front. The authoritative check runs at completion. Max 500MB. |

Example — Start an upload:

```json
{
  "originalName": "teaser.mp4",
  "fileSize": 52428800
}
```

## Responses

### 200

Upload created — feed these credentials to your TUS client.

| Field | Type | Required | Description |
|---|---|---|---|
| `videoId` | string | yes | The Bunny Stream GUID created for this upload. Send it back to the complete step, and use it as the TUS `VideoId` metadata. |
| `tusEndpoint` | string | yes | The TUS upload endpoint (https://video.bunnycdn.com/tusupload). Upload the raw file bytes here with a TUS client. |
| `libraryId` | string | yes | Bunny Stream library id — send as the `LibraryId` TUS header. |
| `signature` | string | yes | Presigned sha256 — send as the `AuthorizationSignature` TUS header. The Stream API key itself is never exposed. |
| `expires` | integer | yes | Unix timestamp (seconds) when the signature expires (~6 hours) — send as the `AuthorizationExpire` TUS header. |
| `completionToken` | string | yes | HMAC token proving this upload was started by your key — required by the complete step. Valid 8 hours. |

```json
{
  "videoId": "c2f7f9e2-1111-4222-b333-4d55e6f7a8b9",
  "tusEndpoint": "https://video.bunnycdn.com/tusupload",
  "libraryId": "572783",
  "signature": "9b2f…64 hex…c1a0",
  "expires": 1755640800,
  "completionToken": "eyJ…"
}
```

## Errors

| Status | Body | When |
|---|---|---|
| 400 | `{"error":"Missing required field: originalName"}` | `originalName` absent or blank. |
| 401 | `{"error":"Unauthorized","code":"unauthorized"}` | Missing or invalid API key. |
| 413 | `{"error":"Video too large. Max 500MB."}` | The advisory fileSize exceeds 500MB. |
| 500 | `{"error":"Could not start the video upload"}` | CDN video creation failed — retry later. |

## Rate limiting

Per-key fixed windows by tier (Personal 60/min · 5,000/day; approved apps 300/min · 50,000/day; Dropfans-operated integrations exempt). Read the live values from X-RateLimit-Tier, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset and their -Day variants; a 429 carries Retry-After and `{"error":"Rate limit exceeded","code":"rate_limited"}`. See [Rate limits](https://www.dropfans.io/developers/concepts/rate-limits.md).

## Code samples

### curl

```bash
curl -X POST "https://www.dropfans.io/api/external/vault/video-upload" \
  -H "Authorization: Bearer $DROPFANS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "originalName": "teaser.mp4",
  "fileSize": 52428800
}'
```

### Node

```javascript
const res = await fetch(`https://www.dropfans.io/api/external/vault/video-upload`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "originalName": "teaser.mp4",
    "fileSize": 52428800
  }),
});
console.log(await res.json());
```

### Python

```python
import os
import requests

res = requests.post(
    "https://www.dropfans.io/api/external/vault/video-upload",
    headers={"Authorization": f"Bearer {os.environ['DROPFANS_API_KEY']}"},
    json={
        "originalName": "teaser.mp4",
        "fileSize": 52428800,
    },
)
print(res.json())
```

## OpenAPI

```json
{
  "method": "POST",
  "path": "/api/external/vault/video-upload",
  "operationId": "startVideoUpload",
  "tags": [
    "vault"
  ],
  "summary": "Start a video upload (step 1 of 3)",
  "description": "Starts a direct-to-CDN video upload and returns presigned TUS credentials.\n\nVideos cannot ride through [POST /api/external/vault](https://www.dropfans.io/developers/reference/upload-vault-item.md) — the platform rejects request bodies over ~4MB before the app even runs. Instead: **(1)** call this to create the video and get credentials, **(2)** upload the raw bytes straight to the returned `tusEndpoint` with any TUS client, sending `AuthorizationSignature`, `AuthorizationExpire`, `VideoId` and `LibraryId` as TUS headers, **(3)** call [complete](https://www.dropfans.io/developers/reference/complete-video-upload.md) with the `completionToken`. The full sequence with code is in the [upload guide](https://www.dropfans.io/developers/guides/upload-media.md).\n\nThe CDN API key itself is never exposed — only a sha256 signature valid ~6 hours. The completion token is valid 8 hours.",
  "requestBody": {
    "required": true,
    "content": {
      "application/json": {
        "schema": {
          "type": "object",
          "properties": {
            "originalName": {
              "type": "string",
              "description": "The video file name, stored as fileName.",
              "example": "teaser.mp4"
            },
            "fileSize": {
              "type": "integer",
              "description": "Optional advisory byte count — obvious oversizes are rejected up front. The authoritative check runs at completion. Max 500MB.",
              "example": 52428800,
              "maximum": 524288000
            }
          },
          "required": [
            "originalName"
          ]
        },
        "examples": {
          "start": {
            "summary": "Start an upload",
            "value": {
              "originalName": "teaser.mp4",
              "fileSize": 52428800
            }
          }
        }
      }
    }
  },
  "responses": {
    "200": {
      "description": "Upload created — feed these credentials to your TUS client.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "videoId": {
                "type": "string",
                "description": "The Bunny Stream GUID created for this upload. Send it back to the complete step, and use it as the TUS `VideoId` metadata.",
                "example": "c2f7f9e2-1111-4222-b333-4d55e6f7a8b9"
              },
              "tusEndpoint": {
                "type": "string",
                "description": "The TUS upload endpoint (https://video.bunnycdn.com/tusupload). Upload the raw file bytes here with a TUS client.",
                "format": "uri"
              },
              "libraryId": {
                "type": "string",
                "description": "Bunny Stream library id — send as the `LibraryId` TUS header."
              },
              "signature": {
                "type": "string",
                "description": "Presigned sha256 — send as the `AuthorizationSignature` TUS header. The Stream API key itself is never exposed."
              },
              "expires": {
                "type": "integer",
                "description": "Unix timestamp (seconds) when the signature expires (~6 hours) — send as the `AuthorizationExpire` TUS header.",
                "example": 1755640800
              },
              "completionToken": {
                "type": "string",
                "description": "HMAC token proving this upload was started by your key — required by the complete step. Valid 8 hours."
              }
            },
            "required": [
              "videoId",
              "tusEndpoint",
              "libraryId",
              "signature",
              "expires",
              "completionToken"
            ]
          },
          "example": {
            "videoId": "c2f7f9e2-1111-4222-b333-4d55e6f7a8b9",
            "tusEndpoint": "https://video.bunnycdn.com/tusupload",
            "libraryId": "572783",
            "signature": "9b2f…64 hex…c1a0",
            "expires": 1755640800,
            "completionToken": "eyJ…"
          }
        }
      }
    },
    "400": {
      "description": "`originalName` absent or blank.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message describing what went wrong.",
                "example": "Vault item not found"
              }
            },
            "required": [
              "error"
            ]
          },
          "example": {
            "error": "Missing required field: originalName"
          }
        }
      }
    },
    "401": {
      "description": "Missing or invalid API key.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "Unauthorized",
            "code": "unauthorized"
          }
        }
      }
    },
    "403": {
      "description": "The app this key belongs to has been suspended by Dropfans. Every request fails with this until the app is reinstated — surface it to the creator and contact Dropfans.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "This integration has been suspended by Dropfans. Contact the app developer.",
            "code": "app_suspended"
          }
        }
      }
    },
    "413": {
      "description": "The advisory fileSize exceeds 500MB.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message describing what went wrong.",
                "example": "Vault item not found"
              }
            },
            "required": [
              "error"
            ]
          },
          "example": {
            "error": "Video too large. Max 500MB."
          }
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded for the current minute or day window. Wait Retry-After seconds and retry.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "Retry-After": {
          "description": "Seconds to wait before retrying (sent with 429s).",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "Rate limit exceeded",
            "code": "rate_limited"
          }
        }
      }
    },
    "500": {
      "description": "CDN video creation failed — retry later.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message describing what went wrong.",
                "example": "Vault item not found"
              }
            },
            "required": [
              "error"
            ]
          },
          "example": {
            "error": "Could not start the video upload"
          }
        }
      }
    }
  },
  "x-codeSamples": [
    {
      "lang": "cURL",
      "label": "curl",
      "source": "curl -X POST \"https://www.dropfans.io/api/external/vault/video-upload\" \\\n  -H \"Authorization: Bearer $DROPFANS_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"originalName\": \"teaser.mp4\",\n  \"fileSize\": 52428800\n}'"
    },
    {
      "lang": "JavaScript",
      "label": "Node",
      "source": "const res = await fetch(`https://www.dropfans.io/api/external/vault/video-upload`, {\n  method: 'POST',\n  headers: {\n    Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,\n    'Content-Type': 'application/json',\n  },\n  body: JSON.stringify({\n    \"originalName\": \"teaser.mp4\",\n    \"fileSize\": 52428800\n  }),\n});\nconsole.log(await res.json());"
    },
    {
      "lang": "Python",
      "source": "import os\nimport requests\n\nres = requests.post(\n    \"https://www.dropfans.io/api/external/vault/video-upload\",\n    headers={\"Authorization\": f\"Bearer {os.environ['DROPFANS_API_KEY']}\"},\n    json={\n        \"originalName\": \"teaser.mp4\",\n        \"fileSize\": 52428800,\n    },\n)\nprint(res.json())"
    }
  ],
  "x-dropfans-docs": "https://www.dropfans.io/developers/reference/start-video-upload"
}
```

---

Previous: [Delete a vault folder](https://www.dropfans.io/developers/reference/delete-folder.md) · Next: [Finish a video upload (step 3 of 3)](https://www.dropfans.io/developers/reference/complete-video-upload.md) · All pages: [llms.txt](https://www.dropfans.io/developers/llms.txt)