Set up where your uploads go.

Where the settings are

Open Settings, then Uploads. Under Destinations, tap Configure Destinations to see every host, and pick the one you want. When you're done, tap Save. The S3 and FTP / SFTP screens also have a Test Connection button, which is worth a tap before your first upload.

Default Upload Destination on the same screen decides where uploads go when you don't pick one.

Imgur

Imgur needs a Client ID, which you get by registering a small app with Imgur. It's free.

1. Sign in to Imgur and open api.imgur.com/oauth2/addclient.
2. Give the app any name, choose anonymous usage without user authorization, and submit the form.
3. Copy the Client ID it shows you.
4. In XerahS, open the Imgur settings, keep Anonymous Upload on, paste the ID and save.

Anonymous Upload

Leave this on. Uploads aren't tied to an Imgur account.

Client ID

The ID from step 3. Required.

Client Secret

Only needed with Anonymous Upload off.

Amazon S3

Create a bucket, then create an access key for a user that can write to it. If you want the links to open in a browser, the objects have to be readable by the public, either through a bucket policy or through the ACL field below.

Access Key ID

From your IAM user or access key. Required.

Secret Access Key

Shown once when you create the key. Required.

Region

The bucket's region, for example eu-central-1. Defaults to us-east-1.

Bucket

The bucket name. Required.

S3 API Endpoint (optional)

Leave empty for Amazon S3. Fill it in for other S3 storage.

Custom URL (optional)

Use this when files are served from your own domain or a CDN, like https://i.example.com. The link becomes this address plus the file's path in the bucket.

Upload Path (optional)

A folder inside the bucket. You can use {yyyy}, {yy}, {MM}, {dd} and {month}, as in uploads/{yyyy}/{MM}.

ACL

Sent as the object's ACL when it isn't empty, for example public-read. Leave it empty if your bucket has ACLs turned off, which is the default for new buckets.

Path-style URLs

Uses endpoint/bucket/file instead of bucket.endpoint/file. Amazon doesn't need it. Most self-hosted storage does.

Cloudflare R2

In the Cloudflare dashboard, create an R2 bucket and an R2 API token with write access to it. Cloudflare shows an Access Key ID and a Secret Access Key for the token.

1. In the S3 settings, under Presets, tap Cloudflare R2.
2. Enter your Account ID and tap Apply. XerahS fills in the endpoint and turns on Path-style URLs.
3. Fill in the two keys and the Bucket. Cloudflare's docs use auto as the region.
4. Leave ACL empty.

R2 buckets aren't public by default. Turn on the public r2.dev address or connect your own domain to the bucket in Cloudflare, then put that address in Custom URL. Otherwise the links point at the API endpoint, and browsers can't open them.

MinIO and other S3 storage

MinIO, DigitalOcean Spaces and most other S3-compatible services work through the same S3 screen.

• S3 API Endpoint: the API address, like https://minio.example.com. For MinIO this is the API port, not the web console.
• Region: whatever your server is set to. MinIO uses us-east-1 unless you changed it.
• Path-style URLs: turn it on for MinIO.
• Custom URL: set it if files are served from a different address than the API.

Nextcloud

Use an app password, not your normal password. In Nextcloud, open Settings, Security, and create one under Devices & sessions. You can revoke it there later without touching your main login.

Server URL

Your Nextcloud address, like https://cloud.example.com.

Username

Your Nextcloud user ID. Usually the name you sign in with.

App password

The one you just created.

Folder

Where uploads go. Defaults to XerahS, and it's created if it doesn't exist.

Create a public share link

On by default. XerahS creates a share link for each file and copies that. If sharing fails, or you turn this off, you get the file's direct WebDAV address, which only works when you're signed in.

Immich

In Immich, open Account settings, API keys, and create a key. If your Immich version lets you choose permissions, the key needs to upload assets, and to create shared links if you want share links.

Server URL

Your Immich address, like https://photos.example.com. With or without /api at the end, both work.

API key

The key you created.

Create a share link

On by default, so you get a link anyone can open. Off, you get a link to the photo in your library, which needs you to be signed in.

GitHub Gist

Gist is for text and code. Create a personal access token on GitHub under Settings, Developer settings. A classic token only needs the gist scope.

Personal access token

The token. Needs the gist scope.

Public gist

Off by default, which makes a secret gist: not listed on your profile, but anyone with the link can see it.

Files have to be under 1 MB, and they're sent as text.

FTP and FTPS

Open the FTP / SFTP settings and stay on the FTP tab.

Host

The server name or IP address. Required.

Port

Usually 21.

Username and Password

Your FTP login.

Remote Path

The folder to upload into. Folders that don't exist are created. You can use {yyyy}, {yy}, {MM}, {dd} and {month}.

HTTP URL (for link generation)

The web address of that same folder, like https://files.example.com/uploads. The link you get is this address plus the file name.

Use FTPS

Encrypts the connection with explicit TLS, for both the login and the file.

Passive Mode

Leave it on unless your server needs active mode. Passive works better behind home routers and mobile networks.

SFTP and host keys

Open the FTP / SFTP settings and switch to the SFTP tab. The fields work like FTP, with a few differences.

Port

Usually 22.

Password

Used when no key is set.

SSH Key Path (optional)

Path to a private key file the app can read. When it's set, XerahS signs in with the key instead of the password.

Remote Path and HTTP URL

Same as FTP, including the note about date tokens.

If your key has a passphrase, set the server up as an upload profile instead. The profile editor has a Key Passphrase (optional) field.

How host keys work

The first time XerahS connects to a server, it saves the server's key fingerprint for that host and port. After that, every connection checks the server still has the same key. That's what stops someone in the middle from pretending to be your server.

If the key changes, the upload stops with a message that starts with "The server's identity changed" and shows both fingerprints. To check one, run this on the server and compare:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

If you changed the key yourself, or reinstalled the server, open the SFTP tab and tap Forget saved host key. The next connection saves the new one. If you didn't change anything, don't forget the key until you know why it changed.

Custom uploaders (.sxcu)

XerahS runs ShareX custom uploader files, so anything you've set up for ShareX on the desktop should work here too.

• Import uploader in Settings, Uploads takes a .sxcu file, or an encrypted .xsdc exported from XerahS on the desktop. Use Choose file or Paste .sxcu. Each uploader becomes an upload profile.
• Add from preset on the same screen has ready-made uploaders for XBackBone, Pastebin and Bitly. You fill in your server or key and it does the rest.
• Custom uploader holds a single uploader. Use Open .sxcu or Paste, then Test endpoint.
• Opening a .sxcu file from a file manager also offers to import it.

If an uploader sends files over plain http://, XerahS warns you before importing it.

An uploader marked URLShortener shows up as a choice under URL shortener in Settings, Uploads, next to the built-in is.gd.

Supported .sxcu syntax

These fields from the file are used. Key names aren't case sensitive.

RequestMethod

Any HTTP method, POST if missing. The older RequestType also works.

RequestURL

Required.

Parameters, Headers

Query string values and request headers.

Body

None, MultipartFormData, FormURLEncoded, JSON, XML or Binary.

Arguments, FileFormName, Data

Form fields, the name of the file field, and the raw body for JSON or XML.

DestinationType

ImageUploader, TextUploader, FileUploader and URLShortener. Without it, the uploader takes images and files.

URL, ThumbnailURL, DeletionURL

Read from the response. If URL is empty, the whole response is used as the link.

ErrorMessage

Shown when the server answers with an error.

Functions

{filename}

The name of the file being uploaded.

{input}

The text for text uploaders, or the long link for shorteners.

{random:a|b|c}

One of the options, picked at random.

{select:a|b|c}

Always uses the first option. There's no picker yet.

{inputbox:Title|Default}

Asks you for a value before the upload.

{base64:text}

Base64 of the text, handy for Basic auth headers.

{response}

The whole response body.

{responseurl}

The final URL of the response.

{header:Name}

A response header.

{json:path}

A value from a JSON response. Paths like data.link, files[0].url and $.url work.

{xml:xpath}

A value from an XML response.

{regex:pattern|group}

A regex match on the response. The group can be a number or a name, or left out for the whole match.

Functions can be nested, and a backslash escapes {, }, | and \. Files in the older ShareX format, with $json:...$ and a RegexList, are converted when you import them.