File uploads

Upload files from your Flutter app to Amazon S3 or Google Cloud Storage with a type-safe API. Files go straight from the device to your storage, secrets stay on the server, and your backend never handles the heavy data traffic.

Get Started

Direct uploads

Most apps need to store files created by their users, such as avatars, photos, or documents. Sending them through your own API is slow and expensive for large files, and uploading to cloud storage directly from the app means having credentials on the device that anyone can extract.

With Serverpod, your server grants permission for a single upload, and the app sends the file directly to your storage. Your keys never leave the server, your API never carries the data traffic, and you confirm the file arrived before trusting it.

How it works

1Create an upload description

The server returns a signed description for a path in one of your storages.

class UploadEndpoint extends Endpoint {
  Future<String?> avatarUpload(Session session, String path) {
    return session.storage.createDirectFileUploadDescription(
      storageId: 'public',
      path: path,
    );
  }
}

2Upload directly from Flutter

The client uploads straight to storage using that description.

var description = await client.upload.avatarUpload('avatars/$userId.png');
var uploader = FileUploader(description!);
await uploader.uploadByteData(byteData);

3Verify and store the reference

var stored = await client.upload.verifyUpload('avatars/$userId.png');

Storage backends

Back your storage with Amazon S3, Google Cloud Storage, or Cloudflare R2. There is also a built-in database storage, which is automatically configured and is great while you develop your app. The API stays the same whichever you choose.

Straight to storage

Files are uploaded straight from the client to S3, Google Cloud Storage, or R2, so large files never proxy through your API.

Public and private storage

Serve public assets straight from a public storage over its URL, and keep sensitive files in a private storage that only your server can read.

Upload rules

Restrict what a client can upload. The upload description specifies a maximum file size, the exact content length, a validity window for the URL, and a flag that prevents overwriting an existing file.

Everything included

Why Serverpod

Works with

Amazon S3 Google Cloud Storage Cloudflare R2

Frequently asked questions