CDNShark Documentation

API Authentication & Tokens

The CDNShark API lets you manage your account from your own code: domains, DNS, pull zones, storage, video, live streams and webhooks. Every request is authenticated with your API token.

Base URL

https://cdnshark.com/api

Get your API token

1. Sign in to the portal and open API Token in the sidebar (under Support).
2. Tick what the token may do, per service: Read (list and view) and Write (create, change, delete). Write always includes Read.
3. Click Create token and copy it. It is shown once: we store only a hash of it.

Your account has one API token.

• Save permissions changes what the token may do. The token itself stays the same, so your integrations keep working.
• Regenerate issues a new token. The old one stops working immediately. Use it if the token leaks.
• Revoke removes the token.

Tokens do not expire. The desktop apps (Backup, Sync) sign in with their own device tokens; those are separate and are never affected by your API token.

Send the token with every request

curl https://cdnshark.com/api/domains \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Accept: application/json"

Always send Accept: application/json. Without it, some errors come back as a redirect instead of JSON. For requests with a body, also send Content-Type: application/json.

Permissions

Permission	Allows
domains:read / domains:write	List domains / add, change, delete domains
dns:read / dns:write	List zones and records / add, change, delete records
pullzones:read / pullzones:write	List pull zones / create, change, delete, purge
storage:read / storage:write	List buckets and read credentials / create, delete buckets
streams:read / streams:write	Video libraries, playback tokens and live streams: view / create, change, delete
webhooks:read / webhooks:write	List webhooks and deliveries / create, change, delete webhooks

A request without the needed permission gets 403. See Rate Limits & Errors for every status code.

Managing the token through the API

Method	Path	What it does
GET	/api/tokens	Lists your tokens (name, permissions, last used). Never returns a token's secret.
POST	/api/tokens	Issues a new API token and revokes the current one, including the token making the call. Body: {"abilities": ["dns:read", ...]}. Returns 201 with token, shown once.
DELETE	/api/tokens/{id}	Revokes one token.
DELETE	/api/tokens/all	Revokes every token on the account, desktop apps included.

A token cannot grant permissions it does not have. For example, a read-only token cannot issue a write token (403). To widen permissions, use the portal. Desktop-app tokens cannot manage tokens at all.

Paid features

Domains, DNS, pull zones, storage and video libraries need an active paid service on the account. Otherwise these endpoints return 402. Creating storage buckets, video libraries and live streams also needs a plan that includes that product.

Next: API Reference lists every endpoint.