cloudinary unsigned upload not working

Not specified by the original author.

TL;DR

Cloudinary unsigned uploads fail for a short list of reasons: the upload preset does not exist, it is still set to Signed instead of Unsigned, the name in your code does not match the dashboard exactly, or the browser posts to the wrong host and CORS kills the request. Open Console, go to Settings then Upload, confirm the preset shows Unsigned as its signing mode, copy the name character for character, and restart your dev server after any env change. Unsigned presets are meant to be public, so lock them down with a fixed folder, allowed formats, and size caps.

cloudinary unsigned upload not working

Steps

1. Open the Cloudinary Console, go to Settings, then the Upload tab, and find your preset in the Upload presets list. Check its Signing Mode column. Expected: the preset exists and the column reads Unsigned, not Signed.

2. If the preset is Signed, change the signing mode to Unsigned and save. The classic error here is "Upload preset must be whitelisted for unsigned uploads". Expected: after saving, the list shows Unsigned for the preset.

3. Compare the preset name in your code with the dashboard name character for character, including case. Copy it from the dashboard rather than typing it. Expected: no more "Upload preset not found" errors; the names match exactly.

4. Restart your dev server after changing the preset name in env config. Client-side env vars are baked in at startup, so the old value persists until restart. Expected: the app picks up the new preset name and uploads retry cleanly.

5. Confirm the upload posts to api.cloudinary.com, not res.cloudinary.com. The delivery host cannot receive uploads and the browser reports it as a CORS error. Expected: CORS errors disappear and the request reaches the upload endpoint.

6. Check the preset's restrictions: fixed folder, allowed formats, and any size cap. An upload that violates the preset's own rules is rejected with a 400. Expected: test files inside the allowed formats and under the size cap upload fine.

const formData = new FormData();
formData.append("file", fileInput.files[0]);
formData.append("upload_preset", PRESET_NAME);

const res = await fetch("https://api.cloudinary.com/v1_1/CLOUD_NAME/image/upload", {
  method: "POST",
  body: formData,
});
const data = await res.json();
console.log(data.secure_url);

Replace PRESETNAME with your unsigned preset name and CLOUDNAME with your cloud name. No signature is sent; that is the whole point of unsigned.

Use this when

• A browser-side upload to Cloudinary fails with a preset or whitelist error
• You see "Upload preset not found" or "Upload preset must be whitelisted for unsigned uploads"
• Uploads worked in one environment and broke in another (stale env vars)
• You are wiring up unsigned uploads for the first time and want the checklist

Not for this skill when

• You are doing signed server-side uploads (those need an api secret and a signature; unsigned presets do not apply)
• The failure is in transformations or delivery URLs after a successful upload (that is a different problem)
• You need uploads restricted to logged-in users (use signed uploads instead; unsigned is public by design)
• The error is a Cloudinary account or billing issue rather than an upload-preset issue

Variant phrasings

Upload preset must be whitelisted for unsigned uploads

The preset exists but its signing mode is Signed. Flip it to Unsigned in Settings, Upload, Upload presets.

cloudinary Upload preset not found

The name in code does not match any preset on that cloud, or a signed request was sent against an unsigned preset. Copy the exact name from the dashboard.

cloudinary unsigned upload CORS error

You are posting to the wrong host. Uploads go to api.cloudinary.com; res.cloudinary.com is delivery only.

Why it happens

Unsigned upload means the browser talks to Cloudinary directly with no secret, so Cloudinary gates it on a preset that explicitly opts in: signing mode Unsigned plus the preset name in the request. The failure modes are all mismatches against that gate: a preset that is still Signed, a name that does not exist on the cloud, a request that signs against an unsigned preset, or a browser that never reaches the upload host. The dashboard preset list is the source of truth; everything else is a guess until it matches that list.

Edge cases

• Every Cloudinary account ships with an ml_default preset that is typically unsigned; it works as a quick test, but create your own preset with restrictions for production.
• Sending a signed request against an unsigned preset also fails: pick one mode per call, unsigned calls send no signature at all.
• Restrict unsigned presets hard: fixed folder, allowed_formats limited to what you need, and a size cap. An open unsigned preset lets anyone upload to your cloud.
• Rate limiting exists per account; a flood of client uploads can trip it even when every preset setting is correct.
• Clock skew does not matter for unsigned uploads (no timestamp signing), so if you see stale-request style errors you are accidentally in the signed flow.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_fGXGtp6eAxwQ12ps1B9AgA

Resolved from the public thread: https://vectle.com/posts/pst_fGXGtp6eAxwQ12ps1B9AgA

Thread query: cloudinary unsigned upload not working

TL;DR: Cloudinary unsigned uploads fail for a short list of reasons: the upload preset does not exist, it is still set to Signed instead of Unsigned, the name in your code does not match the dashboard exactly, or the browser posts to the wrong host and CORS kills the request. Open Console, go to Settings then Upload, confirm the preset shows Unsigned as its signing mode, copy the name character for character, and restart your dev server after any env change. Unsigned presets are meant to be public, so lock them down with a fixed folder, allowed formats, and size caps.

Not specified by the original author.

TL;DR

Treat an unsigned preset as a public upload endpoint: lock it down with allowed formats, a max file size, a fixed folder, and unique filenames. For anything sensitive, switch to signed server-side uploads with access_mode authenticated and short-lived signed delivery URLs instead.

Steps

1. Treat an unsigned preset as a public upload endpoint: lock it down with allowed formats, a max file size, a fixed folder, and unique filenames. For anything sensitive, switch to signed server-side uploads with access_mode authenticated and short-lived signed delivery URLs instead. Review existing presets for unrestricted unsigned ones before launch.

When to use

You are seeing this: Review existing presets for unrestricted unsigned ones before launch. Use this skill when you run into "Cloudinary unsigned presets are public upload endpoints; harden them".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Web (project setup guide, Cloudinary upload preset notes): an unsigned upload preset bakes the cloud name and preset name into the public JavaScript bundle, so anyone can upload arbitrary files into the Cloudinary account, and every uploaded file is served from a public CDN URL with no access control. The guide warns against pointing an unsigned preset at an account holding sensitive documents. Browser uploads need the preset to be unsigned, which makes hardening the preset itself the only guardrail.

Verified resolution: Treat an unsigned preset as a public upload endpoint: lock it down with allowed formats, a max file size, a fixed folder, and unique filenames. For anything sensitive, switch to signed server-side uploads with access_mode authenticated and short-lived signed delivery URLs instead. Review existing presets for unrestricted unsigned ones before launch.

Source URL: https://github.com/ayushr27/placement-portal/blob/HEAD/website/CREATEUPLOADPRESET.md

Not specified by the original author.

TL;DR

A cloudinary upload preset is a named bundle of upload settings (folder, allowed formats, transformations, size caps) stored in your Cloudinary account. To upload from a browser or mobile app with no backend, create an upload preset, set its signing mode to Unsigned, then POST multipart form data to the upload endpoint with two fields: uploadpreset (the preset name) and file (the file bytes). Expect an HTTP 200 with a JSON asset record containing secureurl. The preset name is public by design, so a locked-down preset is your enforcement boundary.

Use this when

• You need browser or mobile uploads to Cloudinary and have no server to sign requests
• You are setting up an unsigned upload preset for user-generated content
• An upload fails with an error about the preset, signing mode, or unsigned uploads being disabled

Not for this skill when

• The upload preset exists and is unsigned but uploads still fail: see the troubleshooting skill in Related skills
• The content is sensitive or per-user: use signed uploads with a server-generated signature instead, so your API secret never reaches the client
• You need to delete or manage assets after upload: that requires authenticated API requests, not unsigned ones

Steps

1. Create the upload preset. In the Cloudinary Console go to Settings, then Upload, then Upload presets, and click Add upload preset. Give it a name and set Signing mode to Unsigned.

Expected: the preset appears in the Upload presets list with signing mode Unsigned.

2. Lock the preset down before you ship it. Set a fixed folder, an allowed-formats list, and file size caps in the preset. Anyone who reads your client code can see the preset name, so everything you do not restrict in the preset is open to the public internet.

Expected: the preset has a folder, a format allowlist, and a maximum file size; nothing uploads outside those bounds.

3. Upload from the client. POST multipart form data to https://api.cloudinary.com/v11/[your cloud name]/image/upload with the fields uploadpreset and file. Swap image for video or raw in the URL for those resource types.

const formData = new FormData();
formData.append("upload_preset", "my_unsigned_preset");
formData.append("file", file);
const res = await fetch(
  "https://api.cloudinary.com/v1_1/[your cloud name]/image/upload",
  { method: "POST", body: formData }
);

Expected: an HTTP 200 response with a JSON asset record containing secureurl and publicid.

4. Verify and troubleshoot failures. If the upload errors, check in this order: the preset name is spelled exactly as in the Console, the preset signing mode really is Unsigned, and unsigned uploads are enabled for the account (Settings, Upload). A signed-mode preset or a typo produces a preset error on every request.

Expected: after the fix, the same request returns 200 with secure_url.

Variant phrasings

cloudinary unsigned upload preset

The same setup named by its signing mode: an unsigned upload preset is what makes backend-free uploads possible, because the preset carries the upload parameters so no signature round trip is needed.

create upload preset cloudinary

The Console task behind the query: Settings, Upload, Upload presets, Add upload preset (step 1). The two settings that matter most are signing mode Unsigned and the restriction fields in step 2.

cloudinary upload preset not working

Usually one of the three causes in step 4: misspelled preset name, preset still set to Signed, or unsigned uploads disabled at the account level.

Root cause

Cloudinary will not accept an unsigned client upload without a preset, because the preset is where the account declares which parameters an unauthenticated request may use. Only a restricted set of parameters can be sent from the client in an unsigned request; everything else must live in the preset. Unsigned requests also cannot overwrite existing assets (overwrite is treated as false). If a preset name is exposed and abused, rotate the preset name and update the client config, or disable the preset.

Edge cases

• Widget and SDK uploads (Upload Widget, React, Vue) take the same preset name and cloud name; the preset rules above apply unchanged.
• Eager transformations on unsigned uploads must be defined in the preset, not sent with the request.
• Multiple presets per app are fine and often better: one locked-down preset per surface (avatars, attachments) beats one permissive preset.

Tool compatibility

Cloudinary image, video, and raw uploads via the upload API endpoint; Console steps as of 2026. Works with fetch, the Upload Widget, and the JavaScript SDKs, all of which send upload_preset the same way.

Related skills

• cloudinary unsigned upload not working: https://vectle.com/skills/skl_aP1EKAxvRDm8HFGa207z7Q
• Cloudinary unsigned presets are public upload endpoints; harden them: https://vectle.com/skills/skl_Ut4v1pv8brkmprplEOY6JA

Provenance

Built from Cloudinary's client-side uploading documentation, linked in the evidence.

This query asks how to upload files to Cloudinary without a backend and without generating an authentication signature, straight from a browser or mobile app. The mechanism is an unsigned upload preset: a named bundle of upload settings (folder, formats, transformations) with signing mode set to Unsigned, which lets the client POST directly to Cloudinary's upload endpoint. The unsigned preset name is public by design, so the how-to only works safely with a deliberately restricted preset.

Verified resolution: The short version: create an unsigned upload preset in the Console, then POST multipart form data to the upload endpoint with upload_preset and file.

1. Create the preset. In the Cloudinary Console go to Settings, then Upload, then Upload presets, and click Add upload preset. Name it, and set Signing mode to Unsigned.
2. Lock the preset down before you ship it. Set a fixed folder, an allowed-formats list, and file size caps. The preset name will be visible to anyone who reads your client code, so the preset itself is your enforcement boundary.
3. Upload from the client. POST multipart form data to https://api.cloudinary.com/v1_1/[your cloud name]/image/upload with two fields: upload_preset (your preset name) and file (the file bytes). Use the video or raw resource type in place of image for those asset kinds.

const formData = new FormData();
formData.append("upload_preset", "my_unsigned_preset");
formData.append("file", file);

const res = await fetch(
  "https://api.cloudinary.com/v1_1/[your cloud name]/image/upload",
  { method: "POST", body: formData }
);

4. Verify it worked. Expect an HTTP 200 with a JSON asset record containing secure_url. If you get an error about the preset, the usual causes are a misspelled preset name, the preset still set to Signed, or the account's unsigned uploads being disabled.

Why unsigned works: the preset carries the upload parameters, so no signature round trip is needed. Constraints to know: only a restricted s

Source: https://cloudinary.com/documentation/clientsideuploading