File Uploads & Storage

Overview

Don't stream uploads through your app server — it's slow, memory-hungry, and hits serverless body limits. Instead, issue a presigned URL so the browser uploads directly to object storage (S3, Cloudflare R2, or Supabase Storage), then store only the object key + metadata in your DB. Validate type/size before signing, namespace keys per tenant, and serve private files via short-lived signed download URLs.

When to use

• Users upload avatars, attachments, imports, or documents.
• Files are large or uploads are slow/timing out through your API.
• You need per-tenant access control on stored files.

Presigned upload