Amen Forms
File Upload Storage
guidestorageconfiguration

File Upload Storage

Upload user and workspace images through Amen Core and Cloudflare R2.

Amen Core owns shared file operations. Product consoles never receive R2 credentials and do not upload base64 payloads through a database function.

Upload flow

  1. The console asks Core for a constrained upload ticket.
  2. Core verifies the user, workspace membership, MIME type and size limit.
  3. The browser uploads directly to the signed R2 destination.
  4. The console calls Core’s finalize route.
  5. Core stores the durable object reference and returns its public representation.

The Forms shell uses this flow for account avatars and church logos. Product-owned files should use the same ticket/finalize shape but remain in a product-specific namespace.

Server configuration

R2 secrets belong to Core’s server environment only:

R2_S3_URL=https://ACCOUNT.r2.cloudflarestorage.com
R2_S3_ACCESS_KEY_ID=server-only
R2_S3_SECRET_ACCESS_KEY=server-only
R2_S3_BUCKET_NAME=amen-files
R2_URL=https://files.example.com

No VITE_* variable may contain a storage credential.