About storage

Storage keeps files for your apps. It is built for files your code creates and reads: documents your customers upload, reports you generate, images you show in your app.

Buckets and files

• A bucket holds files. It belongs to one project, and its name is unique in that project. A project can hold up to 10 buckets.
• A file has a key, such as invoices/2026/0001.pdf. The key is its name and its place in the bucket. Slashes in a key show as folders when you list the bucket.
• Files are private. Only requests with an API key or a console session that may read the project’s files can reach them.

Links, not file bodies

The API never carries the file itself. Instead:

1. To upload, you ask for an upload link, send the file to that link, then tell us the upload is finished.
2. To download, you ask for a download link, then fetch the file from it.

Links work for 15 minutes. Anyone who has a link can use it until then, so treat links like passwords and do not store them.

What happens to a file

• Replacing a file with the same key swaps it in one step when the new upload finishes. People downloading it get the old file or the new one, never part of each.
• Deleting a file removes it at once. It cannot be undone.
• An unfinished upload is cancelled after an hour, and its file is removed.

Who can do what

Each API key holds the storage permissions you chose when you created it: for buckets, Create, View, Edit, and Delete; for files, Upload, View and download, and Delete. People with View access in your organisation can see and download files, but not change them. See API keys and Team members and access.