Shotstash
API referenceREST referenceAuth

Set the media cookie

Bearer in and media cookie out: sets shotstash_session (HttpOnly; SameSite=Lax; Path=/media) for the session of the Bearer token. Browsers call it after sign-in and on boot. No body.

Try the REST routes against the public demo at https://demostash.aldyernesto.my.id. Get a read-only token (valid for 60 minutes), then paste it as the Bearer token in the console of any route.

POST
/api/v1/auth/cookie

Bearer in and media cookie out: sets shotstash_session (HttpOnly; SameSite=Lax; Path=/media) for the session of the Bearer token. Browsers call it after sign-in and on boot. No body.

Authorization

SessionToken
headerAuthorizationBearer <token>

Session token from POST /api/v1/auth/login or the login mutation, sent as Authorization: Bearer <token>.

Response Body

Cookie set

application/json
  1. response
ok*true

Always true.

Value intrue
expiresAt*string

When the session and the cookie expire (ISO-8601 UTC).

curl -X POST "https://example.com/api/v1/auth/cookie"
{  "ok": true,  "expiresAt": "string"}

Upload one part PUT

Streams one part of a resumable upload started with the initiateUpload mutation. The body is the raw bytes; Content-MD5 is required and checked. Sending a part again replaces it.

Sign in POST

Email and password in and a Bearer token out; also sets the shotstash_session media cookie. Rate limited to 10 attempts per 15 minutes per IP and per email.