> ## Documentation Index > Fetch the complete documentation index at: https://spreecommerce.org/docs/llms.txt > Use this file to discover all available pages before exploring further. # Upload a file > Accepts a file and returns a `signed_id` to send wherever the file belongs — as a requirement submission's `file_signed_id`, or as `logo_signed_id`, `square_logo_signed_id` or `cover_photo_signed_id` on the profile. The file is attached to nothing at this point; the endpoint that takes the `signed_id` is the one that checks ownership. Send the file's metadata as JSON, then `PUT` the bytes to `upload.url` with exactly `upload.headers`; or send small files (10 MB by default) as a multipart `file` part, in which case `upload` is null. `signed_id` is opaque and expires at `expires_at`, one day after the upload. `visibility` is `public` (the default, web images, videos and CSV only) or `private` (any type). `checksum` is the file's MD5 digest, base64-encoded. ## OpenAPI ````yaml /api-reference/seller.yaml post /api/v3/seller/files openapi: 3.0.3 info: title: Seller API contact: name: Spree Commerce url: https://spreecommerce.org email: hello@spreecommerce.org description: | Spree Seller API v3 - the marketplace seller panel, where a seller runs their own shop inside someone else's marketplace. This is a branch of its own, not a narrowing of the Admin API. Every endpoint is scoped server-side to the seller the request acts as, which is what makes cross-seller access impossible by construction rather than by rule. Sellers never call the Admin API. ## Authentication Sign in at `POST /api/v3/seller/auth/login` and send the returned JWT as `Authorization: Bearer `. The token carries a `seller_api` audience — a token minted for the storefront or the back office is not accepted here, and vice versa. There is deliberately **no secret API key** for this branch: a credential that could act as a seller without a seller signing in is exactly what the separate audience exists to prevent. ### Choosing a seller A user may run more than one seller. Login returns the list; send the chosen seller's ID in the `X-Spree-Seller-Id` header on every authenticated request. The store is derived from the seller — never sent — so no header can widen what a seller reaches. A request that names no seller the caller belongs to is rejected with `403`. ## Response Format All responses are JSON. List endpoints return paginated responses with `data` and `meta` keys. ## Error Handling Errors return a consistent format: ```json { "error": { "code": "validation_error", "message": "Validation failed", "details": { "name": ["can't be blank"] } } } ``` version: v3 servers: - url: http://{defaultHost} variables: defaultHost: default: localhost:3000 security: [] tags: - name: Authentication description: Seller sign-in, token refresh, logout, and invitation acceptance - name: Account description: The signed-in user, the sellers they may act for, and what they may do - name: Countries description: Country and state reference data for the panel's address forms - name: Delivery Methods description: >- The seller's own ways to ship, and the marketplace methods shared with them - name: Delivery Profiles description: >- The marketplace's delivery vocabulary — what kind of goods a product is, which decides how it ships - name: Delivery Zones description: >- The marketplace's destinations, for narrowing where a seller's own method ships - name: Onboarding description: >- The marketplace checklist a seller completes before admission, and what they submit against it - name: Policies description: The seller's own legal documents, as the marketplace asks them to publish - name: Product Types description: The types a seller may list a product against, and what each adds - name: Products description: The seller's own catalog - name: Profile description: >- The seller's own record — presentation, contact details, addresses, and tax registration - name: Stock Locations description: Where the seller keeps stock, and so where their returns are sent - name: Team description: Who runs this seller, and the invitations nobody has accepted yet - name: Files description: Uploading the files a profile, a submission or an import uses paths: /api/v3/seller/files: post: tags: - Files summary: Upload a file description: | Accepts a file and returns a `signed_id` to send wherever the file belongs — as a requirement submission's `file_signed_id`, or as `logo_signed_id`, `square_logo_signed_id` or `cover_photo_signed_id` on the profile. The file is attached to nothing at this point; the endpoint that takes the `signed_id` is the one that checks ownership. Send the file's metadata as JSON, then `PUT` the bytes to `upload.url` with exactly `upload.headers`; or send small files (10 MB by default) as a multipart `file` part, in which case `upload` is null. `signed_id` is opaque and expires at `expires_at`, one day after the upload. `visibility` is `public` (the default, web images, videos and CSV only) or `private` (any type). `checksum` is the file's MD5 digest, base64-encoded. parameters: - name: X-Spree-Seller-Id in: header required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/FileUploadCreateParams' multipart/form-data: schema: $ref: '#/components/schemas/FileUploadCreateParams' required: true responses: '201': description: upload target created content: application/json: example: signed_id: >- eyJfcmFpbHMiOnsiZGF0YSI6MSwiZXhwIjoiMjAyNi0wMS0xNlQxMjowMDowMC4wMDBaIiwicHVyIjoiYmxvYl9pZCJ9fQ==--a9cd29e72a70654182038480207bd929343f6a07 filename: registration.pdf content_type: application/pdf byte_size: 51234 visibility: private expires_at: '2026-01-16T12:00:00.000Z' upload: method: PUT url: >- http://www.example.com/rails/active_storage/disk/eyJfcmFpbHMiOnsiZGF0YSI6eyJrZXkiOiI4NDFrenlvbTQ5cnRhcDk0cmZxbGV6dnM1cGJsIiwiY29udGVudF90eXBlIjoiYXBwbGljYXRpb24vcGRmIiwiY29udGVudF9sZW5ndGgiOjUxMjM0LCJjaGVja3N1bSI6IlZqaHowNGxRdUVHdXY0bkR2aHNhTlE9PSIsInNlcnZpY2VfbmFtZSI6InRlc3QifSwiZXhwIjoiMjAyNi0wMS0xNVQxMjowNTowMC4wMDBaIiwicHVyIjoiYmxvYl90b2tlbiJ9fQ==--abe303073ba7e7a0de1e5dc55e6c2a9a162c265e headers: Content-Type: application/pdf schema: $ref: '#/components/schemas/FileUpload' security: - bearer_auth: [] x-codeSamples: - lang: javascript label: Spree Seller SDK source: |- import { createSellerClient } from '@spree/seller-sdk' const client = createSellerClient({ baseUrl: 'https://your-store.com', jwtToken: 'eyJhbGciOi...', sellerId: 'sel_UkLWZg9DAJ', }) const file = await client.files.create({ filename: 'registration.pdf', content_type: 'application/pdf', byte_size: 51234, visibility: 'private', }) components: schemas: FileUploadCreateParams: type: object properties: filename: type: string example: registration.pdf content_type: type: string example: application/pdf byte_size: type: integer example: 51234 checksum: type: string description: >- Base64-encoded MD5 digest of the file; the storage service checks the bytes against it. example: rL0Y20zC+Fzt72VPzMSk2A== visibility: type: string enum: - public - private description: >- `public` (the default) for images, videos and CSV files anyone may fetch, `private` for any type. file: type: string format: binary description: The bytes, for a multipart upload. required: - filename - content_type FileUpload: type: object properties: signed_id: type: string filename: type: string content_type: type: string byte_size: type: number visibility: type: string enum: - public - private expires_at: type: string upload: allOf: - $ref: '#/components/schemas/FileUploadTarget' nullable: true required: - signed_id - filename - content_type - byte_size - visibility - expires_at - upload x-typelizer: true FileUploadTarget: type: object properties: method: type: string url: type: string headers: type: object required: - method - url - headers x-typelizer: true securitySchemes: bearer_auth: type: http scheme: bearer bearerFormat: JWT description: JWT token for an authenticated seller session (`seller_api` audience) ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.