Drop API

# API Key authentication
Authorization: Bearer ak_your_api_key_here

https://anon.li/api/v1

{
  "auth_secret": "base64url_argon2id_output"
}

{
  "data": {
    "vault_id": "cuid...",
    "vault_generation": 1,
    "vault_salt": "base64url_salt",
    "password_wrapped_vault_key": "base64url_aes_kw_wrapped_key",
    "kdf_version": 1
  },
  "meta": {
    "request_id": "req_1234567890abcdef"
  }
}

curl https://anon.li/api/v1/drop \
  -H "Authorization: Bearer ak_..."

{
  "data": [
    {
      "id": "abc123xyz",
      "encryptedTitle": "base64...",
      "iv": "base64_iv...",
      "downloads": 3,
      "maxDownloads": 10,
      "expires_at": "2026-01-15T00:00:00.000Z",
      "created_at": "2026-01-08T12:00:00.000Z",
      "fileCount": 2,
      "totalSize": "1048576"
    }
  ],
  "meta": {
    "request_id": "req_1234567890abcdef",
    "total": 1,
    "limit": 50,
    "offset": 0,
    "storage": {
      "used": "5242880",
      "limit": "5368709120"
    }
  }
}

curl -X POST https://anon.li/api/v1/drop \
  -H "Authorization: Bearer ak_..." \
  -H "Content-Type: application/json" \
  -d '{
    "iv": "base64_iv_here",
    "fileCount": 1,
    "expiry": 7,
    "maxDownloads": 10,
    "ownerKey": {
      "wrappedKey": "vault_wrapped_owner_key",
      "vaultId": "vault_id_from_unlock_materials",
      "vaultGeneration": 1
    }
  }'

{
  "data": {
    "drop_id": "abc123xyz",
    "expires_at": "2026-01-15T00:00:00.000Z",
    "owner_key_stored": true
  },
  "meta": {
    "request_id": "req_1234567890abcdef"
  }
}

{
  "fileId": "file123",
  "s3UploadId": "upload-id",
  "uploadUrls": {
    "1": "https://presigned-url-for-chunk-1...",
    "2": "https://presigned-url-for-chunk-2..."
  }
}

{
  "id": "abc123xyz",
  "encryptedTitle": "base64...",
  "encryptedMessage": "base64...",
  "iv": "base64_iv...",
  "customKey": false,
  "salt": null,
  "customKeyData": null,
  "customKeyIv": null,
  "downloads": 4,
  "maxDownloads": 10,
  "expiresAt": "2026-01-15T00:00:00.000Z",
  "hideBranding": false,
  "createdAt": "2026-01-08T12:00:00.000Z",
  "files": [
    {
      "id": "file123",
      "encryptedName": "base64...",
      "size": "1048576",
      "mimeType": "application/pdf",
      "iv": "base64...",
      "chunkSize": 52428800,
      "chunkCount": 1
    }
  ]
}

{
  "success": true,
  "downloadUrls": {
    "file123": "https://presigned-url-for-file-1...",
    "file456": "https://presigned-url-for-file-2..."
  }
}

{
  "success": true
}

import crypto from 'crypto';

// Helper: derive a unique IV for each chunk (or filename)
function deriveChunkIv(baseIv, chunkIndex) {
  const iv = Buffer.alloc(12);
  baseIv.copy(iv, 0, 0, 8);       // First 8 bytes from base IV
  iv.writeUInt32BE(chunkIndex, 8); // Chunk index as big-endian u32
  return iv;
}

// 1. Generate encryption key, drop metadata IV, and per-file IV
const key = crypto.randomBytes(32); // 256-bit AES key
const dropIv = crypto.randomBytes(12); // 96-bit IV for title/message metadata
const fileIv = crypto.randomBytes(12); // 96-bit base IV for this file

// 2. Encrypt file data (chunk index 0 for single-chunk files)
const chunkIv = deriveChunkIv(fileIv, 0);
const cipher = crypto.createCipheriv('aes-256-gcm', key, chunkIv);
const encrypted = Buffer.concat([cipher.update(fileBuffer), cipher.final()]);
const authTag = cipher.getAuthTag();
const encryptedData = Buffer.concat([encrypted, authTag]);

// 3. Encrypt filename (reserved chunk index 0xFFFFFFFF)
const filenameIv = deriveChunkIv(fileIv, 0xFFFFFFFF);
const nameCipher = crypto.createCipheriv('aes-256-gcm', key, filenameIv);
const encryptedName = Buffer.concat([
  nameCipher.update(filename, 'utf8'),
  nameCipher.final(),
  nameCipher.getAuthTag()
]).toString('base64url');

// 4. Create drop
const createResponse = await fetch('https://anon.li/api/v1/drop', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer ak_...',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    iv: dropIv.toString('base64url'),
    fileCount: 1,
    expiry: 7,
    // ownerKey: {
    //   wrappedKey: vaultWrappedOwnerKey,
    //   vaultId,
    //   vaultGeneration
    // }
  })
}).then(r => r.json());
const drop = createResponse.data;

// 5. Add file and get presigned upload URLs
const file = await fetch(`https://anon.li/api/v1/drop/${drop.drop_id}/file`, {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer ak_...',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    size: encryptedData.length,
    encryptedName,
    iv: fileIv.toString('base64url'),
    mimeType: 'application/octet-stream',
    chunkCount: 1,
    chunkSize: encryptedData.length
  })
}).then(r => r.json());

// 6. Upload encrypted data to presigned URL
const uploadResponse = await fetch(file.uploadUrls[1], {
  method: 'PUT',
  body: encryptedData
});
const etag = uploadResponse.headers.get('ETag');
if (!etag) throw new Error('Storage did not return an ETag');

// 7. Finish the upload by recording chunk ETags and marking the drop ready
await fetch(`https://anon.li/api/v1/drop/${drop.drop_id}?action=finish`, {
  method: 'PATCH',
  headers: {
    'Authorization': 'Bearer ak_...',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    files: [{
      fileId: file.fileId,
      chunks: [{ chunkIndex: 0, etag }]
    }]
  })
});

// 8. Build share URL with key in fragment
const shareUrl = `https://anon.li/d/${drop.drop_id}#${key.toString('base64url')}`;
console.log('Share URL:', shareUrl);

import crypto from 'crypto';

// Helper: derive a unique IV for each chunk (or filename)
function deriveChunkIv(baseIv, chunkIndex) {
  const iv = Buffer.alloc(12);
  baseIv.copy(iv, 0, 0, 8);       // First 8 bytes from base IV
  iv.writeUInt32BE(chunkIndex, 8); // Chunk index as big-endian u32
  return iv;
}

// 1. Parse the share URL
const shareUrl = 'https://anon.li/d/abc123xyz#U2FsdGVkX1...';
const url = new URL(shareUrl);
const dropId = url.pathname.split('/d/')[1];
const keyBase64 = url.hash.slice(1); // Remove the '#'

// 2. Import the encryption key
const keyBuffer = Buffer.from(keyBase64, 'base64url');

// 3. Fetch drop metadata (no auth required)
const drop = await fetch(`https://anon.li/api/v1/drop/${dropId}`)
  .then(r => r.json());

// 4. Get presigned download URLs (increments download counter)
const { downloadUrls } = await fetch(
  `https://anon.li/api/v1/drop/${dropId}/download`,
  { method: 'POST' }
).then(r => r.json());

// 5. Decrypt title and message if present
const dropIv = Buffer.from(drop.iv, 'base64url');

if (drop.encryptedTitle) {
  const titleIv = deriveChunkIv(dropIv, 0xFFFFFFFF);
  const encTitle = Buffer.from(drop.encryptedTitle, 'base64url');
  const titleDec = crypto.createDecipheriv('aes-256-gcm', keyBuffer, titleIv);
  titleDec.setAuthTag(encTitle.slice(-16));
  const title = Buffer.concat([
    titleDec.update(encTitle.slice(0, -16)),
    titleDec.final()
  ]).toString('utf8');
  console.log('Title:', title);
}

if (drop.encryptedMessage) {
  const msgIv = deriveChunkIv(dropIv, 0xFFFFFFFF);
  const encMsg = Buffer.from(drop.encryptedMessage, 'base64url');
  const msgDec = crypto.createDecipheriv('aes-256-gcm', keyBuffer, msgIv);
  msgDec.setAuthTag(encMsg.slice(-16));
  const message = Buffer.concat([
    msgDec.update(encMsg.slice(0, -16)),
    msgDec.final()
  ]).toString('utf8');
  console.log('Message:', message);
}

// 6. Download and decrypt each file
for (const file of drop.files) {
  const fileIv = Buffer.from(file.iv, 'base64url');

  // Decrypt filename (reserved chunk index 0xFFFFFFFF)
  const filenameIv = deriveChunkIv(fileIv, 0xFFFFFFFF);
  const encryptedName = Buffer.from(file.encryptedName, 'base64url');
  const decipher = crypto.createDecipheriv('aes-256-gcm', keyBuffer, filenameIv);
  decipher.setAuthTag(encryptedName.slice(-16));
  const filename = Buffer.concat([
    decipher.update(encryptedName.slice(0, -16)),
    decipher.final()
  ]).toString('utf8');

  // Fetch the encrypted file using the presigned URL
  const downloadUrl = downloadUrls[file.id];
  const encryptedData = await fetch(downloadUrl)
    .then(r => r.arrayBuffer())
    .then(ab => Buffer.from(ab));

  // Decrypt each chunk
  // Each encrypted chunk = ciphertext + 16-byte GCM auth tag
  const chunkSize = file.chunkSize || (50 * 1024 * 1024); // from API or 50 MB default
  const encryptedChunkSize = chunkSize + 16;
  const chunkCount = file.chunkCount || Math.ceil(encryptedData.length / encryptedChunkSize);
  const decryptedChunks = [];

  for (let i = 0; i < chunkCount; i++) {
    const start = i * encryptedChunkSize;
    const end = Math.min(start + encryptedChunkSize, encryptedData.length);
    const chunk = encryptedData.slice(start, end);

    const chunkIv = deriveChunkIv(fileIv, i);
    const dec = crypto.createDecipheriv('aes-256-gcm', keyBuffer, chunkIv);
    dec.setAuthTag(chunk.slice(-16));
    decryptedChunks.push(Buffer.concat([
      dec.update(chunk.slice(0, -16)),
      dec.final()
    ]));
  }

  const decryptedFile = Buffer.concat(decryptedChunks);
  // Save to disk, process, etc.
  console.log(`Decrypted: ${filename} (${decryptedFile.length} bytes)`);
}

import crypto from 'crypto';

function deriveChunkIv(baseIv, chunkIndex) {
  const iv = Buffer.alloc(12);
  baseIv.copy(iv, 0, 0, 8);
  iv.writeUInt32BE(chunkIndex, 8);
  return iv;
}

const key = crypto.randomBytes(32);
const iv = crypto.randomBytes(12);

// Your custom metadata - can be any structure
const metadata = JSON.stringify({
  description: 'Q1 financial report',
  tags: ['finance', 'confidential'],
  author: 'jane@example.com',
  version: 2
});

// Encrypt the metadata using the same IV derivation as filenames
// (reserved chunk index 0xFFFFFFFF)
const metaIv = deriveChunkIv(iv, 0xFFFFFFFF);
const metaCipher = crypto.createCipheriv('aes-256-gcm', key, metaIv);
const encryptedMessage = Buffer.concat([
  metaCipher.update(metadata, 'utf8'),
  metaCipher.final(),
  metaCipher.getAuthTag()
]).toString('base64url');

// Optionally encrypt a human-readable title too
const titleIv = deriveChunkIv(iv, 0xFFFFFFFF);
const titleCipher = crypto.createCipheriv('aes-256-gcm', key, titleIv);
const encryptedTitle = Buffer.concat([
  titleCipher.update('Q1 Report', 'utf8'),
  titleCipher.final(),
  titleCipher.getAuthTag()
]).toString('base64url');

// Create drop with encrypted metadata
const drop = await fetch('https://anon.li/api/v1/drop', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer ak_...',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    iv: iv.toString('base64url'),
    encryptedMessage,
    encryptedTitle,
    fileCount: 1,
    expiry: 7
  })
}).then(r => r.json());

// After fetching the drop (see Download & Decrypt Workflow above)
const baseIv = Buffer.from(drop.iv, 'base64url');
const metaIv = deriveChunkIv(baseIv, 0xFFFFFFFF);
const encMsg = Buffer.from(drop.encryptedMessage, 'base64url');

const decipher = crypto.createDecipheriv('aes-256-gcm', keyBuffer, metaIv);
decipher.setAuthTag(encMsg.slice(-16));
const metadataJson = Buffer.concat([
  decipher.update(encMsg.slice(0, -16)),
  decipher.final()
]).toString('utf8');

const metadata = JSON.parse(metadataJson);
// { description: 'Q1 financial report', tags: ['finance', 'confidential'], ... }