API & CLI

1. Get an API key

An API key is how the CLI and scripts prove they’re acting for your account, so your plan’s limits and transfer history apply.

1. Go to Account → API keys (Ultimate plan) and click Create.
2. Copy it immediately. It’s shown once and stored only as a hash — we can never show it again. Lost it? Revoke it and create a new one.

A key starts with d2p_. It can transfer files and read your history — it can never change billing or account settings, and it can’t create or revoke other keys.

2. The command-line tool

drop2p is a real Drop2p peer for your terminal. It streams files directly to the other device, encrypted end to end — no size ceiling, nothing stored.

Install

The quickest way — a standalone binary, no Node toolchain required. Homebrew (macOS & Linux):

brew install webdeviant/drop2p/drop2p
drop2p --version

Prefer a direct download? Grab the archive for your platform from the latest release (macOS, Linux, Windows). Or, if you already have Node.js 20+, install from npm:

npm install -g @drop2p/cli
drop2p --version

Connect your account

Point the CLI at your key. For a one-off or a script, set an environment variable:

export DROP2P_API_KEY="d2p_your_key_here"

Or save it once so you don’t have to set it each time:

drop2p login --key d2p_your_key_here   # stored in ~/.config/drop2p/config.json
drop2p whoami                          # confirms your email + plan

You can also use the CLI without a key — it just falls back to free-tier limits.

Send a file

drop2p send ./big-video.mp4

It connects, prints a short share code (and a QR code), and waits. Keep the terminal open until it says it’s done.

Receive a file

On the other device, run with the code you were given:

drop2p receive 8QVY-Q9MZ4P            # saves into the current folder
drop2p receive 8QVY-Q9MZ4P --out ~/Downloads

Add a passphrase (extra encryption)

Layer a second, password-derived encryption on top of the code. The receiver needs the same passphrase to open the file.

drop2p send ./contract.pdf --password "correct horse battery staple"
drop2p receive <code> --password "correct horse battery staple"

Use it in scripts / CI

Pass --json for machine-readable output; exit code 0 means success, non-zero means failure. Everything can come from the environment, so no login step is needed:

DROP2P_API_KEY="d2p_…" drop2p send ./build.tar.gz --json

All commands

drop2p send <file> [--password X] [--out-code-only] [--json]
drop2p receive <code> [--out DIR] [--password X] [--json]
drop2p login [--key d2p_…] | [--email [email protected] --password ••••]
drop2p whoami | logout
drop2p keys (create <name> | list | revoke <id>)   # needs an email/password login
drop2p history [--limit N] [--json]
drop2p --version | --help

3. The HTTP API

For your own integrations, call the API directly. Base URL https://api.drop2p.com. The full surface is described by an OpenAPI 3.1 spec, and every /v1 response carries RateLimit-* headers. Authenticate every request with your key:

Authorization: Bearer d2p_your_key_here

Your account & plan

curl -H "Authorization: Bearer d2p_…" https://api.drop2p.com/v1/me

Transfer history

Recent transfers (metadata only — size, direction, status, time; never filenames):

curl -H "Authorization: Bearer d2p_…" https://api.drop2p.com/v1/history

What you can’t do over HTTP

Because Drop2p stores nothing, there’s no endpoint to upload a file or fetch one by URL. The actual transfer happens peer-to-peer and is driven by the CLI or the browser. Managing keys (create / revoke) is also intentionally not available to an API key — do that on the account page (so a leaked key can’t mint more keys).

4. Looking after your keys

• Keys are shown once and stored only as a hash — keep them somewhere safe.
• Revoke stops a key working immediately; Delete then removes it from your list.
• Rotate freely — create a new key and revoke the old one any time.
• A key’s scope is transfers + reading history only. Never billing, never admin.