Hosted file uploads, storage and delivery
Uploads, without the plumbing.
Typed file routers, bytes that go straight to object storage, and delivery you control. Your server decides who can upload. Uploadfile handles the rest.
- authorize
- reserve
- upload
- deliver
https://www.uploadfile.dev/f/7Hq2xK9mPqT3publicTyped file routers for
- Next.js
- React
- Vue
- Svelte
- Solid
- Nuxt
- Expo
pnpm add @uploadfile/core @uploadfile/react How an upload works
Four steps. Your server only does the first.
- 1
Authorize
Your middleware runs on your server and decides who can upload. Throw, and nothing is reserved.
- 2
Reserve
Uploadfile checks file policy and capacity, reserves the upload, and issues short-lived presigned destinations.
- 3
Direct upload
Bytes go straight to object storage (S3), single or multipart. They never pass through your server.
- 4
Complete and deliver
Processing and your
onUploadCompletecallback finish it. Serve it publicly, privately, or through a signed link.
import { createUploadfile, type FileRouter } from "@uploadfile/core/next";
const f = createUploadfile();
export const fileRouter = {
imageUploader: f({ image: { maxFileSize: "4MB", maxFileCount: 4 } })
// 1 · authorize: runs on your server
.middleware(async ({ req }) => {
const user = await authenticateYourUser(req);
if (!user) throw new Error("Unauthorized");
return { userId: user.id };
})
// 4 · complete: after the bytes land in storage
.onUploadComplete(async ({ metadata, file }) => {
await saveYourFile(metadata.userId, file.key);
return { key: file.key };
}),
} satisfies FileRouter;Capabilities
Everything after the upload. Filter it like anything else.
Access control
Every file is public or private. Private files are served through signed delivery links that expire. Pausing delivery stops serving a file without deleting it, and you can undo it.
https://www.uploadfile.dev/f/<file-key>https://www.uploadfile.dev/f/<file-key>?expires=…&sig=…Per-application isolation
Your organization owns people, roles and billing. Each application gets its own files, scoped server API keys, home storage region, plan and limits.
Sydney is the region enabled today.
Usage meters
Four meters, per application. Overage is off until you opt in, with quantity limits and a spending alert. Without your consent, excess use is blocked and never charged.
Example application on Launch. The bars are illustrative.
Team roles
Five roles, scoped to your organization.
| Permission | Owner | Admin | Developer | Billing | Viewer |
|---|---|---|---|---|---|
| Read | Yes | Yes | Yes | Yes | Yes |
| Read private files | Yes | Yes | Yes | No | No |
| Write files and apps | Yes | Yes | Yes | No | No |
| Manage members | Yes | Yes | No | No | No |
| Billing | Yes | No | No | Yes | No |
| Delete apps, transfer ownership | Yes | No | No | No | No |
Account security
Sign in securely, and see who did what.
- Passkeys
- TOTP with recovery codes
- Session review
- Audit log
Two-factor and passkeys are optional. Once you turn one on, it's checked every session.
Deletion that means it
When you deliberately delete a file, access is revoked and every copy is purged. There is no trash period, so deleted means deleted.
Developer experience
Typed file routers, a Next.js route handler and a dashboard. Define routes with createUploadfile and add a typed upload button.
@uploadfile/core@uploadfile/react@uploadfile/vue@uploadfile/svelte@uploadfile/solid@uploadfile/nuxt@uploadfile/expoNo capability matches that filter.
Pricing
Priced per application. Overage only if you say so.
Pricing is temporarily unavailable. Check back in a minute.
Full details on the pricing page.
One router. Every file handled.
Install the SDK, write a file router, and let Uploadfile take care of storage and delivery.