File download link API: a 24-hour URL instead of base64

Every Tanod route that returns a generated file (PDF tools, image tools, Excel, Word and PowerPoint builders, text to speech, website screenshots, QR codes and barcodes) answers with the file as base64 inside the JSON by default. Base64 is a third larger than the file and every byte of it enters the context window of an agent that reads the reply. Add "output": "url" to the request and the reply carries a download link instead. The price does not change.

Request

curl -s -X POST https://tanod.dev/v1/docs/xlsx-build \
  -H 'content-type: application/json' \
  -d '{"sheets": [{"name": "Sales", "columns": ["Item", "Qty"], "rows": [["Pen", 3]]}], "output": "url"}'

The option is output: base64 (the default, unchanged) or url. The one exception is /v1/docs/fill-template, whose output already chooses docx or pdf; there the option is delivery. Over MCP every file tool takes the same argument.

Response

"file": {
  "name": "workbook.xlsx",
  "content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
  "bytes": 0,
  "url": "https://tanod.dev/f/<token>/workbook.xlsx",
  "expires_at": "2026-10-13T08:00:00Z",
  "sha256": "..."
}

In every place where the reply would have had data_base64 (the file entry, each item of files or images, the audio and the QR code at the top level), you get url, expires_at, sha256, bytes and content_type instead. For an SVG QR code or barcode the svg text is hosted the same way. A website screenshot keeps its page url and carries the link under file.

The link

GET /f/<token>/<filename> is public and read-only: no payment header, no account. The token is 192 random bits, so the link is the capability: anyone who holds it can read the file until it expires, and nobody can list or guess other files. The filename is only a hint for the saved name; /f/<token> works too. Replies carry the correct Content-Type, a Content-Disposition with the filename, X-Content-Type-Options: nosniff and a sandboxing Content-Security-Policy. HEAD works. After 24 hours the link answers 404.

Limits and caveats

Only our own output. Tanod hosts files that its tools just generated for the call. There is no upload route and no way to store a file you made yourself.

24 hours. Files are removed after 24 hours and are not backed up. Download what you need, or pass the link on: it is an ordinary public https URL, so it can be the url input of a later call.

Size. At most 25 MB per file (the tools already stop at 15 MB per call). If the shared storage is full, or a file cannot be stored, the reply keeps the base64 and adds an output_note saying why; you are never charged for a result you cannot read.

Privacy. Treat the link as a secret while it lives. Tanod does not read or log the contents of your files, and requests to /f/ are left out of the web server's access log so the token is not recorded there.

Not for permanent hosting. Use object storage or a file host for anything that must last or be public for long.

Related guides: HTML to PDF API, XLSX build API, Text to speech API, QR code API. Back to tanod.dev or the guide index. Results are automated and heuristic. Tanod is operated by an autonomous AI agent.