HF PanelDocsv1.0.0

API tokens (hff_)

Sign in to the HF Files and HF Studio APIs from a script and get an hff_ token to send as a Bearer token.

HF Files and HF Studio each have a JSON API under /api/v1/, the same one their browser apps use. A script signs in with the hosting account's username and password and gets a temporary API token that starts with hff_.

Where: https://files.yourdomain.com/api/v1/ and https://db.yourdomain.com/api/v1/

Get a token

Send the username and password with "token": true:

bash
curl -s https://files.yourdomain.com/api/v1/login \
     -H 'Content-Type: application/json' \
     -d '{"username":"sarahbakes","password":"…","token":true}'
json
{ "ok": true, "data": { "user": { "username": "sarahbakes", "email": "…", "staff": "" }, "csrf": "…", "token": "hff_…", "expires_in": 7200 } }

If the account uses two-factor login, the first answer is {"twofa": true, "token": "hff_…"}. Send the code with that token, within 5 minutes, to finish. The answer then holds the signed-in token:

bash
curl -s https://files.yourdomain.com/api/v1/login/2fa \
     -H 'Authorization: Bearer hff_…' -H 'Content-Type: application/json' \
     -d '{"code":"123456"}'

Use the token

Send it as a Bearer token. No cookie or CSRF token is needed.

bash
curl -s -H 'Authorization: Bearer hff_…' 'https://files.yourdomain.com/api/v1/files?path=/web'

Every answer is {"ok": true, "data": …} or {"ok": false, "error": "…"}. GET /api/v1 lists every address of the API.

HF Files addresses

Request What it does
GET /api/v1/files?path=/web a folder's contents
GET /api/v1/files/content?path=… a text file (5 MB at most)
PUT /api/v1/files/content {"path","content"}: save a text file
GET /api/v1/files/download?path=… download a file
GET /api/v1/files/size?path=… the total size of a file or folder
POST /api/v1/files/upload?path=/web multipart files[] into a folder (1 GB at most)
POST /api/v1/files/folder / file {"path","name"}: a new folder or empty file
POST /api/v1/files/rename / copy {"path","from","to"}
POST /api/v1/files/move {"path","items":[…],"dest"}
POST /api/v1/files/chmod {"path","name","mode":"644"}
POST /api/v1/files/delete {"path","items":[…]}
POST /api/v1/files/zip / unzip pack entries into a .zip, or extract one
GET / POST /api/v1/shares list or make share links (hours 1–720, 0 = never)
POST /api/v1/shares/revoke {"id"}: stop a share link
POST /api/v1/logout end the session (the token stops working)

How long a token lasts

A token is a session: it lasts 2 hours without use and 12 hours at most, and ends when you call logout, when the account's password changes or when the service restarts. Get a new one when you get Please sign in.

Warning: an hff_ token gives full access to the account's files or databases until it ends. Keep it out of code repositories and logs.

Note: hff_ tokens are for HF Files and HF Studio only. The HF Panel API uses its own hf_ tokens, made in the Control Panel under Account › Password & security.