---
title: "ZERO-INSTALL delivery: ensure session + register file + return a public relay download URL"
method: POST
path: "/quick-share"
tags: ["agent", "transfer"]
---

# ZERO-INSTALL delivery: ensure session + register file + return a public relay download URL

`POST /quick-share`

## Request

- Base URL: `http://127.0.0.1:3822`
- URL: `http://127.0.0.1:3822/quick-share`
- Auth: none required

Primary entry point for AI agents. If no session is active, creates one, then registers the file for public HTTP download. Returns a `downloadUrl` like `https://srift.app/d/<token>` the recipient can fetch with any HTTP client (browser, `srift get`, wget, curl) — SRIFT install on the recipient side is NOT required. This is a relay link: when it is opened, this daemon streams the bytes on demand through the srift.app relay (pass-through, `Cache-Control: no-store`). Nothing is stored on any server, so the link works only while this daemon (or the process hosting it) runs. `encrypt: true` (or a `password`) makes it end-to-end encrypted with AES-256-GCM; the key is returned in the URL's `#k=` fragment, which is never sent to a server. Without it the link is protected by TLS in transit only. Optional `maxDownloads` and `ttlMs` enforce sharing limits; failed/cancelled downloads do not count against the cap. Tokens survive transient signaler reconnects. Note: requires the local SRIFT daemon (http://127.0.0.1:3822) — filesystem access to `filePath` is not available on the public https://srift.app host. Several files: pass filePaths for one .tar.gz bundle link (default) or bundle:false for one link per path, created in parallel; the response then has links[] and errors[].

## Request body

- object
  - `filePath` string: Absolute path to a file or folder (folders are sent as .tar.gz). Use this OR filePaths.
  - `sessionName` string: Optional label
  - `maxDownloads` integer: Cap after N completed downloads. 0 = unlimited.
  - `ttlMs` integer: Auto-expire the link after N milliseconds. 0 = never.
  - `encrypt` boolean: End-to-end encrypt (AES-256-GCM). The key is carried in the returned URL's #k= fragment and never sent to a server. Default false (TLS in transit only).
  - `password` string: Optional password the recipient must supply (PBKDF2-SHA256, 100,000 iterations). Implies encrypt.
  - `filePaths` string[]: Several absolute file/folder paths in one call. Use this OR filePath.
  - `bundle` boolean: With filePaths: true = one .tar.gz link containing everything; false = one link per path, created in parallel.
  - `bundleName` string: With filePaths + bundle: archive name (.tar.gz is added).
  - `exclude` string[]: Extra glob patterns skipped when packing folders (.git and node_modules always skipped).
  - `name` string: Recipient-visible file name
  - `mode` 'relay' | 'auto': Accepted for older clients. Links are always relay links served by this daemon (nothing is stored on a server).

## Response `200`

OK

- QuickShareResult
  - `success` boolean
  - `mode` 'relay'
  - `sessionId` string
  - `fileId` string
  - `token` string
  - `downloadUrl` string: Give this to the recipient. Encrypted links include the key after #k=
  - `shareUrl` string: Same as downloadUrl (kept for older clients)
  - `fileName` string
  - `fileSize` number
  - `maxDownloads` number
  - `expiresAt` number, nullable
  - `encrypted` boolean
  - `passwordProtected` boolean

---

[API](https://skmtc.dev/srift/apis/srift-api.md) · [All operations](https://skmtc.dev/srift/apis/srift-api/llms.txt) · [OpenAPI document](https://skmtc.dev/srift/apis/srift-api/revisions/efe3ae285f45?raw)