cloudinary unsigned upload not working

TL;DR

Cloudinary unsigned uploads fail for a short list of reasons: the upload preset does not exist, it is still set to Signed instead of Unsigned, the name in your code does not match the dashboard exactly, or the browser posts to the wrong host and CORS kills the request. Open Console, go to Settings then Upload, confirm the preset shows Unsigned as its signing mode, copy the name character for character, and restart your dev server after any env change. Unsigned presets are meant to be public, so lock them down with a fixed folder, allowed formats, and size caps.

cloudinary unsigned upload not working

Steps

1. Open the Cloudinary Console, go to Settings, then the Upload tab, and find your preset in the Upload presets list. Check its Signing Mode column. Expected: the preset exists and the column reads Unsigned, not Signed.

2. If the preset is Signed, change the signing mode to Unsigned and save. The classic error here is "Upload preset must be whitelisted for unsigned uploads". Expected: after saving, the list shows Unsigned for the preset.

3. Compare the preset name in your code with the dashboard name character for character, including case. Copy it from the dashboard rather than typing it. Expected: no more "Upload preset not found" errors; the names match exactly.

4. Restart your dev server after changing the preset name in env config. Client-side env vars are baked in at startup, so the old value persists until restart. Expected: the app picks up the new preset name and uploads retry cleanly.

5. Confirm the upload posts to api.cloudinary.com, not res.cloudinary.com. The delivery host cannot receive uploads and the browser reports it as a CORS error. Expected: CORS errors disappear and the request reaches the upload endpoint.

6. Check the preset's restrictions: fixed folder, allowed formats, and any size cap. An upload that violates the preset's own rules is rejected with a 400. Expected: test files inside the allowed formats and under the size cap upload fine.

const formData = new FormData();
formData.append("file", fileInput.files[0]);
formData.append("upload_preset", PRESET_NAME);

const res = await fetch("https://api.cloudinary.com/v1_1/CLOUD_NAME/image/upload", {
  method: "POST",
  body: formData,
});
const data = await res.json();
console.log(data.secure_url);

Replace PRESETNAME with your unsigned preset name and CLOUDNAME with your cloud name. No signature is sent; that is the whole point of unsigned.

Use this when

• A browser-side upload to Cloudinary fails with a preset or whitelist error
• You see "Upload preset not found" or "Upload preset must be whitelisted for unsigned uploads"
• Uploads worked in one environment and broke in another (stale env vars)
• You are wiring up unsigned uploads for the first time and want the checklist

Not for this skill when

• You are doing signed server-side uploads (those need an api secret and a signature; unsigned presets do not apply)
• The failure is in transformations or delivery URLs after a successful upload (that is a different problem)
• You need uploads restricted to logged-in users (use signed uploads instead; unsigned is public by design)
• The error is a Cloudinary account or billing issue rather than an upload-preset issue

Variant phrasings

Upload preset must be whitelisted for unsigned uploads

The preset exists but its signing mode is Signed. Flip it to Unsigned in Settings, Upload, Upload presets.

cloudinary Upload preset not found

The name in code does not match any preset on that cloud, or a signed request was sent against an unsigned preset. Copy the exact name from the dashboard.

cloudinary unsigned upload CORS error

You are posting to the wrong host. Uploads go to api.cloudinary.com; res.cloudinary.com is delivery only.

Why it happens

Unsigned upload means the browser talks to Cloudinary directly with no secret, so Cloudinary gates it on a preset that explicitly opts in: signing mode Unsigned plus the preset name in the request. The failure modes are all mismatches against that gate: a preset that is still Signed, a name that does not exist on the cloud, a request that signs against an unsigned preset, or a browser that never reaches the upload host. The dashboard preset list is the source of truth; everything else is a guess until it matches that list.

Edge cases

• Every Cloudinary account ships with an ml_default preset that is typically unsigned; it works as a quick test, but create your own preset with restrictions for production.
• Sending a signed request against an unsigned preset also fails: pick one mode per call, unsigned calls send no signature at all.
• Restrict unsigned presets hard: fixed folder, allowed_formats limited to what you need, and a size cap. An open unsigned preset lets anyone upload to your cloud.
• Rate limiting exists per account; a flood of client uploads can trip it even when every preset setting is correct.
• Clock skew does not matter for unsigned uploads (no timestamp signing), so if you see stale-request style errors you are accidentally in the signed flow.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_fGXGtp6eAxwQ12ps1B9AgA