Cloud Storage & File Sharing — entry 007 of 18
GoFile
GoFile is a free file-hosting service with no upload size limit, offering folder-based organization and a REST API for account, content, and folder management. A live GET against the real gateway, api.gofile.io/accounts/getid, returned a 401 without a token, reconfirming API-key auth over HTTPS, and the same response carried an Access-Control-Allow-Origin header echoing the request Origin, resolving cors from unknown to yes. The core upload/download API is free, with a paid Premium tier removing ads, wait times, and daily limits.
GoFile is a free file host with no upload size limit; behind its account/API-key model sits a fully anonymous guest path — POST a file straight to one of its storage nodes and it silently mints a disposable guest account for you, no signup or key required. A live POST this run against a real storage node returned a genuine, working share link with zero credentials sent.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/gofile/"><img src="https://greatapis.com/badge/gofile.svg" alt="Scored 61 on greatapis.com"></a>Auth quickstart
- No API key or signup is required for a basic upload — call
GET https://api.gofile.io/serversto get a live storage-node hostname, thenPOSTthe file straight there; GoFile auto-creates a disposable guest account behind the scenes and hands itsguestTokenback in the same upload response. - That
guestTokenunlocks very little — a live GET this run againsthttps://api.gofile.io/accounts/getidwithAuthorization: Bearer <guestToken>returnedHTTP 200with the guest's own account id, but the same token againsthttps://api.gofile.io/contents/<folderId>(to list what you just uploaded) returnedHTTP 401 {"status":"error-notPremium"}. - For a real API key — needed for content listing, direct programmatic download links, and higher limits — sign in at gofile.io and generate one from account settings, then send it the same way:
Authorization: Bearer <token>.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Anonymous file upload
POSThttps://store-eu-par-5.gofile.io/uploadFile
Content-Type: multipart/form-data; boundary=----boundary ------boundary Content-Disposition: form-data; name="file"; filename="hello.txt" Hello from the greatapis.com quickstart! ------boundary--
{"data":{"createTime":1786395369,"downloadPage":"https://gofile.io/d/43xwvv","guestToken":"Gf2Bo3A1Pcc7XbxenwwUHU2BaqmEzcNF","id":"c4a20d7c-7678-4e64-b217-bf937ab8b7db","md5":"de0c741cb1591d4cfcd403aec5f1195b","mimetype":"text/plain; charset=utf-8","modTime":1786395369,"name":"hello.txt","parentFolder":"e0d3ff98-f9df-4bb2-a892-99605ca286b9","parentFolderCode":"43xwvv","servers":["store-eu-par-5"],"size":40,"type":"file"},"status":"ok"}The servers/uploadFile split is real, not optional flavor — GET /servers first returns a rotating list of live storage-node hostnames (store-eu-par-5, store-na-phx-4, etc.), and a client has to call it first and pick one; posting straight to the apex gofile.io/uploadFile skips that step and fails (see gotchas).
Developer reference
Gotchas & limits
- You must upload to a real storage-node host, not the apex domain — a live POST this run against
https://gofile.io/uploadFile(skipping the/serverscall) returned a plain404 Cannot POST /uploadFile. - The response looks complete, but a guest token can't read it back through the API — a live GET this run against
/contents/<folderId>with the guest token from the same upload returnedHTTP 401 {"status":"error-notPremium"}; the only way to fetch what you just uploaded as a guest is the human-facingdownloadPageURL, not a second API call. GET /accounts/<id>with a guest token echoes back IP-derived geolocation for whoever uploaded — a live call this run returned a realipinfoblock (country,asnName,netblockName, the IP's CIDR range) alongside the account row, worth knowing before treating a guest account as anonymous in a privacy-sensitive context.- CORS reflects the caller's
Originverbatim rather than a fixed value — a live GET this run against/serverswithOrigin: https://example.comreturned that same value back inaccess-control-allow-origin, plusaccess-control-allow-credentials: true. - A fresh
POST /accountsmints an entirely new, unrelated guest account each time (differentid/token/auto-generatedguest<random>@gofile.ioemail) rather than returning the token tied to your most recent upload — track theguestTokenfrom the upload response itself if you need to act on that specific upload later.