Storage

Storage keeps your application’s files (avatars, uploads, exports, images) in buckets next to your databases, with access decided by row-level security policies in your project’s primary database.

Coming soon: Storage is being built

Storage is not available on the platform yet. This page describes how it works at launch; prices and plan limits are already published in Platform pricing and limits and nothing is billed before it is live.

Status changes are announced in the changelog; the platform overview lists where every capability stands.

How it works

• Buckets belong to a project. A public bucket serves objects to anyone; a private bucket requires a policy or a signed URL for every read and write.
• Policies are ordinary row-level security policies on storage.objects and storage.buckets in the primary database, so the rules for files and rows live in one place. Without a primary database, buckets support only public reads and secret-key access.
• Objects are stored in the region that runs the project, under your organisation and project.
• Signed URLs give time-limited access to a private object; signed upload URLs let a client upload without a session.

Quickstart (at launch)

SQL: users may manage their own folder in the avatars bucket

create policy "own avatar" on storage.objects for all to authenticated
  using (bucket_id = 'avatars' and (storage.foldername(name))[1] = auth.uid()::text)
  with check (bucket_id = 'avatars' and (storage.foldername(name))[1] = auth.uid()::text);

curl

curl -X POST "https://<ref>.us-east.databasezy.com:8443/storage/v1/object/avatars/user-1.png" \
  -H "apikey: <publishable-key>" \
  -H "Authorization: Bearer <publishable-key>" \
  -H "Content-Type: image/png" \
  --data-binary @user-1.png

supabase-js

import { createClient } from "@supabase/supabase-js";

const supabase = createClient("https://<ref>.us-east.databasezy.com:8443", "<publishable-key>");

const { data, error } = await supabase.storage
  .from("avatars")
  .upload("user-1.png", file, { contentType: "image/png" });

Python (supabase)

from supabase import create_client

supabase = create_client("https://<ref>.us-east.databasezy.com:8443", "<publishable-key>")

with open("user-1.png", "rb") as f:
    supabase.storage.from_("avatars").upload("user-1.png", f, {"content-type": "image/png"})

Rust (reqwest)

// Cargo.toml: reqwest = { version = "0.12", features = ["json"] }, serde_json, tokio
let key = "<publishable-key>";
let res = reqwest::Client::new()
    .post("https://<ref>.us-east.databasezy.com:8443/storage/v1/object/avatars/user-1.png")
    .header("apikey", key)
    .bearer_auth(key)
    .header("Content-Type", "image/png")
    .body(std::fs::read("user-1.png")?)
    .send()
    .await?
    .error_for_status()?;
let json: serde_json::Value = res.json().await?;

Large files and S3

• Resumable uploads with the tus protocol and multipart uploads, so a dropped connection resumes instead of restarting.
• An S3-compatible endpoint at https://<ref>.us-east.databasezy.com:8443/storage/v1/s3, authenticated with a project secret key, for the AWS CLI and S3 SDKs.

Image transformations

Append width, height, quality and format to an image URL to resize, crop or convert it to WebP or AVIF. Results are cached per project; only origin transformations count toward the meter.

Pricing and limits

Platform usage prices and the allowance each plan includes per month

Meter	Price	Free	Solo	Team	Enterprise
Object storage ○Coming soon	$0.021 per GB-month	1 GB	10 GB	100 GB	Contract
Image transformations ○Coming soon	$5 per 1,000	None	100	1,000	Contract

Platform limits on each plan

Limit	Free	Solo	Team	Enterprise
Storage buckets ○Coming soon	5	100	Unlimited	Unlimited
Largest single upload ○Coming soon	50 MB	500 GB	500 GB	500 GB