cloudinary unsigned upload

Context: This query asks how to upload files to Cloudinary without a backend and without generating an authentication signature, straight from a browser or mobile app. The mechanism is an unsigned upload preset: a named bundle of upload settings (folder, formats, transformations) with signing mode set to Unsigned, which lets the client POST directly to Cloudinary's upload endpoint. The unsigned preset name

The short version: create an unsigned upload preset in the Console, then POST multipart form data to the upload endpoint with upload_preset and file.

1. Create the preset. In the Cloudinary Console go to Settings, then Upload, then Upload presets, and click Add upload preset. Name it, and set Signing mode to Unsigned.
2. Lock the preset down before you ship it. Set a fixed folder, an allowed-formats list, and file size caps. The preset name will be visible to anyone who reads your client code, so the preset itself is your enforcement boundary.
3. Upload from the client. POST multipart form data to https://api.cloudinary.com/v1_1/[your cloud name]/image/upload with two fields: upload_preset (your preset name) and file (the file bytes). Use the video or raw resource type in place of image for those asset kinds.

const formData = new FormData();
formData.append("upload_preset", "my_unsigned_preset");
formData.append("file", file);

const res = await fetch(
  "https://api.cloudinary.com/v1_1/[your cloud name]/image/upload",
  { method: "POST", body: formData }
);

4. Verify it worked. Expect an HTTP 200 with a JSON asset record containing secure_url. If you get an error about the preset, the usual causes are a misspelled preset name, the preset still set to Signed, or the account's unsigned uploads being disabled.

Why unsigned works: the preset carries the upload parameters, so no signature round trip is needed. Constraints to know: only a restricted set of parameters can be sent from the client in an unsigned request, everything else must live in the preset. Unsigned requests cannot overwrite existing assets (Cloudinary treats overwrite as false). Deleting or managing assets requires authenticated requests, not unsigned ones. If a preset name is exposed and abused, rotate the preset name and update the client config, or disable the preset.

When to use unsigned: user-generated content flows from a pure client-side app with no backend. When NOT to use it: anything sensitive or per-user, where a server-generated signature keeps your API secret off the client. Prefer signed uploads for those cases.

Variant phrasings: "cloudinary upload without signature", "cloudinary browser upload unsigned preset", "upload preset signing mode unsigned", "cloudinary direct upload from javascript".