Buckets and policies

Buckets

Create buckets on the Storage page in the console. From your own server or scripts, a project developer can also create them with the SDK and a console access token:

import { createVaifClient } from "@vaifstudio/client";

const admin = createVaifClient({
  baseUrl: "https://api.vaif.studio",
  projectId: process.env.VAIF_PROJECT_ID,
  accessToken: process.env.VAIF_ACCESS_TOKEN, // a console access token, server only
});

const bucket = await admin.storage.createBucket("avatars", {
  isPublic: true,
  allowedMimeTypes: ["image/png", "image/jpeg", "image/webp"],
  maxFileSize: 5 * 1024 * 1024,
});

const all = await admin.storage.listBuckets();
console.log(bucket.name, all.length);

Setting	Effect
isPublic	A public bucket serves files at a plain URL (getPublicUrl). A private bucket needs a signed URL
allowedMimeTypes	Uploads of other content types are refused
maxFileSize	Uploads larger than this many bytes are refused

Policies

A policy decides who may do one thing in one bucket. A bucket can have several. Manage them on Storage > Policies in the console, where Test access also runs a bucket’s rules against a sample request without reading or writing a file.

Each policy has:

Field	Values
Operation	SELECT (download), INSERT (upload), UPDATE or DELETE. Choosing ALL creates one policy for each operation
Who	Anyone (anonymous), any signed-in user (authenticated), the file’s owner (owner), or users with a given role (role)
Path prefix	Optional. The policy covers only keys under this prefix, such as public/
Content type	Optional. A pattern such as image/*
Maximum size	Optional. A limit for each file, in bytes

For example, to let signed-in users upload images of up to 2 MB under uploads/, create an INSERT policy for authenticated users with the path prefix uploads/, the content type image/* and a maximum size of 2000000.

A role policy matches a user whose access token carries that role claim.

Policies can also be managed over the REST API under /storage/buckets/{bucketId}/policies, with the same fields; see the REST API.

Limits

Total storage for each project, and the other storage limits, depend on the plan. See Plans.