uploadfile

Hosted file uploads, storage and delivery

Uploads, without the plumbing.

Typed file routers, bytes that go straight to object storage, and delivery you control. Your server decides who can upload. Uploadfile handles the rest.

Get started Read the quickstart
acme-web
product-shot.webpComplete · onUploadComplete ran
3.4 MB
  1. authorize
  2. reserve
  3. upload
  4. deliver
https://www.uploadfile.dev/f/7Hq2xK9mPqT3public
Press ⌘K to take over Demo · nothing is created Press ⌘K to try it

Typed file routers for

  • Next.js
  • React
  • Vue
  • Svelte
  • Solid
  • Nuxt
  • Expo
pnpm add @uploadfile/core @uploadfile/react

How an upload works

Four steps. Your server only does the first.

  1. 1

    Authorize

    Your middleware runs on your server and decides who can upload. Throw, and nothing is reserved.

  2. 2

    Reserve

    Uploadfile checks file policy and capacity, reserves the upload, and issues short-lived presigned destinations.

  3. 3

    Direct upload

    Bytes go straight to object storage (S3), single or multipart. They never pass through your server.

  4. 4

    Complete and deliver

    Processing and your onUploadComplete callback finish it. Serve it publicly, privately, or through a signed link.

app/api/uploadfile/core.ts
import { createUploadfile, type FileRouter } from "@uploadfile/core/next";

const f = createUploadfile();

export const fileRouter = {
  imageUploader: f({ image: { maxFileSize: "4MB", maxFileCount: 4 } })
    // 1 · authorize: runs on your server
    .middleware(async ({ req }) => {
      const user = await authenticateYourUser(req);
      if (!user) throw new Error("Unauthorized");
      return { userId: user.id };
    })
    // 4 · complete: after the bytes land in storage
    .onUploadComplete(async ({ metadata, file }) => {
      await saveYourFile(metadata.userId, file.key);
      return { key: file.key };
    }),
} satisfies FileRouter;

Capabilities

Everything after the upload. Filter it like anything else.

7 capabilities

Access control

Every file is public or private. Private files are served through signed delivery links that expire. Pausing delivery stops serving a file without deleting it, and you can undo it.

publichttps://www.uploadfile.dev/f/<file-key>
signedhttps://www.uploadfile.dev/f/<file-key>?expires=…&sig=…

Per-application isolation

Your organization owns people, roles and billing. Each application gets its own files, scoped server API keys, home storage region, plan and limits.

API key scopes · keys start with sk_uploadfile_
readwritedeleteuploadsign
Home storage region
Sydney · ap-southeast-2

Sydney is the region enabled today.

Usage meters

Four meters, per application. Overage is off until you opt in, with quantity limits and a spending alert. Without your consent, excess use is blocked and never charged.

Stored dataof 100 GB
Downloadsof 50 GB
Live filesof 10,000
Request unitsof 100,000

Example application on Launch. The bars are illustrative.

Team roles

Five roles, scoped to your organization.

PermissionOwnerAdminDeveloperBillingViewer
ReadYesYesYesYesYes
Read private filesYesYesYesNoNo
Write files and appsYesYesYesNoNo
Manage membersYesYesNoNoNo
BillingYesNoNoYesNo
Delete apps, transfer ownershipYesNoNoNoNo

Account security

Sign in securely, and see who did what.

  • Passkeys
  • TOTP with recovery codes
  • Session review
  • Audit log

Two-factor and passkeys are optional. Once you turn one on, it's checked every session.

Deletion that means it

When you deliberately delete a file, access is revoked and every copy is purged. There is no trash period, so deleted means deleted.

deleteaccess revokedall copies purged

Developer experience

Typed file routers, a Next.js route handler and a dashboard. Define routes with createUploadfile and add a typed upload button.

@uploadfile/core@uploadfile/react@uploadfile/vue@uploadfile/svelte@uploadfile/solid@uploadfile/nuxt@uploadfile/expo

No capability matches that filter.

Pricing

Priced per application. Overage only if you say so.

Paid plans are per application. Free is one pool shared across your organization. Prices in USD per month.

Free

$0/ month
organization pool

An organization-wide pool to get started.

Storage
2 GB
Downloads
2 GB
Live files
1,000
Request units
10,000

Launch

$59/ month
per application

A focused home for your first production app.

Storage
100 GB
Downloads
50 GB
Live files
10,000
Request units
100,000

Growth

$269/ month
per application

Room for a growing product and its customers.

Storage
500 GB
Downloads
250 GB
Live files
50,000
Request units
500,000

Scale

$1,099/ month
per application

More capacity for an established application.

Storage
2,000 GB
Downloads
1,000 GB
Live files
200,000
Request units
2,000,000

Pay as you go · $0/month + usage

No included usage. Charged proportionally from the first unit against prepaid funds: $10 to start, and every top-up is $10. Unused funds don't expire. A one-part upload uses 5 request units (0.00075); each successful download uses 1. Stored files keep accruing storage charges while they remain stored. USD, excluding applicable taxes.

Storage
$0.50 / GB-month
Downloads
$1.00 / GB
Resident files
$0.50 / 1,000 file-months
Request units
$150 / million

Opt-in overage

Off by default. Turn it on with quantity limits and a spending alert. Without your consent, excess use is blocked and never charged.

Storage
$0.25 / GB-month
Downloads
$0.45 / GB
Live files
$0.25 / 1,000 file-months
Request units
$65 / million

Full details on the pricing page.

One router. Every file handled.

Install the SDK, write a file router, and let Uploadfile take care of storage and delivery.

Get started Read the docs