SMALL API. BIG POSSIBILITIES.

A better handoff,
in one request.

Relay gives agents a destination and people a real download. All you need is HTTPS.

01. Create an upload link

In your workspace, choose New upload link. Set a name, expiry, and file-size limit. Copy the agent instructions or upload URL. Upload URLs are shown when created; regenerating one invalidates the old URL.

Open your workspace

02. Send the file

Use HTTP PUT with the file as the raw request body. Set X-File-Name to the URL-encoded filename. Do not send multipart data to this endpoint. A successful upload consumes the link.

curl --fail-with-body --request PUT \
  --upload-file ./final-report.pdf \
  --header "X-File-Name: final-report.pdf" \
  "$RELAY_UPLOAD_URL"

The upload URL is a capability token. Give it only to the intended uploader. An account or API key is not needed to use it.

Successful response · 201 Created

{
  "id": "transfer_id",
  "status": "ready",
  "filename": "final-report.pdf",
  "size_bytes": 124850,
  "sha256": "verified_file_digest",
  "download_url": "https://your-relay-domain/d/…"
}

The SHA-256 digest is calculated from the received bytes. A link accepts exactly one file; create another transfer for another file.

03. Download or share

Download your files from the workspace. To let someone else download, create a share link. Public download links expire after 72 hours, or when file retention ends. Creating a new share link invalidates the previous one. Revoking the transfer invalidates both upload and shared download access; it does not recall bytes someone already downloaded.

Downloads use Content-Disposition: attachment. Files are streamed from private storage and are never executed.

Take the dashboard out of the loop.

Create a workspace API key in API keys, then send it as a Bearer token. Keys can manage your entire workspace. Prefer scoped upload links when an agent only needs to deliver one file.

curl --fail-with-body "https://relay.allowia.com/api/transfers" \
  --header "Authorization: Bearer $RELAY_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"title":"Monthly research", "expires_hours":72,
    "max_bytes":524288000, "allowed_extensions":"pdf,zip"}'

GET /api/transfersList your transfers

POST /api/transfersCreate an upload link

GET /api/transfers/{id}Read transfer details

GET /api/transfers/{id}/downloadDownload as the owner

POST /api/transfers/{id}/shareCreate a fresh download link

POST /api/transfers/{id}/rotateRegenerate an unused upload URL

POST /api/transfers/{id}/revokeRevoke external access

DELETE /api/transfers/{id}Permanently delete the transfer

Errors you can act on

401 sign-in or API key required · 409 link used or upload in progress · 410 expired or revoked · 413 file or storage limit · 415 extension not allowed · 429 rate limit.

Clear boundaries. No surprises.

The preview configuration allows a 5 GB workspace, files up to 1 GB, and 50 active upload links. Choose an upload window of 1 hour, 1 day, 3 days, or 7 days. Files remain available to the owner for 30 days from transfer creation, unless deleted sooner.

Hosting providers may enforce lower request limits. Your deployment’s server, PHP, proxy, and storage limits must support the selected file size. Relay enforces both the transfer size and the workspace quota, including concurrent upload reservations.

Private by default. Specific by design.

Upload links use random 256-bit tokens and are stored as SHA-256 hashes. A link can upload only to its assigned transfer. It cannot list other files or manage an account. Session actions require a CSRF token. Passwords are hashed. API keys are shown once and stored as hashes.

Files are stored outside the public asset directory. The application sends them as downloads with restrictive headers. Link-bearing URLs should be excluded or redacted in production access logs. Use HTTPS, protect your database credentials, and schedule cleanup to delete files after retention.

Data stored

Relay stores account names, email addresses, password hashes, file metadata, file contents, and activity records. Rate limiting uses hashed IP/window buckets rather than storing raw IP addresses in the application tables. This self-hosted build does not send telemetry or use analytics trackers. No third-party identity, payment, or email provider is enabled by default.

Built for a browser-only cPanel setup.

Use the cPanel-ready ZIP, extract it in your domain’s document root, create a dedicated database and user in MySQL Database Wizard, then visit /install.php. The installer checks PHP extensions, writes the connection settings, and creates the database tables. Built CSS, JavaScript, and fonts are included. You do not need SSH, Composer, or Node.js on the hosting account.

After installation, remove install.php in File Manager. Set a daily cPanel Cron Job for private/bin/cleanup.php; the deployment guide includes a command you paste into the Cron Jobs screen, not a terminal. For large files, confirm your hosting provider permits long-running raw PUT requests.

Enough reading. Let’s deliver something.

Create your workspace

A better handoff,in one request.