diff --git a/CHANGELOG b/CHANGELOG
index eaf94ab..e94074e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -2,6 +2,7 @@ codebird-cors-proxy - changelog
 ===============================
 
 1.3.0 (not yet released)
++ #4 Allow uploading multiple media (use media_data)
 
 1.2.3 (2013-12-26)
 + #3 Whitelist rate-limiting headers in CORS
diff --git a/codebird-cors-proxy.php b/codebird-cors-proxy.php
index 824b71e..d299178 100644
--- a/codebird-cors-proxy.php
+++ b/codebird-cors-proxy.php
@@ -116,7 +116,8 @@ function http_get_request_body()
     $body = http_get_request_body();
 
     // check for media parameter
-    // TODO support multiple media[] params after Twitter allows them
+    // for uploading multiple medias, use media_data, see
+    // https://dev.twitter.com/docs/api/multiple-media-extended-entities
 
     if (isset($_POST['media']) && is_array($_POST['media'])) {
         $body = $_POST;
@@ -171,7 +172,13 @@ function http_get_request_body()
     header('HTTP/1.1 412 Precondition failed');
     die('This proxy only supports requests to API version 1.1.');
 }
-$url = 'https://api.twitter.com' . substr($url, $version_pos);
+// use media endpoint if necessary
+$is_media_upload = strpos($url, 'media/upload.json') !== false;
+if ($is_media_upload) {
+    $url = 'https://upload.twitter.com' . substr($url, $version_pos);
+} else {
+    $url = 'https://api.twitter.com' . substr($url, $version_pos);
+}
 
 // send request to Twitter API
 $ch = curl_init($url);