Guides
Files
Browser uploads straight to storage, checked after they land.
STORAGE_DRIVER picks local (disk), s3 (AWS and every S3-compatible service: Cloudflare R2, MinIO, Spaces, B2, Google Cloud Storage) or azure.
POST /api/v1/filesrecords the file and returns a short-lived upload URL, bound to the declared type and size.- The browser sends the file straight to storage.
POST /api/v1/files/{id}/completechecks what arrived, and deletes anything that does not match.
Storage keys are built by the API, never from a file name, and downloads are always served as attachments. Allowed types and the size limit are UPLOAD_TYPES and UPLOAD_MAX_MB; HTML and SVG are left out by default because both can carry scripts.