Skip to content

Docs

Object storage

S3-compatible buckets inside your workspace, for backups, build artifacts, user uploads and anything else that does not belong in a database. Point any S3 tool at the endpoint — aws, boto3, rclone, restic, s3cmd — and it works without a plugin. Objects are private to your workspace: another workspace cannot read them even if it knows the bucket name.

Create a bucket and a key

Open Infrastructure → Object storage. Create a bucket, then switch to Access keys and mint one. The secret is shown once — when you dismiss the dialog it is gone, because nothing here can read it back. Copy it before you close.

The dialog also shows the endpoint to configure. Use that address, not the one in your browser's URL bar: these pages are served by the app, while objects live on the storage service.

export AWS_ACCESS_KEY_ID=<access key id>
export AWS_SECRET_ACCESS_KEY=<secret>

aws --endpoint-url <endpoint> s3 ls
aws --endpoint-url <endpoint> s3 cp ./backup.tar.gz s3://<bucket>/backup.tar.gz
aws --endpoint-url <endpoint> s3 sync ./dist s3://<bucket>/dist

What a key can do, and for how long

An access key carries your workspace's object permissions. Anyone holding one can read and write the objects those permissions allow, from anywhere — it is a credential, not a session, and it is not tied to a browser or an IP address.

A key belongs to the workspace, not to the person who created it, and it keeps working after that person leaves. That is deliberate — a backup job should not break because someone changed teams — but it means offboarding includes revoking the keys a leaver minted. The list shows who created each one.

Set an expiry when you create a key for something short-lived. Disable stops a key immediately and keeps it listed so its history stays readable; Delete removes it outright. Either takes effect on the next request — there is no cache to wait out.

Sharing a single file

The browser view can produce a time-limited link to one object. Anyone with the link can fetch that object until it expires, with no account and no key — which is what makes it useful and also what makes it worth thinking about before you paste one into a chat.

A share link bypasses sign-in, permissions and network restrictions for its whole lifetime. Revoke it from the shared links page if it leaks — it is also revoked when the object is deleted. Keep the expiry short; your operators set the maximum.

Uploading from the browser

Drag files onto a bucket to upload them. They go straight from your machine to the storage service rather than through this app, so a multi-gigabyte upload is limited by your connection and nothing else. Large uploads are split automatically and can be cancelled mid-flight.

Folders, and why there are none

An object key is a single flat string. reports/2026/q1.pdf is not a file in two nested folders — it is one key that happens to contain slashes. The browser groups keys on / so it reads like a tree, but there is no folder to create, rename or delete: a "folder" exists exactly as long as something inside it does.

Limits

The Usage tab shows what your workspace holds and any limit set on it. An upload that would exceed the limit is refused before it sends any data, so you find out immediately rather than after a long transfer. Limits are set by your platform operators.