SFTP that just works
One API call provisions a secure SFTP directory with credentials and webhook notifications. No AWS config. No Azure portal. Just SFTP.
How it works
Three steps from your first API call to files landing in your directory.
1. Create a directory
Call POST /api/v1/directories with a name and optional external ID. The directory is live immediately.
2. Share credentials
The API response includes the SFTP host, username, and password. Hand them to a client, use them in a script, or connect directly.
3. Get notified
When a file lands, Bridglet fires a signed webhook to your endpoint. No polling.
API endpoints
Authenticate with a Bearer token. All endpoints are HTTPS only.
Provision a new SFTP directory. Returns credentials immediately.
Credentials are returned inline. Use them in a script, pass them to a client, or connect directly.
Public key authentication
Each directory supports three SFTP auth modes. Switch modes at any time via the API; the change takes effect on the next login attempt.
Default mode. Bridglet generates a strong random password and returns it in the API response. Best for getting started quickly.
Authenticate with an SSH key pair — no password needed. Upload the public key via the API. The SHA256 fingerprint is returned for verification.
Accepts either a password or a public key. Useful during migrations where users need time to switch to key-based auth without losing access.
Upload a public key and switch the directory to key-only auth in a single call.
The fingerprint confirms which key is active. Store it to verify key rotation later.
Revoke the stored public key and revert the directory to password auth. The original password is restored, so access is not lost.
Auth mode reverts to password and the fingerprint is cleared immediately.
Webhooks
When a file arrives, Bridglet sends a signed POST to your webhook URL within seconds. No polling. No missed files.
HMAC signature verification
Every webhook includes an x-bridglet-signature header in the format sha256=<hex> — the HMAC-SHA256 of the raw request body keyed with the directory's webhook_secret. Verification code samples →
external_id passthrough
The external_id you set when creating the directory is included in every webhook, so uploads map cleanly back to your records.
Full API reference
This page is an overview. The complete reference documents every endpoint — listing and filtering directories, fetching a single directory, updating basic fields, deleting directories, and listing uploads — plus rate limits and error formats.
API key auth
Generate API keys from your Bridglet dashboard. Use bk_live_ keys in production and bk_test_ keys in staging.
Bearer token
Pass your API key as a Bearer token in the Authorization header on every request. Standard HTTP auth that works with any HTTP client.
HTTPS only
All API traffic is encrypted over TLS. HTTP requests are rejected. SFTP connections use SSH key exchange, so credentials are never sent in plaintext.
Integration flow
Your app provisions the SFTP directory. Files get uploaded. You get notified instantly.
Start building in minutes.
Create your API key, make a POST /api/v1/directories call, and start transferring files today.