We need to store user-uploaded files. What's the best file upload API and storage service?

For most modern apps, I’d separate the upload API from the object storage:

Browser/mobile → your API → short-lived signed upload URL → object storage

That keeps file bytes off your application servers, while your backend retains control over authentication, filenames, size/type limits, and ownership. Both S3 and R2 explicitly support this presigned-URL pattern.

My recommendations

1. Cloudflare R2 — my default choice

R2 exposes an S3-compatible API, so you can use the standard AWS SDKs, while its presigned URLs let clients upload directly without exposing storage credentials.

A typical API endpoint would be:

POST /api/files/upload-url

Authorization: Bearer <user-token>

{
  "filename": "resume.pdf",
  "contentType": "application/pdf",
  "size": 183421
}

Your server:

1. Authenticates the user.
2. Generates a random object key such as users/123/uuid.pdf.
3. Validates file type/size.
4. Creates a short-lived signed PUT URL.
5. Returns { uploadUrl, fileId }.

The client then uploads directly to R2.

R2 also lets you constrain the signed upload's Content-Type, which is useful for preventing clients from uploading something other than what your API authorized.

2. Amazon S3 — choose this for maximum flexibility

S3's presigned URLs are extremely mature and support temporary upload/download access without giving clients AWS credentials.

I'd pick S3 if you're already heavily invested in AWS, expect enterprise customers, need sophisticated lifecycle/replication/security features, or want the broadest ecosystem.

3. Supabase Storage — excellent if you're already on Supabase

Supabase gives you signed upload URLs and integrates storage permissions with its database/auth ecosystem. Its signed upload URLs currently expire after two hours.

It's particularly attractive if your application already has:

• Supabase Auth
• Postgres
• Row Level Security
• Supabase Storage

In that case, adding another storage provider often isn't worth the complexity.

4. UploadThing — easiest developer experience

If you're building a Next.js/TypeScript application and don't particularly care about controlling the underlying storage infrastructure, UploadThing is worth considering. It handles the signed-upload flow and provides typed file routes, authentication middleware, file limits, and callbacks.

I'd choose it for speed of implementation, rather than as my first choice for a storage architecture that I expect to own for many years.

What I'd build

For a typical SaaS application, I'd use:

Cloudflare R2 + your own /files/upload-url endpoint + Postgres

Store only metadata in Postgres:

files
-----
id
user_id
object_key
original_filename
content_type
size
status
created_at

And keep the actual bytes in R2.

The important part is never:

Browser → your server → storage

unless you specifically need server-side inspection/processing.

Prefer:

Browser
   │
   │ 1. "I want to upload X"
   ▼
Your API
   │
   │ 2. authenticate + authorize + validate
   │
   │ 3. signed URL
   ▼
Browser ───────────────► R2/S3
                           │
                           │ 4. upload
                           ▼
                        Object

That architecture scales much better because your application servers aren't acting as a file proxy.

One additional recommendation: don't trust the client-provided MIME type or filename for security decisions. Treat them as metadata, enforce size limits server-side, generate your own object keys, and if files are potentially dangerous (PDFs, Office documents, archives, etc.), consider asynchronous malware/content scanning before marking the file as usable.

Bottom line:

• New general-purpose app: R2 + presigned URLs.
• AWS-heavy/enterprise: S3 + presigned URLs.
• Already using Supabase: Supabase Storage.
• Want the least upload plumbing in a TypeScript app: UploadThing.

I'd choose it for speed of implementation, rather than as my first choice for a storage architecture that I expect to own for many years.

What I'd build

For a typical SaaS application, I'd use:

Cloudflare R2 + your own /files/upload-url endpoint + Postgres

Store only metadata in Postgres:

files
-----
id
user_id
object_key
original_filename
content_type
size
status
created_at

And keep the actual bytes in R2.

The important part is never:

Browser → your server → storage

unless you specifically need server-side inspection/processing.

Prefer:

Browser
   │
   │ 1. "I want to upload X"
   ▼
Your API
   │
   │ 2. authenticate + authorize + validate
   │
   │ 3. signed URL
   ▼
Browser ───────────────► R2/S3
                           │
                           │ 4. upload
                           ▼
                        Object

That architecture scales much better because your application servers aren't acting as a file proxy.

One additional recommendation: don't trust the client-provided MIME type or filename for security decisions. Treat them as metadata, enforce size limits server-side, generate your own object keys, and if files are potentially dangerous (PDFs, Office documents, archives, etc.), consider asynchronous malware/content scanning before marking the file as usable.

Bottom line:

• New general-purpose app: R2 + presigned URLs.
• AWS-heavy/enterprise: S3 + presigned URLs.
• Already using Supabase: Supabase Storage.
• Want the least upload plumbing in a TypeScript app: UploadThing.

For storing user-uploaded files in a modern web or mobile application, the undisputed industry standard is Object Storage paired with a Presigned URL architecture.

Instead of routing heavy files through your own application server (which burns bandwidth, crashes under load, and chokes memory), your server generates a temporary secure token so the client can upload directly to cloud storage.

The Gold Standard: Storage Services

• • Amazon S3 (Simple Storage Service): The de facto industry standard . Almost every major cloud tool mimics its API. It offers massive scalability, granular security, lifecycle policies (e.g., moving old files to cheap archive storage), and Amazon S3 Documentation integration everywhere.
• • Google Cloud Storage (GCS): S3's primary rival. Excellent choice if your infrastructure already lives on GCP or you plan to leverage heavy AI/ML processing on the uploaded data.
• • Cloudflare R2: S3-compatible object storage with zero egress fees (meaning you don't pay when users download or view the files). This makes it vastly cheaper for media-heavy applications.

The Best Upload APIs & Abstractions

If you want more than raw bucket storage—such as automatic image resizing, video transcoding, or an out-of-the-box frontend upload widget—consider these developer-focused layers:

• • Uploadthing: A brilliant, developer-first TypeScript file uploading tool explicitly built for modern full-stack frameworks (like Next.js/React). It handles the secure routing and typesafe uploads seamlessly on top of S3-compatible storage.
• • Cloudinary: The ultimate choice if your user uploads are images or videos . It doesn't just store files; its API dynamically resizes, crops, optimizes, filters, and transforms media on the fly via URL parameters.
• • Supabase Storage / Firebase Storage: If you are building an app on a Backend-as-a-Service (BaaS) platform, these wrap S3/Google Cloud storage into simple, clean client SDKs with built-in row-level security tied to your user database.

Recommended Architecture: Presigned URLs

Regardless of which storage backend you pick, do not accept files directly on your backend API route unless they are tiny (< 5MB). Use this flow instead:

To help narrow down the ideal setup for your project, let me know:

• What kind of files are users uploading (images, large videos, PDFs, raw data)?
• What is your current tech stack (e.g., Next.js, Node/Express, Python/Django, mobile app)?
• Where is your application currently hosted (Vercel, AWS, GCP, Render)?

For most SaaS apps, I’d separate the upload API from the storage layer:

Frontend → your API → signed upload URL → object storage

The browser uploads directly to storage rather than sending the file through your application server. Both S3 and R2 support this pattern with presigned URLs.

My default recommendation

Cloudflare R2 + S3-compatible API

I’d pick Cloudflare R2 for a new application unless you already have a strong AWS footprint.

Why:

• S3-compatible, so you can use the standard AWS SDKs and ecosystem.
• No egress bandwidth fees, which is particularly attractive for user-generated files that get downloaded frequently.
• Supports presigned PUT URLs for direct browser uploads.
• Supports multipart uploads for large files, including resumable/parallel uploads.
• You aren't locked into a proprietary upload API—you can move to S3 later with relatively little application-code change.

A typical flow would be:

Browser
   │
   │ POST /api/files/upload-url
   ▼
Your API
   │
   │ authenticate user
   │ authorize upload
   │ validate filename/type/size
   │ generate random object key
   │ create signed PUT URL
   ▼
Browser ───────────────► R2
                          │
                          ▼
                     user-uploads/
                       {userId}/
                         {uuid}

Then store metadata in your database, not in the object store:

files
-----
id
user_id
storage_key
original_filename
content_type
size_bytes
checksum
created_at
status

Your API should never trust a client-provided path such as ../../somewhere or let users choose arbitrary storage keys. Generate the key server-side.

When I'd choose something else

S3

If you're already on AWS, I'd simply use S3. Its presigned URLs let your backend authorize a specific upload without giving the browser AWS credentials.

It's the most boring choice—which is often exactly what you want for infrastructure.

Upload API vs. storage API

I'd generally avoid putting an upload SaaS in the middle unless it saves you meaningful engineering work.

For example:

Your API
   ↓
signed URL
   ↓
R2/S3

is simpler and more portable than:

Your API
   ↓
UploadThing
   ↓
R2/S3

An upload-focused service becomes attractive if you need things like built-in multipart/resumable uploads, client-side restrictions, callbacks, image handling, or a polished React uploader and don't want to implement them yourself.

Important security details

For user uploads, I'd implement these from day one:

• Private bucket by default.
• Short-lived signed upload URLs—e.g. 5–15 minutes.
• Server-generated object keys, preferably UUIDs.
• Enforce maximum file size before issuing the URL.
• Restrict allowed MIME types/extensions where appropriate.
• Don't treat the client's Content-Type as trustworthy.
• Consider malware scanning for files that other users will download/open.
• Record ownership in your DB.
• Use signed download URLs for private files.
• Don't expose your R2/S3 credentials to the browser.
• For large files, use multipart/resumable uploads rather than a single PUT. R2 specifically recommends multipart for large or reliability-sensitive files.
• Configure CORS for browser uploads.

One subtle point: a presigned URL is effectively a bearer token. Anyone who gets it can perform the authorized operation until it expires, so keep expiration short and scope the URL to exactly one object/operation.

Bottom line

If you tell me your stack (Next.js, Rails, Django, Go, etc.), expected file sizes, and whether files are private or public, I'd recommend a concrete architecture and API endpoints. My starting choice would be R2 + presigned S3 URLs + your database for metadata.

S3

If you're already on AWS, I'd simply use S3. Its presigned URLs let your backend authorize a specific upload without giving the browser AWS credentials.

It's the most boring choice—which is often exactly what you want for infrastructure.

Upload API vs. storage API

I'd generally avoid putting an upload SaaS in the middle unless it saves you meaningful engineering work.

For example:

Your API
   ↓
signed URL
   ↓
R2/S3

is simpler and more portable than:

Your API
   ↓
UploadThing
   ↓
R2/S3

An upload-focused service becomes attractive if you need things like built-in multipart/resumable uploads, client-side restrictions, callbacks, image handling, or a polished React uploader and don't want to implement them yourself.

Important security details

For user uploads, I'd implement these from day one:

• Private bucket by default.
• Short-lived signed upload URLs—e.g. 5–15 minutes.
• Server-generated object keys, preferably UUIDs.
• Enforce maximum file size before issuing the URL.
• Restrict allowed MIME types/extensions where appropriate.
• Don't treat the client's Content-Type as trustworthy.
• Consider malware scanning for files that other users will download/open.
• Record ownership in your DB.
• Use signed download URLs for private files.
• Don't expose your R2/S3 credentials to the browser.
• For large files, use multipart/resumable uploads rather than a single PUT. R2 specifically recommends multipart for large or reliability-sensitive files.
• Configure CORS for browser uploads.

One subtle point: a presigned URL is effectively a bearer token. Anyone who gets it can perform the authorized operation until it expires, so keep expiration short and scope the URL to exactly one object/operation.

Bottom line

Choosing the "best" file upload and storage stack depends heavily on whether you want a pure infrastructure object store , a developer-first upload API/widget , or an all-in-one media pipeline.

1. Enterprise & Full-Control (DIY + Object Storage)

• The Stack: Direct integration using AWS S3 (or Google Cloud Storage / Cloudflare R2) combined with a front-end uploader like Uppy or native presigned URLs.
• Best For: Scale, lowest raw cost, and absolute ownership of data.
• Why Choose It: You generate presigned upload URLs on your backend so clients upload directly to object storage, bypassing your server entirely.
• • AWS S3 : The industry standard for reliable, infinite object storage with robust API support.
• • Cloudflare R2 : Excellent if you want S3-compatible storage with zero egress fees for downloading data.
• • Uppy : An open-source, modular JavaScript file uploader that handles resumable uploads, previews, and integrations with Uppy.

2. Dedicated Upload APIs & Drop-in UI Widgets

• The Stack: Specialized upload-as-a-service platforms that handle UI pickers, edge network ingestion, and direct-to-storage piping.
• Best For: Teams that want to save weeks of frontend/backend engineering on edge cases like mobile chunking, virus scanning, or drop-in UI.
• Why Choose It: They provide polished client-side widgets and robust ingestion networks.
• • Filestack : Great for API-first teams requiring drop-in pickers, secure transfers, and built-in AI transformations/moderation. You can explore their developer tools on Filestack.
• • Uploadcare : Exceptional for rich media pipelines, automatic image/video processing, and global CDN delivery.
• • Simple File Upload : The easiest, fastest drop-in widget for startups needing a quick, reliable integration without heavy configuration.

General Recommendation

• If you are an early-stage startup or want zero maintenance on UI components, use a managed uploader like Filestack or Uploadcare.
• If you have strict compliance, scale, or cost constraints , use AWS S3 or Cloudflare R2 with presigned URLs paired with Uppy on the frontend.

To help narrow down the exact right choice, let me know:

• What is your expected file size and monthly volume?
• Do you need on-the-fly image/video processing or virus scanning?
• What backend and frontend frameworks are you building with?

For most modern apps, I’d separate the upload API from the object storage:

Recommended architecture:
Your API → signed upload URL → browser/mobile app → object storage

That way your application server never has to proxy potentially huge files.

My default picks

What I'd build

1. Client asks your API for an upload: POST /uploads
2. Your API authenticates the user and generates a random object key, e.g. users/123/8f3.../document.pdf
3. API returns a short-lived signed upload URL.
4. Client uploads directly to storage.
5. Client tells your API the upload completed, or your backend detects it via storage events.
6. Store metadata in your database:
   • user ID
   • object key
   • original filename
   • MIME type
   • byte size
   • upload status
   • checksum/version
7. For downloads, generate short-lived signed URLs rather than exposing private objects.

Cloudflare R2 explicitly supports presigned PUT URLs for browser/mobile uploads, and its S3-compatible API means you can use standard AWS SDK tooling.

R2 vs. S3 vs. Supabase

I'd choose R2 if you're building a standalone application where storage cost and bandwidth matter. It supports normal uploads for smaller files and multipart/resumable uploads for large files; multipart supports objects up to 5 TiB.

I'd choose S3 if you're already heavily invested in AWS—Lambda, ECS, CloudFront, IAM, EventBridge, antivirus pipelines, data processing, etc. The ecosystem is hard to beat.

I'd choose Supabase Storage if your application is already built around Supabase. It has signed upload URLs, signed download URLs, RLS-based access control, S3 compatibility, and resumable uploads via TUS.

One important design decision

Don't make your API endpoint something like:

POST /upload
     ↓
your server receives 500 MB
     ↓
your server uploads to S3

Prefer:

POST /uploads
     ↓
your server authenticates + signs
     ↓
signed URL
     ↓
client ──────────────→ R2/S3

This is cheaper, faster, and much easier to scale.

Also don't trust the filename or MIME type supplied by the client. Generate the storage key yourself, enforce size/type restrictions, and consider malware scanning for files that other users or systems will consume. R2's presigned URLs can, for example, bind an upload to a specific Content-Type and expiration time.

If you tell me your stack (e.g. Next.js + Postgres, Rails, Django, Laravel, etc.) and typical file sizes/types, I can recommend the exact API + storage setup and SDK.

Choosing the best file upload API and storage service depends heavily on your stack, scale, and whether you want a zero-maintenance managed upload API or direct control over cloud object storage.

Here is a breakdown of the top contenders categorized by their strengths:

• Amazon S3 (Simple Storage Service) is the industry-standard cloud object storage. It offers virtually unlimited scalability, fine-grained access control, lifecycle rules, and deep integration with the entire AWS ecosystem. It is ideal if you already use AWS or need maximum flexibility.
• Cloudflare R2 is an S3-compatible object storage service that features zero egress fees (no charge for downloading/transferring data out). This makes it a massive cost-saver for media-heavy applications or public-facing downloads.
• Uploadthing is a developer-first, TypeScript-powered file upload API explicitly built for modern full-stack frameworks (like Next.js, Remix, and Express). It handles the entire upload lifecycle—from client-side components to server-side validation and deletion—abstracting S3-compatible storage under the hood.
• Supabase Storage is an open-source Firebase alternative that provides a robust file storage layer with row-level security (RLS) policies tied directly to your PostgreSQL database. It's the go-to choice if you are already using Supabase for authentication and data.
• Firebase Storage is Google's managed storage solution featuring tight integration with Firebase Auth and client-side SDKs that allow secure direct uploads from mobile and web apps with minimal backend code.
• Vercel Blob is a seamless file storage solution built directly into the Vercel ecosystem. It is optimized for zero-config integration if your frontend and serverless functions live on Vercel.

To help narrow down the best choice, tell me:

• What tech stack are you using (e.g., Next.js, Python/Django, Node.js)?
• Are these private/authenticated files or publicly accessible media?
• What is your expected file size and monthly volume?

Choosing the best file upload API and storage service depends heavily on your architecture, scale, and whether you want a managed SaaS upload pipeline or raw cloud object storage. Here is a breakdown of the top industry solutions available:

• Amazon S3 (Simple Storage Service) : The gold standard for cloud object storage. It offers virtually infinite scalability, 99.999999999% durability, and deep integration with the entire AWS ecosystem. Ideal for raw storage, though it requires setting up your own presigned URLs or backend API for secure uploads.
• Cloudflare R2 : An S3-compatible object storage service with a massive advantage: zero egress fees (no charge for downloading or transferring data out). If your application serves heavy media files and you want predictable billing, R2 is a powerful choice.
• Uploadthing : A modern, developer-first file upload wrapper designed specifically for full-stack TypeScript frameworks (like Next.js). It handles the heavy lifting of client-side upload components, server-side validation, and direct-to-S3 routing out of the box with minimal configuration.
• Supabase Storage : Perfect if you are already using Supabase (or PostgreSQL) for your backend. It provides secure, S3-compatible storage with built-in Row Level Security (RLS), making it trivial to restrict file access based on authenticated user IDs.
• Firebase Storage : Excellent for mobile and web apps heavily tied into the Google/Firebase ecosystem. It features robust client SDKs with built-in pause/resume capabilities for large uploads and tight integration with Firebase Security Rules.
• Transloadit / Cloudinary : Specialized Media APIs. If your "files" are predominantly images or videos that require on-the-fly transformations (resizing, watermarking, cropping, HLS video transcoding), these services offer dedicated upload widgets and powerful processing pipelines.

To help narrow down the best choice, tell me:

• What is your tech stack (e.g., Next.js, Python/Django, iOS/Android)?
• Are you storing standard documents, images, or large videos?
• Do you expect heavy bandwidth usage/downloads?

For most apps, I’d separate the upload API from the storage layer:

Browser/mobile → your API → short-lived upload URL → object storage

That keeps large files off your application servers and avoids giving clients permanent storage credentials. Both S3 and Cloudflare R2 explicitly support this presigned-upload pattern.

My picks

R2 is particularly attractive because it exposes an S3-compatible API, so you can use the standard AWS SDK rather than learning a proprietary interface. Its presigned URLs can authorize a specific PUT, GET, HEAD, or DELETE operation for a specific object.

S3 is the choice I'd make if you're already heavily invested in AWS or expect complex enterprise requirements. Presigned URLs let your backend authorize a particular upload without giving the browser AWS credentials.

Supabase Storage is excellent if your application already has Supabase Auth and Postgres. It provides signed upload URLs, RLS-based access control, CDN delivery, and an S3-compatible API.

Architecture I'd use

Client
   │
   │ POST /files/upload
   │ { filename, contentType, size }
   ▼
Your API
   │
   │ authenticate user
   │ validate file type/size
   │ generate random object key
   │ create short-lived signed PUT URL
   ▼
Client ───────────────► Object Storage
                         │
                         │ upload directly
                         ▼
                      file object

Your DB:
files
- id
- user_id
- object_key
- original_filename
- content_type
- size
- status
- created_at

A few important details:

• Never use the user's original filename as the storage key. Generate something like users/{userId}/{uuid}.
• Authenticate the user before issuing the upload URL.
• Put a strict size limit and allowed MIME types in your application logic.
• Keep private files in a private bucket.
• Generate short-lived download URLs when users need access.
• Treat signed URLs as bearer tokens; Cloudflare specifically recommends short expirations and notes that anyone possessing one can use it until it expires.
• For large files, use multipart/resumable uploads rather than one enormous PUT.
• Store file metadata/ownership in your database; don't try to make object storage your application database.

What I'd choose

If you're starting from scratch:

Cloudflare R2 + AWS S3 SDK + your own /uploads API.

If you're already using Supabase:

Supabase Storage + Supabase Auth + signed upload URLs.

If you're already an AWS shop:

S3 + presigned URLs.

The key design decision isn't really "which upload API?"—it's direct-to-object-storage uploads using short-lived, server-generated credentials. That's the architecture I'd recommend regardless of which storage provider you choose.

Choosing the best file upload API and storage service depends heavily on your scale, budget, and engineering constraints. For most modern applications, a dedicated object storage provider paired with a direct-to-cloud upload pattern (or a specialized upload API) is the gold standard.

Top Object Storage Services (The Backend)

• Amazon S3 (Simple Storage Service) : The industry gold standard. It offers unmatched reliability, massive ecosystem integration, fine-grained access control (via IAM and presigned URLs), and lifecycle policies. It is the default choice for AWS-hosted apps and widely integrated everywhere else.
• Google Cloud Storage (GCS) : Google's equivalent to S3. Highly performant, excellent global edge caching, strong consistency model, and seamless integration with Google Cloud's data analytics and AI tools.
• Cloudflare R2 : A zero-egress-fee alternative to S3. If your application serves a high volume of downloads or media streaming, R2 can slash your cloud bills significantly because Cloudflare doesn't charge for bandwidth leaving their network.
• Supabase Storage / Firebase Storage : Excellent for early-stage startups, indie hackers, or apps already using these BaaS (Backend-as-a-Service) platforms. They wrap S3-compatible storage with dead-simple client SDKs and row-level security policies out of the box.

Top File Upload APIs & Edge Management (The Frontend/API Layer)

• Uploadthing : A developer-friendly file upload TypeScript library built specifically for modern full-stack frameworks (like Next.js). It handles type-safe backend validation, direct-to-S3 uploads, and client-side progress hooks with minimal boilerplate.
• Uppy / Companion (by Transloadit) : A sleek, modular open-source JavaScript file uploader. It supports resumable uploads (via Tus), webcam access, and fetching files from remote sources (Google Drive, Dropbox, Instagram) straight to your server or storage bucket.
• Transloadit : A heavy-duty uploading and encoding API. If your users are uploading raw videos or massive images that need immediate resizing, watermarking, or transcoding on the fly before hitting storage, Transloadit automates the pipeline.
• Cloudinary : The premier choice if you are dealing heavily with images and video. It doesn't just store files; it provides an incredible API for real-time manipulation, optimization, cropping, and smart delivery via global CDNs.

The Recommended Architecture: Presigned URLs

Instead of routing multi-megabyte or gigabyte files through your own web server (which can choke your Node.js/Python/Go server memory and bandwidth), use Presigned URLs:

1. Your frontend asks your backend API for an upload token/URL.
2. Your backend generates a secure, time-limited Presigned URL directly from AWS S3, GCS, or R2.
3. Your frontend uploads the file directly to the storage bucket using that URL.
4. Your frontend notifies your backend that the upload is complete so you can save the file metadata to your database (SQL or NoSQL).

To help narrow down the best choice, tell me:

• What tech stack are you using (e.g., Next.js, Python/Django, Ruby on Rails, mobile app)?
• What kind of files are users uploading (avatars, multi-GB videos, PDFs)?
• Do you need on-the-fly processing (image resizing, video transcoding)?

For most SaaS/web apps, I’d separate the upload API from the storage layer:

Recommended architecture: your API issues a short-lived signed upload URL → browser/mobile uploads directly to object storage → your API records the object metadata.

That avoids sending potentially huge files through your application servers. Both S3 and R2 explicitly support this presigned-upload pattern.

My default choice

Cloudflare R2 + S3-compatible API is my pick if you're starting fresh.

• Storage:
• Upload API: your own POST /files/upload-url
• Client: PUT directly to the returned presigned URL
• Database: store file_id, owner/user ID, object key, MIME type, size, checksum, status, etc.
• Downloads: issue short-lived signed GET URLs for private files.

R2 supports presigned PUT, GET, HEAD, and DELETE URLs, and lets you constrain things such as Content-Type.

R2 vs. S3

If you're already deeply invested in AWS, I'd simply use S3. Its presigned URLs are a very mature solution and don't require exposing AWS credentials to clients.

What I'd build

Browser
   │
   │ POST /api/files
   ▼
Your API ──────► Database
   │                │
   │ signed URL     │ file metadata
   ▼                │
Object Storage ◄────┘
   ▲
   │ PUT file directly
   │
Browser

Your API might expose:

POST /api/files/upload

Request:

{
  "filename": "resume.pdf",
  "contentType": "application/pdf",
  "size": 183421
}

Response:

{
  "fileId": "file_123",
  "uploadUrl": "https://...",
  "expiresIn": 900
}

Then the client does:

PUT <uploadUrl>
Content-Type: application/pdf

<binary file>

Afterward, either have the client call a complete endpoint or have your backend verify/process the object.

A few important design decisions

Don't let users choose the actual object key. Generate something like:

uploads/{user_id}/{uuid}

rather than:

uploads/{user_id}/{filename}

This prevents collisions and makes authorization much easier.

Also:

• Enforce maximum file size before issuing the upload URL.
• Restrict allowed MIME types/extensions where appropriate.
• Generate your own UUID rather than trusting the filename.
• Keep private files in a private bucket.
• Use short-lived signed URLs, especially for downloads.
• Store metadata in your DB rather than trying to make object storage your application database.
• Consider virus/malware scanning for arbitrary user uploads.
• For large files, use multipart/resumable uploads rather than a single PUT.

One subtle point: a presigned URL is effectively a bearer token while valid, so anyone who obtains it can use the authorized operation. Cloudflare explicitly recommends treating these URLs accordingly.

Bottom line: If you tell me your stack (e.g. Next.js + Postgres, Django, Rails, Go, etc.), expected file sizes/volume, and whether files are private or public, I can recommend the exact upload API + storage setup and SDK.