Upload helper¶

rightra-upload.php is a single PHP file that receives encrypted segments from the browser SDK and serves them from your own domain. It requires no cloud account or third-party service. Its only configuration is one secret.

Setup¶

Copy rightra-upload.php to a folder on your host, for example public_html/rightra/rightra-upload.php.
Set the secret to a long random value:
```
define('RIGHTRA_UPLOAD_SECRET', 'replace-with-a-long-random-string');
```
Generate a value with openssl rand -hex 32.
Set the same value as RIGHTRA_UPLOAD_SECRET in your backend.

Keep the secret on the server

The upload secret must never be sent to the browser or committed to a public repository.

Upload tokens¶

The browser authorizes each upload with a short-lived token sent in the X-Rightra-Token header. Your backend mints the token. The helper verifies it.

Format:

<expiry>.<hmac>

Part	Definition
`expiry`	Unix timestamp after which the token is rejected.
`hmac`	`HMAC-SHA256("<contentId>\|<expiry>", RIGHTRA_UPLOAD_SECRET)`

A token is bound to one content ID and one expiry, so it cannot be reused for other content. The default lifetime is 900 seconds, controlled by RIGHTRA_UPLOAD_TOKEN_TTL.

Backend	Mint	Verify
Laravel	`UploadToken::mint()`	Upload helper
Python	`rightra.mint_upload_token()`	Upload helper, or `rightra.verify_upload_token()`
Other	Compute the HMAC above	Upload helper

Upload request¶

POST /rightra/rightra-upload.php?content=<contentId>&file=seg-<index>.enc
X-Rightra-Token: <token>
Content-Type: multipart/form-data

Field	Description
`segment`	Encrypted segment bytes.
`index`	Segment index.
`iv`	Segment initialization vector.

The response is JSON containing the public url of the stored segment. Return this value from the SDK's uploadSegments callback. A complete example is in the Quickstart.

Errors¶

Status	Cause
`401`	The token is missing, malformed, or expired.
`403`	The token signature does not match. The secrets on the helper and backend differ.