Documentation File storage

File storage

CloudCode doesn't provide file storage for your app's users. Use Supabase Storage in your own project, with public buckets for files anyone can fetch by URL and private buckets that need a signed URL or an authenticated download. Static assets such as logos and icons can simply live in your project: upload them in the file explorer, and the dev preview inlines project images automatically.

Create a bucket

Create it in the Supabase dashboard (Storage), or ask the agent for a migration that inserts into storage.buckets and apply it as in Database.

Upload a file

Use the storage client from your app code.

Retrieve the URL

Public buckets give you a permanent public URL. Private buckets need createSignedUrl or download.

Set access policies

Write RLS policies on storage.objects to control who can upload, read and delete files.

typescript

import { supabase } from "@/lib/supabase";

// Upload a file
const { data, error } = await supabase.storage
  .from("avatars")
  .upload(`${userId}/avatar.png`, file, { upsert: true });

// Get the public URL
const { data: { publicUrl } } = supabase.storage
  .from("avatars")
  .getPublicUrl(`${userId}/avatar.png`);

// Download a file (private bucket)
const { data: blob } = await supabase.storage
  .from("documents")
  .download(`${userId}/report.pdf`);

Warning

Don't store sensitive files in public buckets. For user content that shouldn't be public, use private buckets with signed URLs.