Direct upload

A direct upload sends a file straight from the browser or client to storage, bypassing your application server. The backend issues a presigned URL, then the client PUTs the bytes to it. This avoids proxying large files through your server, cutting load, memory use, and latency.

In the naive approach, an upload travels twice: client → your server → storage. Your server has to buffer or stream the whole file, which burns memory and request time and makes large uploads a scaling headache. Direct upload removes the middle hop.

The flow is: (1) the client asks your API for permission, (2) your backend mints a presigned URL scoped to a single object and method, (3) the client PUTs the bytes straight to storage, and (4) the client (or a webhook) tells your backend the upload finished so it can record metadata. Your server only ever handles small JSON, never the file itself.

The two things to get right are CORS (so the browser is allowed to PUT cross-origin) and a finalize/confirm step (so your database knows the object now exists).

// 1. ask your API for a URL, then PUT the file straight to storage
const { url } = await api.getUploadUrl(file.name);
await fetch(url, { method: "PUT", body: file });

Related terms

Presigned URL

A presigned URL is a temporary, signed link that grants time-limited permission to upload or download a specific object in cloud storage without exposing account credentials. The signature encodes the allowed operation, object key, and an expiry, so whoever holds the URL can perform exactly that action until it expires.

Multipart upload

Multipart upload splits a large file into smaller parts that are uploaded independently — often in parallel — then reassembled into one object on the server. It improves throughput, survives flaky networks by retrying only failed parts, and is the standard way to move large files into object storage reliably.

CORS

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls whether a web page on one origin may request resources from another. The server returns Access-Control-Allow-Origin and related headers; if they don't permit the requesting origin, the browser blocks the response. It governs cross-domain fetch, XHR, and direct uploads.

Signed URL

A signed URL is a web address with a cryptographic signature and expiry appended as query parameters, granting temporary access to a private resource. Servers and CDNs validate the signature before serving the file, so the link works only until it expires and cannot be altered without breaking the signature.

How files.link fits in

The files.link upload flow is direct by design: request a URL, PUT the bytes, then confirm — your server never proxies the file. a direct image upload API.

Get started

← Back to the glossary