> ## Documentation Index
> Fetch the complete documentation index at: https://cloudinary.com/documentation/llms.txt
> Use this file to discover all available pages before exploring further.

# Why do I get a 'XXX parameter is not allowed' error on unsigned uploads?



When performing [unsigned uploads](upload_images#unauthenticated_requests), Cloudinary only allows a [limited set of parameters](image_upload_api_reference#unsigned_upload_parameters) to be passed directly in the upload call. Attempting to use unsupported parameters, results in an error.

## The error

When you try to pass an unsupported parameter, such as `transformation`, directly in an unsigned upload call, you receive an error response similar to:

```json
{
  "error": {
    "message": "Transformation parameter is not allowed when using unsigned upload. Only upload_preset,callback,public_id,folder,asset_folder,tags,context,metadata,face_coordinates,custom_coordinates,source,filename_override,manifest_transformation,manifest_json,template,template_vars,regions,public_id_prefix upload parameters are allowed."
  }
}
```

Or in the `X-Cld-Error` response header:

```
Transformation parameter is not allowed when using unsigned upload. Only upload_preset,callback,public_id,folder,asset_folder,tags,context,metadata,face_coordinates,custom_coordinates,source,filename_override,manifest_transformation,manifest_json,template,template_vars,regions,public_id_prefix upload parameters are allowed.
```

### Why this happens

For security reasons, unsigned uploads have protective limitations. Since unsigned uploads don't require authentication, Cloudinary restricts which parameters you can pass directly to prevent potential misuse. Specifically, you can pass only parameters from this [allowed list](image_upload_api_reference#unsigned_upload_parameters) directly in an unsigned upload call.

## The solution

Move restricted parameters into your [upload preset](upload_presets) configuration instead of passing them directly in the upload call.

### Step 1: Create or update your upload preset

[Create an upload preset or update the existing one](upload_presets#creating_and_managing_upload_presets) to include the restricted parameters you need.

### Step 2: Remove restricted parameters from your upload call

Remove any restricted parameters from your upload call. The parameters you defined in the preset are applied automatically:

```multi
|nodejs
// Transformation is applied automatically from the preset
cloudinary.v2.uploader.unsigned_upload("sample.jpg", "my_preset_with_transformation");

|python
# Transformation is applied automatically from the preset
cloudinary.uploader.unsigned_upload("sample.jpg", "my_preset_with_transformation")
```

> **NOTE**: If your upload call already references a preset, you don't need to create a new one. Just add the transformation to that existing preset and remove it from the upload call.

## Example: Creating a preset with transformations

The following example creates an unsigned upload preset that applies an incoming transformation to resize and crop images:

```multi
|nodejs
cloudinary.v2.api.create_upload_preset({
  name: "thumbnail_preset",
  unsigned: true,
  transformation: [
    { width: 200, height: 200, crop: "thumb", gravity: "face" }
  ]
}).then(result => console.log(result));

|python
cloudinary.api.create_upload_preset(
  name="thumbnail_preset",
  unsigned=True,
  transformation=[
    {"width": 200, "height": 200, "crop": "thumb", "gravity": "face"}
  ]
)

|ruby
Cloudinary::Api.create_upload_preset(
  name: "thumbnail_preset",
  unsigned: true,
  transformation: [
    { width: 200, height: 200, crop: "thumb", gravity: "face" }
  ]
)

|curl
curl -X POST \
  https://<API_KEY>:<API_SECRET>@api.cloudinary.com/v1_1/<cloud_name>/upload_presets \
  -d "name=thumbnail_preset&unsigned=true&transformation=w_200,h_200,c_thumb,g_face"
```

Now you can use this preset for unsigned uploads, and the transformation is applied automatically:

```multi
|nodejs
cloudinary.v2.uploader.unsigned_upload("sample.jpg", "thumbnail_preset")
  .then(result => console.log(result));

|python
cloudinary.uploader.unsigned_upload("sample.jpg", "thumbnail_preset")
```

> **READING**:
>
> * [Unsigned uploads](upload_images#unauthenticated_requests)

> * [Unsigned upload parameters](image_upload_api_reference#unsigned_upload_parameters)

> * [Upload presets](upload_presets)

> * [Troubleshooting failed upload requests](ts_troubleshooting_failed_upload_requests)