Dbrij Storage docs

Dbrij Storage keeps files. Two faces, one allowance: Buckets, which your code reaches through the REST API below or through the S3 protocol with any tool that speaks it, and Files, the drive people use from the app with folders, sharing and editors. A person's storage is theirs; a company's is the company's, and every meter and cap is by that principal.

Bytes live on an S3 compatible object store with traffic included, which is why no plan carries an egress fee. Uploads go straight to the store through presigned URLs, so a large file never streams through the API.

REST calls carry Authorization: Bearer <accessKeyId>:<secret>. S3 calls sign with the same id and secret as AWS credentials. Keys are minted on the Access keys page; the secret is shown once.

Three calls put a file in a bucket and read it back. Every step also works with the AWS CLI, shown afterwards.

curl https://api.dbrij.com/api/storage/buckets \
  -H "Authorization: Bearer dbsk_…:dbss_…" \
  -H "Content-Type: application/json" \
  -d '{ "name": "my-assets" }'

curl https://api.dbrij.com/api/storage/buckets/<bucketId>/upload-url \
  -H "Authorization: Bearer dbsk_…:dbss_…" \
  -H "Content-Type: application/json" \
  -d '{ "key": "images/logo.png", "contentType": "image/png" }'
# → { "url": "https://…", "headers": { "Content-Type": "image/png" } }

curl -X PUT "<url from the response>" -H "Content-Type: image/png" --data-binary @logo.png

curl https://api.dbrij.com/api/storage/buckets/<bucketId>/confirm \
  -H "Authorization: Bearer dbsk_…:dbss_…" \
  -H "Content-Type: application/json" \
  -d '{ "key": "images/logo.png" }'

export AWS_ACCESS_KEY_ID=dbsk_…
export AWS_SECRET_ACCESS_KEY=dbss_…
aws --endpoint-url https://s3.dbrij.com s3 mb s3://my-assets
aws --endpoint-url https://s3.dbrij.com s3 cp logo.png s3://my-assets/images/logo.png
aws --endpoint-url https://s3.dbrij.com s3 ls s3://my-assets/images/

Over S3 there is no confirm step: the store tells Dbrij when the bytes land. Use whichever surface your stack already speaks. Most frameworks have an S3 storage driver, and pointing it here is a two line change.

An access key is an id (dbsk_…) and a secret (dbss_…) with a scope of read, write or both. A key made in your personal space reaches your buckets. A key made while working in a company reaches the company's buckets and bills to the company. The secret is shown once, at creation.

rclone config create dbrij s3 provider=Other access_key_id=dbsk_… secret_access_key=dbss_… endpoint=https://s3.dbrij.com
rclone sync ./public dbrij:my-assets/public

import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';

const s3 = new S3Client({
  endpoint: 'https://s3.dbrij.com',
  region: 'auto',
  forcePathStyle: true,
  credentials: { accessKeyId: process.env.DBRIJ_KEY_ID!, secretAccessKey: process.env.DBRIJ_KEY_SECRET! },
});
await s3.send(new PutObjectCommand({ Bucket: 'my-assets', Key: 'images/logo.png', Body: bytes, ContentType: 'image/png' }));

Path style (https://s3.dbrij.com/my-assets/key) is always accepted. Virtual host style (my-assets.s3.dbrij.com) works too. Presigned S3 URLs from any SDK verify the same way.

Rotation. Mint the new key, move your deployments to it, then revoke the old one. A revoked key fails every call immediately with 401. Keys made before the S3 endpoint existed show as REST only on the keys page and cannot sign S3 requests; mint a new one.

Scoped keys (Pro plan and up) are narrowed at creation: one bucket, a prefix under it, an end date, an IP allowlist. Out of scope calls fail with 403 on REST and AccessDenied over S3; an expired key fails with 401. A key for one service that can only write uploads/ in one bucket and stops working next quarter is the key to put in that service's environment.

@dbrij/storage is a zero dependency client for Node 18+ and browsers. It covers what S3 does not: delivery links, transformations, presets, and the confirm step REST uploads need. Keep using an AWS SDK for everything else if you already do.

npm install @dbrij/storage

import { DbrijStorage, transform } from '@dbrij/storage';

const storage = new DbrijStorage({ keyId: process.env.DBRIJ_KEY_ID, secret: process.env.DBRIJ_KEY_SECRET });

const bucket = await storage.buckets.create('my-assets');
await storage.objects.upload(bucket.id, 'images/logo.png', bytes, { contentType: 'image/png' });
const link = await storage.delivery.url(bucket.id, 'images/logo.png', { transform: transform({ width: 800, format: 'auto' }) });
// link.url → https://files.dbrij.com/t/w_800,f_auto/<bucketId>/images/logo.png

import { DbrijStorage } from '@dbrij/storage';

const file = await DbrijStorage.presetUpload('dbup_…', input.files[0], { onProgress: (f) => bar.style.width = f * 100 + '%' });
img.src = file.deliveryUrl;

Python, Go and PHP: point the AWS SDK for that language at https://s3.dbrij.com with the key id and secret, and call the REST endpoints in this reference for delivery links and presets. Dedicated packages follow.

A bucket is a named space for objects. It is private by default: nothing in it can be read without a signed URL or a key. Switching it public makes every object's stable link readable by anyone. A public bucket can also be put on signed, expiring links instead of permanent ones, for downloads you want to be able to withdraw.

curl -X GET https://api.dbrij.com/api/storage/buckets \
  -H "Authorization: Bearer $DBRIJ_API_KEY"

{
  "success": true,
  "data": [{ "id": "b1…", "name": "my-assets", "visibility": "private", "versioning": null, "objectCount": 128, "totalBytes": 91827364, "createdAt": "…" }]
}

curl -X POST https://api.dbrij.com/api/storage/buckets \
  -H "Authorization: Bearer $DBRIJ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "my-assets", "visibility": "private" }'

{ "name": "my-assets", "visibility": "private" }

{
  "success": true,
  "data": { "id": "b1…", "name": "my-assets", "visibility": "private", "objectCount": 0, "totalBytes": 0 }
}

Over S3, CreateBucket, ListBuckets, DeleteBucket, PutBucketVersioning, PutBucketLifecycleConfiguration and PutBucketPolicy are all served. Deleting a bucket needs it empty, as everywhere.

Keys are paths: slashes make folders, and a key ending in a slash is a folder marker with no bytes. Objects can be up to five gigabytes each, subject to the plan's allowance. Uploads never stream through the API: REST hands you a presigned PUT, S3 uploads go to the endpoint directly, multipart included.

curl -X GET https://api.dbrij.com/api/storage/buckets/:bucketId/objects \
  -H "Authorization: Bearer $DBRIJ_API_KEY"

{
  "success": true,
  "data": [{ "key": "images/logo.png", "size": 18233, "contentType": "image/png", "isFolder": false, "url": null, "updatedAt": "…" }]
}

curl -X POST https://api.dbrij.com/api/storage/buckets/:bucketId/upload-url \
  -H "Authorization: Bearer $DBRIJ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "key": "images/logo.png", "contentType": "image/png" }'

{ "key": "images/logo.png", "contentType": "image/png" }

{
  "success": true,
  "data": { "url": "https://…", "method": "PUT", "headers": { "Content-Type": "image/png" }, "key": "images/logo.png", "expiresIn": 900 }
}

curl -X POST https://api.dbrij.com/api/storage/buckets/:bucketId/confirm \
  -H "Authorization: Bearer $DBRIJ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "key": "images/logo.png" }'

{ "key": "images/logo.png" }

{
  "success": true,
  "data": { "key": "images/logo.png", "size": 18233, "contentType": "image/png", "url": null }
}

curl -X GET https://api.dbrij.com/api/storage/buckets/:bucketId/object?key=… \
  -H "Authorization: Bearer $DBRIJ_API_KEY"

curl -X DELETE https://api.dbrij.com/api/storage/buckets/:bucketId/object?key=… \
  -H "Authorization: Bearer $DBRIJ_API_KEY"

{
  "success": true,
  "data": { "deleted": true }
}

Big files. Use S3 multipart for anything over a hundred megabytes: CreateMultipartUpload, UploadPart, ListParts, CompleteMultipartUpload and UploadPartCopy are served, and every SDK's high level upload helper uses them for you.

Copy. CopyObject copies within and between your buckets on the server, no download.

Browser uploads. The presigned URL from the REST call is safe to hand to a browser: it carries no key and expires in fifteen minutes. Bucket CORS is configured for direct browser PUTs.

Three kinds of link, depending on what the bucket allows.

https://files.dbrij.com/<bucketId>/images/logo.png                     # a public object
https://files.dbrij.com/<bucketId>/images/logo.png?dl=1                # served as a download
https://files.dbrij.com/<bucketId>/private.pdf?exp=1760000000&sig=…   # a private object, signed
https://files.dbrij.com/t/w_800,c_fill,f_auto/<bucketId>/images/logo.png  # transformed

curl -X POST https://api.dbrij.com/api/storage/buckets/:bucketId/delivery-url \
  -H "Authorization: Bearer $DBRIJ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "key": "images/hero.jpg", "transform": "w_1200,f_auto,q_80", "expiresIn": 86400 }'

{ "key": "images/hero.jpg", "transform": "w_1200,f_auto,q_80", "expiresIn": 86400 }

{
  "success": true,
  "data": { "url": "https://…/t/w_1200,f_auto,q_80/<bucketId>/images/hero.jpg?exp=…&sig=…", "expiresAt": "…", "signed": true }
}

The delivery host streams the bytes with range support, ETag and Last-Modified, so browsers revalidate cheaply and video seeks. Every byte served counts against the plan's transfer allowance; there is no egress fee. The free plan stops serving at its allowance for the period, paid plans keep serving and bill the extra per GB.

Put tokens in the path and the delivery host resizes, crops and re-encodes the image on first request, caches the result, and serves it from the cache after that. Only images transform; anything else is served as is. A transformation counts against the plan's allowance the first time it runs, never on a cache hit.

https://files.dbrij.com/t/<tokens>/<bucketId>/<key>
https://cdn.example.com/t/<tokens>/<key>            # on a custom domain

Unknown tokens are refused with the token named, never ignored. Sources up to 40 MB transform; SVG and icons are served untouched. Cloudinary style paths (/image/upload/w_300,c_fill/v1712/folder/file.jpg) are read too, on the delivery host after the bucket id and on custom domains directly, so URLs copied from an existing site keep working after a switch.

An upload preset opens one bucket prefix to keyless uploads from a browser or a mobile app, inside limits you set: accepted types, a size cap, and the origins allowed. The preset token (dbup_…) is safe in page source. Create presets on the bucket page.

<script src="https://app.dbrij.com/storage-widget.js"></script>
<button id="upload">Upload files</button>
<script>
  DbrijStorage.attach(document.querySelector('#upload'), {
    preset: 'dbup_…',
    onUploaded: (file) => console.log(file.key, file.deliveryUrl),
  });
  // or without UI: DbrijStorage.upload('dbup_…', fileInput.files[0]).then(console.log)
</script>

curl -X POST https://api.dbrij.com/api/storage/uploads/:presetToken \
  -H "Authorization: Bearer $DBRIJ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "filename": "avatar.png", "contentType": "image/png", "size": 18233 }'

{ "filename": "avatar.png", "contentType": "image/png", "size": 18233 }

{
  "success": true,
  "data": { "uploadUrl": "https://…", "method": "PUT", "headers": { "Content-Type": "image/png" }, "key": "uploads/2026/09/1a2b3c4d-avatar.png", "expiresIn": 900, "confirmUrl": "…" }
}

curl -X POST https://api.dbrij.com/api/storage/uploads/:presetToken/confirm \
  -H "Authorization: Bearer $DBRIJ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "key": "uploads/2026/09/1a2b3c4d-avatar.png" }'

{ "key": "uploads/2026/09/1a2b3c4d-avatar.png" }

{
  "success": true,
  "data": { "key": "…", "size": 18233, "contentType": "image/png", "url": null, "deliveryUrl": "https://…?exp=…&sig=…" }
}

Put your own hostname in front of a bucket. cdn.example.com/images/hero.jpg serves the object, cdn.example.com/t/w_800/images/hero.jpg the transformation, and Cloudinary style paths are read as well. The plan sets how many domains a space may attach.

Add the domain on the bucket page, add the record, press Check. Signed links work on custom domains too; the signature does not depend on the host.

Turn versioning on for a bucket and every overwrite keeps the previous bytes as a version, every delete writes a delete marker instead of removing anything, and deleting the marker brings the object back. Versions count against the allowance until a lifecycle rule or an explicit delete removes them.

aws --endpoint-url https://s3.dbrij.com s3api put-bucket-versioning \
  --bucket my-assets --versioning-configuration Status=Enabled

aws --endpoint-url https://s3.dbrij.com s3api list-object-versions --bucket my-assets --prefix images/logo.png
aws --endpoint-url https://s3.dbrij.com s3api delete-object --bucket my-assets --key images/logo.png --version-id <marker id>

Lifecycle rules run every hour. The applied subset is Expiration.Days (current objects older than this are deleted, a delete marker on a versioned bucket), NoncurrentVersionExpiration.NoncurrentDays (previous versions removed for good) and ExpiredObjectDeleteMarker. Transitions, tag filters and date based rules are refused with a reason rather than silently ignored.

aws --endpoint-url https://s3.dbrij.com s3api put-bucket-lifecycle-configuration --bucket my-assets --lifecycle-configuration '{
  "Rules": [{ "ID": "prune-versions", "Status": "Enabled", "Filter": { "Prefix": "" },
              "NoncurrentVersionExpiration": { "NoncurrentDays": 30 } }]
}'

A whole bucket can be public, or just a prefix of it: public/ readable by anyone while everything else stays private. Set it from the bucket page, or with a bucket policy over S3. Dbrij reads the policy and maps it to what it enforces; anything finer than "public read on this prefix" is refused with a reason, never accepted and silently unenforced.

aws --endpoint-url https://s3.dbrij.com s3api put-bucket-policy --bucket my-assets --policy '{
  "Version": "2012-10-17",
  "Statement": [{ "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-assets/public/*" }]
}'

Object level ACLs (x-amz-acl: public-read) on a private bucket are refused with guidance, because an ACL that quietly did nothing is the kind of thing that leaks a file a year later.

Object events delivered to your own https endpoints (Starter plan and up), signed the way every Dbrij webhook is signed. Add endpoints on the Webhooks page; each one gets a secret shown once and a delivery log you can replay from.

POST https://example.com/hooks/dbrij
Content-Type: application/json
X-Dbrij-Event: object.created
X-Dbrij-Signature: sha256=<hmac(secret, body)>
X-Dbrij-Signature-V2: t=1760000000,sha256=<hmac(secret, "1760000000." + body)>

{ "id": "evt_…", "type": "object.created", "createdAt": "…", "data": { "bucketId": "…", "key": "images/logo.png", "size": 18233, "contentType": "image/png" } }

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(secret, body, header) {
  const [t, sig] = header.split(',').map((p) => p.split('=')[1]);
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const expected = createHmac('sha256', secret).update(t + '.' + body).digest('hex');
  return timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
}

Reply with any 2xx within ten seconds. Anything else is retried four more times over a few hours; twenty consecutive failures switch the endpoint off until you turn it back on. Deliveries are kept for thirty days.

Files is the drive: what a person or a company keeps without writing code. Folders, sharing with members or by email, links anyone can open, trash, versions of edited files, and editors for documents, spreadsheets and presentations. It sits on the same allowance as the buckets, so a company buys storage once.

Import from Google Drive, Dropbox and OneDrive, and mounting Files as a disk over WebDAV, are on the roadmap and land with the switching tools below.

Because the endpoint speaks S3, most moves are a change of endpoint and key. This is what changes in the common stacks, and what does not.

rclone config create old s3 provider=AWS access_key_id=… secret_access_key=… region=eu-west-1
rclone config create dbrij s3 provider=Other access_key_id=dbsk_… secret_access_key=dbss_… endpoint=https://s3.dbrij.com
rclone sync old:my-assets dbrij:my-assets --transfers 16 --checksum
# run it again just before cutover: only what changed is copied

The allowance is one number for the drive and the buckets together. A paid Hosting plan's included storage still counts: the allowance is the sum. Free stops uploads at the allowance. Paid plans keep accepting uploads and bill the gigabytes held above it by the day, at renewal, from the closed period, never the live month. There is no egress fee on any plan.