Developers — SMR Assets Vault

Quick Start

Three steps to wire any backend to this vault.

1 Create an account & copy your key

Register → Dashboard → copy the key shown once (smr_live_….smr_sec_…).

2 Store the key in your app config

Load it once into a global config (example: config('assets.api_key')). Do not call env() outside config files, and never put the key in frontend JS.

Base URL https://assets.smrtech.co

3 Call the API

# Create upload session (server)
curl -X POST "https://assets.smrtech.co/api/v1/sessions" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"original_name":"photo.jpg","size_bytes":12345}'

# Signed download URL (server)
curl -X POST "https://assets.smrtech.co/api/v1/files/{uuid}/sign-url" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"disposition":"inline"}'

Http::baseUrl('https://assets.smrtech.co')
    ->withToken(config('assets.api_key'))
    ->post('/api/v1/sessions', [
        'original_name' => 'photo.jpg',
        'size_bytes' => 12345,
    ]);

// Browser: upload with one-time token only
await fetch(session.upload_url, {
  method: 'POST',
  headers: { 'X-Upload-Token': session.upload_token },
  body: formDataWithFile,
});

Never put the API key in frontend JS. Only use one-time upload tokens in the browser. Set allowed origins on your project for CORS.

Authentication

Server requests use a Bearer API key from your dashboard.

$client = Http::baseUrl('https://assets.smrtech.co')
    ->withToken(config('assets.api_key'))
    ->acceptJson();

const headers = {
  Authorization: `Bearer ${config.assets.apiKey}`,
  'Content-Type': 'application/json',
};

headers = {
  "Authorization": f"Bearer {settings.ASSETS_API_KEY}",
  "Content-Type": "application/json",
}

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
Accept: application/json

Upload Assets

Create a session on the server, then upload bytes with X-Upload-Token.

$session = Http::baseUrl('https://assets.smrtech.co')
    ->withToken(config('assets.api_key'))
    ->post('/api/v1/sessions', [
        'original_name' => $file->getClientOriginalName(),
        'mime_type' => $file->getClientMimeType(),
        'size_bytes' => $file->getSize(),
    ])->throw()->json();

// $session['upload_url'], $session['upload_token'], $session['file_id']

const fd = new FormData();
fd.append('file', file, file.name);

await fetch(session.upload_url, {
  method: 'POST',
  headers: { 'X-Upload-Token': session.upload_token, Accept: 'application/json' },
  body: fd,
});

curl -X POST "https://assets.smrtech.co/api/v1/uploads/FILE_UUID" \
  -H "X-Upload-Token: UPLOAD_TOKEN" \
  -F "file=@./photo.jpg"

Download Assets

$signed = Http::baseUrl('https://assets.smrtech.co')
    ->withToken(config('assets.api_key'))
    ->post('/api/v1/files/'.$fileId.'/sign-url', [
        'disposition' => 'inline',
        'ttl' => 900,
    ])->throw()->json();

return redirect()->away($signed['url']);

curl -X POST "https://assets.smrtech.co/api/v1/files/{uuid}/sign-url" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"disposition":"inline","ttl":900}'

Examples

Method	Endpoint	Auth
`POST`	`https://assets.smrtech.co/api/v1/sessions`	Bearer
`POST`	`https://assets.smrtech.co/api/v1/uploads/{uuid}`	Upload token
`POST`	`https://assets.smrtech.co/api/v1/files/{uuid}/sign-url`	Bearer
`DELETE`	`https://assets.smrtech.co/api/v1/files/{uuid}`	Bearer

Security

Never put the API key in frontend JS. Only use one-time upload tokens in the browser. Set allowed origins on your project for CORS.

Rate Limits

API routes are throttled (default ~60–120 requests/minute per IP/key). For bulk ingestion, batch uploads and reuse sessions carefully.

Get API Key Open dashboard