Storage

Storage keeps files in buckets. You control access with RLS policies on the storage.objects table.

Create a bucket

insert into storage.buckets (id, name, public)
values ('avatars', 'avatars', true);

Upload

const file = event.target.files[0];
const { data, error } = await supabase.storage
  .from("avatars")
  .upload("user-123/avatar.png", file, { upsert: true, contentType: file.type });

Public URL

const { data } = supabase.storage
  .from("avatars")
  .getPublicUrl("user-123/avatar.png");

On-the-fly image transformations (transform: { width, height }) are coming soon. Access over the S3 protocol is already available — see below.

Signed URLs (private buckets)

const { data } = await supabase.storage
  .from("invoices")
  .createSignedUrl("2026/10/INV-001.pdf", 60 * 10); // valid for 10 minutes

Policy: users can only write to their own folder

create policy "Upload to own folder"
on storage.objects for insert to authenticated
with check (
  bucket_id = 'avatars'
  and (storage.foldername(name))[1] = auth.uid()::text
);

Storage in the dashboard

In the project's Storage module you create buckets (public or private, with size and MIME type limits), browse files in folders or as a gallery, drag-and-drop upload files up to 10 MB, preview images, PDFs and text, copy public or signed URLs and delete objects.

Upload limits

• Storage → Settings — the global file size limit for all buckets (50 MB by default). A bucket's own limit can only be lower.
• Send files larger than about 6 MB with a multipart upload: S3 multipart or TUS (resumable uploads in supabase-js).

Vectors

Storage → Vectors creates embedding collections on pgvector: a table with an embedding vector(n) column, JSON metadata, an HNSW index and a match_<name> RPC function for similarity search.

const { data } = await supabase.rpc("match_documents", {
  query_embedding: embedding, // number[] with the collection's dimension
  match_count: 5,
  filter: { lang: "en" },     // metadata match (jsonb @>)
});

S3 protocol

Storage speaks the S3 API — use the aws CLI, rclone, boto3 or the AWS SDK. Access keys are in Storage → S3.

aws s3 ls s3://avatars \
  --endpoint-url https://abcdefghijklmnopqrst.host.ulewicz.space/storage/v1/s3 \
  --region pl-waw-1