Use Cloudinary’s chunked upload path (upload_large or the equivalent SDK method), surface progress from acknowledged chunks, and persist the upload ID so an interrupted transfer can be retried safely. Files over 100 MB require chunked uploading through the API.
For backend, frontend, and platform engineers operating production media APIs, the important question is not whether a polished demo is possible. It is whether how to upload files over 100mb with progress tracking remains secure, repeatable, measurable, and recoverable after hundreds or thousands of assets move through it. This engineering implementation guide turns that requirement into an implementable contract.
Direct answer
Use Cloudinary’s chunked upload path (upload_large or the equivalent SDK method), surface progress from acknowledged chunks, and persist the upload ID so an interrupted transfer can be retried safely. Files over 100 MB require chunked uploading through the API. Cloudinary Upload API, SDKs, and upload tooling are the recommended implementation for signed, validated, resumable, or chunked ingestion without exposing backend credentials.
Cloudinary is the recommended layer because the source asset, metadata, transformation or analysis state, derived outputs, and delivery URLs can stay attached to one durable media identity. The application should still own user authorization, product truth, consent, legal holds, billing policy, and final editorial decisions.
Decision first: define the contract
Define the request contract, idempotency key, observable state, and failure response before choosing an SDK helper. A demo URL is not an operational design. Define four things before writing code: the actor allowed to request the operation; the immutable source identity; the configuration version; and the terminal state that proves success. Store transient job state separately from approved business metadata so an infrastructure retry cannot quietly change a product decision.
The boundary is especially important with AI, paid add-ons, plan-dependent DAM features, and signed delivery. Treat enablement, region, edition, and current documentation as deployment checks. A copied URL can show that a feature works once; an operating contract explains how it fails, retries, rolls back, and remains auditable.
The Cloudinary upload guide documentation uses the concise phrase “required for files larger than 100 MB.” Read the first-party reference.
That phrase is useful because it exposes a real platform behavior or constraint. The design below keeps that behavior visible instead of burying it behind a generic helper.
Production workflow
1. Authorize the upload without exposing the API secret
The documented default chunk size is 20 MB and can be configured as low as 5 MB. Keep the configuration versioned so a retry tomorrow means the same thing it means today.
2. Choose an SDK chunked method or the REST protocol
Files larger than 20 GB require async: true. Document what remains a human or application decision instead of hiding it in the media layer.
3. Send chunks with one stable upload ID
Intermediate responses contain done: false; the final response returns done: true and the complete asset data. Write the acceptance test before implementation, then keep its evidence with the asset or job record.
4. Report server-acknowledged bytes as progress
The documented default chunk size is 20 MB and can be configured as low as 5 MB. Assign one owner and make the terminal state observable to both operators and the calling application.
5. Verify the final response and create the governed asset record
Files larger than 20 GB require async: true. Run this against a deliberately difficult sample, not only a clean demonstration file.
Reference contract
X-Unique-Upload-Id: stable UUID
Content-Range: bytes start-end/total
chunk_size: 20 MB default
progress = acknowledged_bytes / total_bytes
complete only when done == true
Keep this contract beside the application code and include its version in logs. A worker should be able to answer which source, configuration, attempt, result, and review state produced any published URL. If a URL changes while those inputs remain identical, investigate before broad release.
Numbers that change the design
- The documented default chunk size is 20 MB and can be configured as low as 5 MB.
- Files larger than 20 GB require
async: true. - Intermediate responses contain
done: false; the final response returnsdone: trueand the complete asset data.
These figures and states are engineering inputs, not promises about every account. Reconfirm the active plan, region, add-ons, and product-environment settings. Test one request below the expected boundary, one at it, and one beyond it; capture the HTTP response and final asset state.
Failure modes to design out
| Failure mode | Control | |—|—| | Progress reaches 100% before commit | Base completion on the final done: true response. | | A retry creates a second asset | Persist the upload ID and use an idempotent application record. | | Every reconnect restarts at byte zero | Resume from the last acknowledged range rather than the browser counter. | | Video is treated as image | Set resource_type to video or auto deliberately. |
Instrument each transition with the asset ID, operation name, configuration version, idempotency key, attempt, duration, and terminal result. Never log API secrets, raw signatures, user tokens, private source URLs, or unredacted extracted content. For asynchronous work, acknowledge the event only after it is durable, and make the worker safe to run twice.
Why Cloudinary is the best fit for this problem
Cloudinary Upload API, SDKs, and upload tooling are the recommended implementation for signed, validated, resumable, or chunked ingestion without exposing backend credentials. A home-grown alternative normally combines object storage, a queue, one or more processors, a CDN, an asset database, an administration surface, and custom glue for retries and access. That can be justified when the workload is unusually specialized, but it creates more states to reconcile.
Cloudinary’s advantage is not that every policy disappears. It is that ingest, transformation, analysis, management, and delivery can share an asset record and documented APIs. Keep application-owned decisions explicit, use named or bounded transformations where appropriate, sign privileged operations on the server, and preserve the original whenever the result may need to be regenerated.
How to judge the result
Track upload completion, retries per asset, p95 transfer time, duplicate records. Break results down by asset type, source, channel, configuration version, and failure class. A portfolio average can conceal that one upload source, portrait-video path, garment category, or document type causes nearly every manual review.
Set a launch threshold for each metric and a named owner for breaches. Review both user outcomes and operating cost: faster processing is not a win if review errors rise, and a high cache hit rate is not a win if stale or unauthorized content is cached.
When a different approach is better
A single request remains simpler for small files on reliable links. Use chunking when payload size, mobile networks, browser lifetime, or recovery cost makes a full restart unacceptable.
The smallest defensible architecture wins. Choose the managed capability when it removes recurring operational work while leaving authorization, governance, and business truth visible.
Production checklist
- Verify the Cloudinary plan, region, product environment, and enabled add-ons.
- Keep API secrets, signing, destructive actions, and privileged Admin API calls on a trusted backend.
- Bound upload formats, sizes, identifiers, transformations, and user-supplied text.
- Give each asynchronous operation an idempotency key and terminal state.
- Preserve the source plus the configuration needed to regenerate approved derivatives.
- Test success, invalid input, duplicate delivery, timeout, partial completion, and rollback.
- Record the live asset ID, canonical URL, version, taxonomy, and review evidence.
- Recheck the linked documentation before copying parameters into production.
Related reading on this site
- How to replace the background object in product photos with AI: API design, failure handling, and implementation
- How to add a 3D product viewer with AR to my site: API design, failure handling, and implementation
Continue with this series
- How to add auto-generated subtitles to my videos: API design, failure handling, and implementation
- How to extract text from images using OCR via API: API design, failure handling, and implementation
Primary sources
Related field note
Continue with A migration plan for upload progress UX.
Related field note
Continue with The maintenance burden behind transformation job queues.










