HTTP

Upload and manage files using the Bunny Storage API over HTTP for best performance, stability, and security

HTTP is the recommended way to upload content to Bunny Storage. It provides the best performance, stability, and security through a simple RESTful protocol.

For complete API documentation, see the Edge Storage API Reference.

Authentication

All requests require authentication using the AccessKey header with your storage zone password.

AccessKey: your-storage-zone-password

Find your storage zone password in the Access tab of your storage zone.

Use your storage zone password (AccessKey), not your global bunny.net API key or Stream API key.

Storage endpoints

The API endpoint depends on your storage zone’s primary region:

Region	Endpoint
Frankfurt, DE	storage.bunnycdn.com
London, UK	uk.storage.bunnycdn.com
New York, US	ny.storage.bunnycdn.com
Los Angeles, US	la.storage.bunnycdn.com
Singapore, SG	sg.storage.bunnycdn.com
Stockholm, SE	se.storage.bunnycdn.com
São Paulo, BR	br.storage.bunnycdn.com
Johannesburg, SA	jh.storage.bunnycdn.com
Sydney, SYD	syd.storage.bunnycdn.com

Find your endpoint in the Access page of your storage zone.

Upload a file

Upload files using a PUT request with the file content in the request body.

Request format

Method: PUT

URL format: https://{region}.bunnycdn.com/{storageZoneName}/{path}/{fileName}

Path parameters:

• storageZoneName (required) - Your storage zone name
• path (optional) - Directory path where the file will be stored (omit for root)
• fileName (required) - Name for the uploaded file

Headers:

• AccessKey (required) - Your storage zone password
• Content-Type (optional) - MIME type of the file (e.g., image/jpeg, application/pdf)
• Checksum (optional) - SHA256 checksum in HEX format (uppercase)

Request body: Raw binary file content (no encoding)

Example

curl -X PUT \
  https://storage.bunnycdn.com/your-zone-name/path/to/file.jpg \
  -H "AccessKey: your-storage-password" \
  -H "Content-Type: image/jpeg" \
  --upload-file /path/to/local/file.jpg

With checksum

curl -X PUT \
  https://storage.bunnycdn.com/your-zone-name/path/to/file.jpg \
  -H "AccessKey: your-storage-password" \
  -H "Content-Type: image/jpeg" \
  -H "Checksum: D7A8FBB307D7809469CA9ABCB0082E4F8D5651E46D3CDB762D02D0BF37C9E592" \
  --upload-file /path/to/local/file.jpg

Response codes

Status Code	Description
201	File uploaded successfully
400	Upload unsuccessful (bad request)
401	Invalid AccessKey, region hostname, or non-binary file format

Important considerations

File content must be raw binary: Send the file as raw binary in the request body without any encoding. Other formats will result in a 401 error.

• Use the correct regional endpoint for your storage zone’s primary region
• Checksum hashes must be SHA256 in HEX format and UPPERCASE
• Use --upload-file with curl to send file contents as raw binary
• The Content-Type header helps with proper file serving but is optional

Download a file

Download files using a GET request:

curl -X GET \
  https://storage.bunnycdn.com/your-zone-name/path/to/file.jpg \
  -H "AccessKey: your-storage-password" \
  -o downloaded-file.jpg

List files

List files in a directory using a GET request to the directory path:

curl -X GET \
  https://storage.bunnycdn.com/your-zone-name/path/to/directory/ \
  -H "AccessKey: your-storage-password"

Returns a JSON array of files and directories.

Delete a file

Delete files or directories using a DELETE request. Deleting a directory recursively removes all of its contents.

curl -X DELETE \
  https://storage.bunnycdn.com/your-zone-name/path/to/file.jpg \
  -H "AccessKey: your-storage-password"

Deleting the root directory

By default, deleting the root directory (/) is blocked as a safety guard. To bypass this protection, include allowRootDelete=true as either a query string parameter or a request header.

Deleting the root directory permanently removes all files and directories in your storage zone. This action cannot be undone.

Via query string parameter:

• Key: allowRootDelete
• Value: true

curl -X DELETE \
  "https://storage.bunnycdn.com/your-zone-name/?allowRootDelete=true" \
  -H "AccessKey: your-storage-password"

Via request header:

• Name: allowRootDelete
• Value: true

curl -X DELETE \
  https://storage.bunnycdn.com/your-zone-name/ \
  -H "AccessKey: your-storage-password" \
  -H "allowRootDelete: true"