API · Plus & Pro
Let your AI handle the uploading.
Create an API key and your scripts or AI assistant can upload, organize, download and share your files — no browser, no screenshots, just plain HTTPS requests.
API keys are available on the Plus and Pro plans. Everything a key does happens in your own account.
# first call, always curl -H "Authorization: Bearer $FRAMEPEEK_API_KEY" \ https://framepeek.com/api/key/whoami {"ok":true, "key":{"scopes":["read","write"],…}, "plan":"plus", "used":123456, "transferToday":0}
Quick start
Three steps, about two minutes. You only do the first two once.
-
Create a key
Open My account and find the API keys card. Name the key, tick only the permissions the job needs, and choose how long it lasts (30 days, 90 days or no expiry).
Copy the key right away — it is shown once.
-
Hand it to your AI
Store the key in an environment variable called
FRAMEPEEK_API_KEY. Don’t paste it into a chat or commit it to a repository.Then give your AI the guide link and the starter message below.
-
Tell it what to do
“Upload every JPG in
~/Tripinto a new folder called Trip 2026.” Or: “Download everything in the folder Clients as a ZIP.”For many files the AI should write one loop, not one request by hand per file.
Manage the files in my framepeek account through its API. First read https://framepeek.com/api-guide.txt completely and follow it exactly. My API key is in the environment variable FRAMEPEEK_API_KEY. Never print it or write it to files or logs. Start by calling whoami to check your permissions and free space. Delete only what I explicitly ask for. Task:
Prefer to run it yourself? Set up once per shell, then use fp in place of curl:
export FRAMEPEEK_API_KEY="fpk_…" # paste your key here
B=https://framepeek.com
fp() { curl -sS -H "Authorization: Bearer $FRAMEPEEK_API_KEY" "$@"; }
fp $B/api/key/whoami
Command line
Prefer one command over a loop of requests? fp.mjs is a single file with no dependencies (Node 18 or newer). It uses the same API and the same key, so your AI can upload a whole folder in one go.
curl -fsSL -o fp.mjs https://framepeek.com/fp.mjs
export FRAMEPEEK_API_KEY="fpk_…" # your key, from My account
node fp.mjs whoami
node fp.mjs upload ./Trip --folder "Trip 2026"
node fp.mjs download --folder "Trip 2026" -o trip.zip
If your AI cannot see the variable (some assistants keep secrets in a connector instead), fp stops with “FRAMEPEEK_API_KEY is not set” before contacting the server. In that case the assistant should make the same API calls through its connector, as described in the guide.
| Command | What it does |
|---|---|
whoami | Permissions, plan, free space, today’s transfer, key expiry. |
ls | Summary and latest files, with ids. |
mkdir | Create a folder. |
upload | Files or whole folders in one run. Reads real width and height, skips files already there, so re-running is safe. |
move | Move files into a folder or out of all folders. |
download | A folder or everything as a ZIP (split every 2,000 files). |
delete | Moves files to the Trash. Without --yes it only lists what would go. |
Safe by design: the key is read only from FRAMEPEEK_API_KEY and never printed, there is no permanent-delete command, and exit code 3 means “stop” (bad, expired or suspended key, no permission, plan or transfer limit) — it never retries those.
Permissions
Each key carries only the permissions you tick when you create it. Anything else is refused.
| Permission | What the key can do |
|---|---|
| read | List files, folders and Trash. Download single files, previews and ZIPs. Check the key with whoami. |
| write | Upload files. Create and rename folders. Move files between folders. Restore files from the Trash. |
| delete | Move files to the Trash and delete folders (their files stay). Trashed files can be restored for 30 days. A key cannot delete files permanently or empty the Trash — that is only possible in the web app. |
| share | Create, list, rename and turn off share links. Off by default. A share link is a public address: anyone who has the URL can open the files in it. |
Tip: start with read + write. Add delete or share only for a job that really needs it, and prefer a separate key for that job.
Endpoints
Base address https://framepeek.com. Send your key as Authorization: Bearer fpk_… on every request. Examples use the fp helper from the setup above.
Check your key read
| Endpoint | What it does |
|---|---|
GET/api/key/whoami | Your permissions, plan, space used and today’s transfer. Make this your first call. |
List and download read
| Endpoint | What it does |
|---|---|
GET/api/items | List your files: id, file, kind, name, size, dimensions, folder. |
GET/media/<file> | Download one original file (use the item’s file value). |
GET/thumb/<file> | A small preview image of an item. |
POST/api/download-zip | Body {"ids":[…]}. Returns a one-time token (works once, for 90 seconds). Up to 2,000 files. |
GET/api/download-zip/<token> | Streams the ZIP. |
fp $B/api/items
T=$(fp -X POST -H 'Content-Type: application/json' \
-d '{"ids":["<id1>","<id2>"]}' $B/api/download-zip \
| sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
curl -sS -o files.zip "$B/api/download-zip/$T"
Upload write
| Endpoint | What it does |
|---|---|
POST/api/upload?name=&w=&h= | The request body is the file’s bytes. Send the real width and height (w, h) so the grid shows the right shape. A Content-Length header is required — use --data-binary @file. |
fp -X POST --data-binary @photo.jpg \
"$B/api/upload?name=photo.jpg&w=1920&h=1080"
# {"ok":true,"item":{"id":"…","file":"…","name":"photo.jpg","w":1920,"h":1080,"size":12345,…}}
Upload one file at a time and collect the new ids. The AI guide has a ready-made fp_upload helper that reads image and video dimensions for you, plus a loop for whole folders.
Folders and moving files read · write · delete
| Endpoint | Needs | What it does |
|---|---|---|
GET/api/folders | read | List folders. |
POST/api/folders | write | Create a folder: {"name":"Trip 2026"}. |
POST/api/folders/<id> | write | Rename a folder: {"name":"New name"}. |
DELETE/api/folders/<id> | delete | Remove the folder only. Its files stay and become unfiled. |
POST/api/items/move | write | {"ids":[…],"folderId":"…"}. Use "folderId":null to unfile. |
Folders are one level deep (no folders inside folders), up to 200 per account.
fp -X POST -H 'Content-Type: application/json' -d '{"name":"Trip 2026"}' $B/api/folders
fp -X POST -H 'Content-Type: application/json' \
-d '{"ids":["<itemId1>","<itemId2>"],"folderId":"<folderId>"}' $B/api/items/move
Delete and Trash read · write · delete
| Endpoint | Needs | What it does |
|---|---|---|
POST/api/items/delete | delete | {"ids":[…]}. Moves files to the Trash, kept for 30 days. |
DELETE/api/items/<id> | delete | Same, for one file. |
GET/api/trash | read | List what is in the Trash. |
POST/api/trash/restore | write | {"ids":[…]}. Bring files back. |
Files in the Trash still count toward your storage until you delete them for good in the web app or the 30 days pass. API keys cannot delete permanently or empty the Trash.
Share links share
| Endpoint | What it does |
|---|---|
POST/api/share | {"ids":[…],"title":"…"}. Returns url — the public address is https://framepeek.com + that value. |
GET/api/share/mine | List your share links. |
PATCH/api/share/<token> | Rename a link: {"title":"…"}. |
DELETE/api/share/<token> | Turn the link off. It stops working at once; your files are not deleted. |
Share links are public. Anyone with the address can open the files in the link. Create one only when you mean to, and tell people what it shows.
Not available to API keys
Account settings, password, billing and plan changes, AI Restyle, saving someone else’s shared grid into your account, and managing API keys. Use the web app (Media Grid and My account) for those.
Errors
Errors come back as JSON with a status and a code. Match on the code.
| Status · code | Meaning | What to do |
|---|---|---|
401 KEY_INVALID | Key wrong, deleted or missing. | Create a new key. |
401 KEY_EXPIRED | The key passed its expiry date. | Create a new key. |
403 API_PLAN_REQUIRED | Account is below Plus, or the plan lapsed. | Upgrade; your files are untouched. |
403 KEY_SCOPE | The key lacks that permission. | Use a key with the permission. |
403 KEY_ROUTE_FORBIDDEN | That endpoint is not available to keys. | Use the web app. |
400 UNSUPPORTED_TYPE | File type not supported. | Skip the file. |
411 LENGTH_REQUIRED | Upload had no Content-Length. | Send with --data-binary @file. |
413 FILE_TOO_LARGE | Over 25 MB (image) or 200 MB (video). | Skip the file. |
413 QUOTA_EXCEEDED | Your storage is full. | Stop. Empty the Trash or upgrade. |
429 KEY_RATE · KEY_BUSY | Too many requests, or more than 3 uploads at once. | Wait Retry-After seconds, then retry. |
429 KEY_QUOTA | Daily transfer limit reached. | Stop; it frees up after Retry-After seconds. |
403 KEY_SUSPENDED | FramePeek suspended this key, or API access on the account. | Stop and don’t retry. Your files are untouched — contact us. |
Limits
These keep the service fast for everyone. They may change with the plans; whoami always shows your current numbers.
| What | Limit |
|---|---|
| Plans | Plus and Pro |
| Storage | Plus 2 GB · Pro 20 GB (same as your account) |
| Daily transfer | Plus 5 GB · Pro 20 GB, counted over the last 24 hours. Downloads and uploads both count, and so do large list responses. |
| Speed | About 120 requests per minute per key, and 3 uploads at once per key. |
| File size | Images up to 25 MB, videos up to 200 MB. |
| File types | Images: jpg, jpeg, jfif, png, gif, webp, avif, bmp, heic, heif, tif, tiff. Video: mp4, webm, mov, m4v. |
| ZIP downloads | Up to 2,000 files each. The download link works once, for 90 seconds. |
| Folders | One level deep, up to 200 per account. |
| Keys | Up to 5 active keys per account. Expiry: 30 days, 90 days (default) or none. |
| Trash | Deleted files are kept for 30 days. |
Safety
A key acts as your account. Treat it like a password.
- Keep it secret. Never put a key in a chat message, a screenshot, a URL, or a code repository. Use an environment variable or a secret manager.
- One key per job. Give each tool or script its own key with only the permissions it needs, and delete it when the job is done.
- Pick an expiry. A 30- or 90-day key limits the damage if it leaks.
- Confirm deletes. Have your AI show the list of files it is about to delete and wait for your yes. Deleting moves files to the Trash for 30 days, and a key cannot delete them permanently.
- Mind share links. A link is a public address. Check what is in it before you pass it on.
- If a key leaks, delete it in My account. It stops working at once. Resetting your password also deletes every key on the account.
Key requests are logged (time, kind of action, result, size) so abuse can be spotted. File names and the key itself are not logged. API use is covered by the API section of the Terms.
FAQ
Who can use the API?
Accounts on the Plus and Pro plans. Free accounts can’t create keys. If a paid plan ends, its keys stop working, and your files stay where they are under our usual policy.
Which AI assistants work with it?
Any assistant or script that can send HTTPS requests — for example by running curl. Give it the AI guide link and the starter message above. There is no SDK; plain requests work from any language.
What happens when I hit a limit?
The request fails with status 429 and a Retry-After number of seconds. A well-behaved script waits that long and tries again; for the daily transfer limit, it should stop and tell you instead.
My AI deleted something by mistake. Can I get it back?
Yes. Deleted files sit in the Trash for 30 days, and an API key cannot delete them permanently. Restore them from the web app, or with POST /api/trash/restore and a write key.
Can a key see other people’s files?
No. A key can only reach files in the account that created it.
Where do I delete or replace a key?
In My account under API keys. Deleting is immediate. To replace a key, create a new one first, update your tools, then delete the old one.
For your AI
The guide below is plain text written for AI assistants. It carries the exact commands and limits from this page, so your AI can read it and get to work.