Storage gateway
Presigned uploads, and public files on your own domain.
Clients get short-lived signed URLs instead of credentials. Objects that should be public are served from a domain you own, route by route, with the provider's host and signature never leaving the gateway.
Start free trial
14 days, no card
A path decides the bucket. A rule decides who may read it.
Routing rules map a prefix to a bucket on a provider, with a fallback each. Public delivery is a property of the rule, so the public surface is exactly the prefixes you marked and nothing else.
The same key also reaches the AI gateway and the push gateway. See what each plan includes.
storage routingexample
gateway
- images/*→Cloudflare R2public
- video/*→AWS S3public
- documents/*→Backblaze B2presigned
14 days agotoday
Cloudflare R254%
AWS S331%
Backblaze B215%
What the storage gateway does
- Presigned uploads
- A client asks the gateway for a URL and uploads straight to the provider. The provider's host, bucket and signature never reach the device, and the URL expires on the schedule you set.
- Routing rules per path
- A path prefix decides which bucket an object belongs to, with a fallback per rule. Moving a prefix to another provider is a rule change, not a migration in your code.
- Public delivery, off by default
- A path is served publicly only once its rule says so. Everything else answers 404 whether or not the object exists, so nothing leaks because a key was guessable.
- Your own domain
- Every account is served at its own address from signup, and a hostname you own can be pointed at the gateway with a CNAME. Object paths are identical either way, so moving between them breaks no URL.
- Buckets managed from the dashboard
- Buckets are listed from the provider, registered, and created without leaving the gateway, with credentials encrypted at rest.
- Costed per bucket, per day
- Storage and operations are counted per bucket and per day, so a bill is traceable to a prefix rather than to a provider total.
Asking for an upload URL
curl -X POST "$PENSTOKE_URL/storage/v1/presign" \
-H "Authorization: Bearer $PENSTOKE_KEY" \
-d '{
"path": "images/cover.jpg",
"method": "PUT",
"contentType": "image/jpeg",
"sizeBytes": 184320
}'
# → { "url": "…", "expiresAt": "…" }
# The client PUTs to that URL. The provider host and signature stay here.Storage gateway questions
- What is a storage gateway?
- A storage gateway is one API in front of several object-storage providers. Applications ask it for upload URLs and read paths instead of holding bucket credentials; the gateway decides which bucket a path belongs to, signs the request with keys kept on the server, and serves whatever you have marked public.
- Which storage providers does Penstoke support?
- Cloudflare R2, AWS S3, Google Cloud Storage, Supabase Storage, MinIO, Backblaze B2, Cloudinary, and any S3-compatible endpoint. Each is registered once with its credentials encrypted at rest, and routing rules decide which paths live where.
- How do presigned uploads work?
- Your server asks POST /storage/v1/presign for a path, a method, a content type and a size. The gateway returns a short-lived URL the client uploads to directly. Content type and length are signed into the URL, so an upload that does not match is rejected by the provider, and no credential ever reaches the device.
- Can I serve public files from my own domain?
- Yes. Point a hostname you own at the gateway with a CNAME, or use the address every account gets at signup. Only paths whose routing rule has public delivery turned on are served, the provider's host and signature stay on the server, and the certificate is issued automatically.
- Does Penstoke charge for storage or bandwidth?
- No. The buckets are yours, on your provider accounts, and that provider bills you. The subscription caps how many providers, buckets and indexed objects you keep configured, not how much you store or serve.