Storage

Storage keeps files in buckets. Create buckets in the dashboard, with the SDK (fastbase.storage.createBucket("avatars", { public: true })), or let the AI Engineer do it.

Public and private buckets

	Public bucket	Private bucket
Read with no credentials	Yes, at a permanent URL	No
Read with a signed URL	Yes	Yes
Read with the public key	Yes	Only the signed-in user’s own files
Write with the public key	Only the signed-in user’s own files	Only the signed-in user’s own files
Secret key	Everything	Everything

“The user’s own files” means paths that start with the user’s id: <user.id>/avatar.png. That gives apps safe per-user uploads from the browser without any server code.

Uploading and reading

const { object, url } = await fastbase.storage
  .bucket("avatars")
  .upload(`${user.id}/avatar.png`, file, { metadata: { source: "profile-form" } })

const blob = await fastbase.storage.bucket("avatars").download(`${user.id}/avatar.png`)
const info = await fastbase.storage.bucket("avatars").metadata(`${user.id}/avatar.png`)
await fastbase.storage.bucket("avatars").remove(`${user.id}/avatar.png`)

file can be a Blob/File, an ArrayBuffer, a Uint8Array or a string. Files are stored byte-for-byte whatever their content type. The limit is 50 MB per file.

Signed URLs

const link = await fastbase.storage.bucket("contracts").createSignedUrl("2026/acme.pdf", 3600)

Server-side only. The link works for anyone until it expires (at most 7 days) and cannot be altered.

Safety

Paths cannot contain .., backslashes or empty segments.
Files are served with a sandboxing Content-Security-Policy and nosniff, so an uploaded HTML or SVG file cannot run scripts against your users.
Deleting a bucket deletes every file in it and needs the bucket name typed back.

Where files live

Storage is S3-compatible by design. Locally files are on disk under the data directory; in production point FASTBASE at AWS S3, Cloudflare R2, MinIO or any S3-compatible service with the S3_* settings. Your code does not change.