Save to PixelDrop Beta

Let the people who use your website or app save a file straight into their own PixelDrop. One script tag, one call.

• Add it
• Try it
• Choose a file
• What the person sees
• What your page gets
• Register and get the badge
• Receive files in your app

Add it

<script src="https://pixeldrop.ca/sdk.js"></script>

<button id="save">Save to PixelDrop</button>
<script>
  document.getElementById("save").onclick = function () {
    PixelDrop.save(myFileOrBlob, { name: "report.pdf" })
      .then(function (saved) { console.log("saved", saved.id, saved.folder); })
      .catch(function (err)  { console.log("not saved:", err.code); });
  };
</script>

Options: name (the file name) and folder (by default the file goes in a folder named after your site; give a short string to name the folder yourself, or false to save the file loose among the person's files).

Call PixelDrop.save() from a click: the browser only opens the PixelDrop window for a click. The file can be a File, a Blob, or a function returning one (or a promise of one).

Try it

Let them choose a file from their PixelDrop

PixelDrop.pick({ hours: 168 })
  .then(function (file) { console.log(file.name, file.url); })
  .catch(function (err) { console.log("not chosen:", err.code); });

A window shows the person their own files; they pick one (or several with multiple: true). Your app receives { id, name, size, url, expires_at }: a link to the file that works for hours hours (1 to 720, default 168). It never gets the file's content except through that link, and never anything else from the account. Errors: popup_blocked, cancelled, not_member, no_files, failed.

What the person sees

A small pixeldrop.ca window opens. They sign in if needed, and read: “your-site.com wants to save a file in your PixelDrop”, with the file name and size. They press Save. The file goes into their PixelDrop, in a folder named after your site (you can name the folder yourself, or save loose among their files). Nothing is shared with anyone.

The site name comes from the browser, not from your code, so no page can pretend to be another one. People can see and remove the sites they have used under Settings → Connected apps.

What your page gets

PixelDrop.save() returns a promise that resolves to { id, name, size, folder }. Your page never receives a key, a token, or any access to the account: only the result.

Error code	Meaning
popup_blocked	The browser blocked the window. Call save() directly from a click.
cancelled	The person closed the window or pressed Cancel.
not_member	Saving from other websites needs a PixelDrop Membre (the free trial counts).
too_large	Without the PixelDrop browser extension, files over 25 MB can't be saved. With it, any size.
failed	Anything else; err.message says what.

• It works on any https site (and on localhost while you build).
• With the PixelDrop browser extension the file goes straight from the browser to the person's Pixeldrain, with no size limit. Without it, files up to 25 MB go through PixelDrop's server.
• The person pays nothing extra and you pay nothing: PixelDrop stores nothing itself, the file lives in their own Pixeldrain account.
• On the confirmation window the person can tick “Always allow this site to save here”: saves from your site then start by themselves after a 3-second countdown, with a Cancel button, until they remove your site in Settings.

Register your app and get the “Verified” badge

An unregistered site shows up in the window as “This site is not registered with PixelDrop”. Register it and people see its name, and, once we have reviewed it, a green ✓ Verified app badge.

1. Sign in, then open Settings → For developers. Enter your app's name and your site's address (https://your-site.com).
2. PixelDrop gives you a line of text. Publish a plain text file at https://your-site.com/.well-known/pixeldrop-verify.txt containing exactly that line.
3. Press Check now. PixelDrop reads the file once, over https, without following redirects. When it matches, your site is proven and its name is shown.
4. We then review the app and approve it: the badge appears. You can remove your app at any time.

Let people send files to your app

Once your site is proven, you can add a receiving address on it (Settings → For developers). People who have already saved from your site then see your app under Send to… on every file. When they pick it, PixelDrop posts a small JSON message to your address:

{ "event": "file.shared", "id": "…", "time": "2026-10-16T20:00:00Z",
  "file": { "name": "report.pdf", "size": 1234, "sha256": "…", "url": "https://pixeldrop.ca/s/…" },
  "expires_at": "…", "max_downloads": 3 }

The link works for 24 hours and 3 downloads. The message says nothing about the person: no name, no email, no account. It is signed so you know it comes from PixelDrop. The header is X-PixelDrop-Signature: t=<unix seconds>,v1=<hex>, where v1 is the HMAC-SHA256 of <t>.<raw body> with your secret (shown in Settings). Check it, and refuse a t older than a few minutes. Reply with any 2xx status to accept; anything else tells the person the app did not accept the file.

const sig = req.headers["x-pixeldrop-signature"];            // t=...,v1=...
const [t, v1] = sig.split(",").map(x => x.split("=")[1]);
const ok = crypto.createHmac("sha256", SECRET).update(t + "." + rawBody).digest("hex") === v1
        && Math.abs(Date.now()/1000 - Number(t)) < 300;

The address must be on your own site (same host, https, no port). PixelDrop calls it from its server and never reaches private or internal addresses.

One person can hold a given site at a time. Questions? Write to [email protected].