FileNest/Docs

Bring Your Own Bucket (BYOB)

BYOB lets you connect your own storage backend to a FileNest project. FileNest stores credentials encrypted in its database and uses them to upload, download, and manage objects in your bucket.

Supported BYOB providers

ProviderCredentials needed
AWS S3Access key ID, secret access key, bucket, region
Azure Blob StorageAccount name, account key, container name
Google Cloud StorageService account JSON, bucket name
Cloudflare R2Access key ID, secret access key, account endpoint, bucket
MinIOAccess key ID, secret access key, endpoint URL, bucket
RustFSAccess key ID, secret access key, endpoint URL, bucket

Setup flow

  1. Create a project with storage_mode: "byob" and the desired storage_provider
  2. Save credentials via PATCH /v1/projects/{id}/storage
  3. Verify connectivity via POST /v1/projects/{id}/storage/verify
  4. Start uploading files — FileNest routes all I/O through your bucket

Saving credentials

curl -X PATCH https://filenest.drgodly.com/v1/projects/{id}/storage \
  -H "Authorization: Bearer fn_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "s3",
    "storage_mode": "byob",
    "bucket_name": "my-company-files",
    "region": "us-east-1",
    "access_key_id": "AKIA...",
    "secret_access_key": "..."
  }'

Credential encryption

Credentials are encrypted with AES-256-GCM before being stored. The plaintext is never written to disk or logs. Only FileNest's API processes can decrypt credentials at runtime.

The GET /v1/projects/{id}/storage endpoint returns non-sensitive fields only (mode, provider, bucket_name, region, endpoint_url). Credentials are never returned after being saved.

Verify connectivity

After saving credentials, run a connectivity test. FileNest writes and immediately deletes a probe object to confirm read/write access:

curl -X POST https://filenest.drgodly.com/v1/projects/{id}/storage/verify \
  -H "Authorization: Bearer fn_live_..."
{ "ok": true, "latency_ms": 87 }

If verification fails, check that the IAM policy on your credentials allows s3:PutObject, s3:GetObject, and s3:DeleteObject on the target bucket.