The file is CSV with one wallet per line: an EVM address, optionally followed by that wallet's mint limit and its mint price in the chain's native currency, in that order and separated by commas, like 0x0000000000000000000000000000000000000000, 2, 0.05. Columns are read by position, not by name. A first line that is not an address is treated as a header and skipped. A file that fails validation returns 400 naming the offending line numbers. This response starts a three-step upload flow. First, request this context from OpenSea. Second, call the returned method at the returned URL. For POST, add every fields entry unchanged as a multipart text field, then add a file part containing the bytes. The file part must be last. Let the HTTP library generate the multipart boundary; do not set the overall multipart Content-Type header yourself. POST storage uploads normally return 204. For PUT, upload the raw bytes, use only headers explicitly required by the endpoint, and expect 200. Treat any 2xx storage response as success. The URL and fields are short-lived sensitive credentials. Do not log, persist, alter, or put them in tickets. Third, after storage succeeds, pass the returned token to the documented OpenSea API endpoint. Do not use the token before the storage upload succeeds. Send the token as allowlist_file_token on the stage in POST /api/v2/drops/{slug}; saving the edits validates the file and rejects them if it is invalid. POST /api/v2/drops/{slug}/allowlist/validate runs the same check without saving and returns the same token. The allowlist is enforced once the drop is published with POST /api/v2/drops/{slug}/publish. The presigned upload expires about a minute after it is issued, so request the context and upload in one go rather than requesting it ahead of time.