File uploads that never touch your app server
FileUploadServices receives bytes directly from the client over a single-use, cryptographically signed ticket — HMAC handshake, RS256 JWT, per-tenant isolation, and automatic image variants out of the box.
HMAC handshake
Every upload is authorized server-to-server with a sha256 HMAC ticket and a 300s replay window.
RS256 JWT
Single-use, hand-rolled RS256 tokens carry the upload_id claim and reject alg=none outright.
Multi-tenant
Each request is scoped by X-Project-Slug with per-project secrets, keys, and disk routing.
Image variants
Thumbnails and resizes are generated asynchronously on a dedicated Horizon queue.
Direct to storage
Bytes stream straight to DO Spaces (or local fallback) — your orchestrator never proxies them.
Signed URLs
Private-by-default storage with short-lived, Redis-cached signed URLs for every read.