Choose who can download each file

Choose who can open each private file by assigning owner, editor, and viewer roles to Conjoin Auth accounts, organizations, and groups. For anyone outside those roles, you can generate a signed URL with an expiry and a rate limit that you set.

Read documentationView pricing

Give each file its own owners, editors, and viewers

Each object in Storage has an access control list, in which you can give the owner, editor, or viewer role to a Conjoin Auth account, organization, or group. For a person outside your Auth accounts, generate a signed URL with the expiry, the rate limit, and the quota that you choose.

How Storage checks access to each file

Public and private visibility

Mark a container or an object as public so that the CDN serves it to anyone, or as private so that Storage serves it only to an authenticated request or a signed URL.

Role-based access

Assign the owner, editor, or viewer role on each object. Each role includes the one below it, so an editor can download and change the file, while an owner can also manage who has access to it.

Entity-based permissions

Grant access to an account, an organization, or an organization group. Storage resolves each grant through Conjoin Auth, so every member of a granted organization or group holds the role.

Signed URLs

Anyone with a signed URL can download the private file that it points to until the expiry that you set. You can also limit the download speed that Storage allows through the URL.

Rate limiting and quotas

Storage enforces upload rate limits and quotas for each project, along with a quota that you can set on each container.

Expiring access

Give a person access to a file until a time that you set, after which Storage revokes that access.

Container policies

Every new file in a container inherits the default visibility and access policies that you set on that container.

Authorization checks

Storage checks the authorization of every download request before it serves any content and returns 403 to each request that fails the check.

Least privilege
Permission levels

Owner, editor, viewer

User or group
Access targets

Accounts, orgs, groups

100%
Request validation

Every access checked

Build faster with solutions designed for real-world needs

Give each person on a project the owner, editor, or viewer role

Assign the owner, editor, or viewer role on an object to each account that works on it. Because each role covers a fixed set of actions, a project lead, a contributor, and a client reviewer can each hold the role that matches their work.

Impact

The RolesForm in the sample lists every account on a Pinemark mix with its current role and saves the changes through one grantObjectAcl call. Storage enforces the new roles on the mix from the next request onward.

Prompt for a coding agent: Let the owner set each person's role on a mix to owner, editor, or viewer.

Conjoin IDE

Select a file to view its contents

Share a file with a whole team in one API call

When you grant a role to an organization or an organization group, Storage checks membership in Conjoin Auth on each request, so every current member holds that role.

Impact

The sample gives Veldspar's engineering group the editor role and a reviewer organization the viewer role on one assembly spec, both in a single grantObjectAcl call. An engineer who joins the group later can edit the spec with no new grant.

Prompt for a coding agent: Give the engineering group editor access and the reviewers viewer access to this spec.

Conjoin IDE

Select a file to view its contents

Throttle download speed with rate-limited signed URLs

When you generate a signed URL, you can set a download rate limit, which Storage applies to every download through that URL.

Impact

When a large file has many downloads open at once, each download can proceed only at the rate on its URL. The bandwidth for that file can therefore rise no higher than the rate multiplied by the number of open downloads.

Cap storage per project with hard quotas

Set a quota on each container to cap the storage that a project uses. Storage also rate-limits uploads, which slows a flood of requests from a single client.

Impact

Once a container reaches its quota, Storage rejects further uploads to it, so one user or one faulty integration can add data only up to that cap.

Build your next app on Conjoin

Conjoin will open with a free Build tier, while the pricing page already lists the launch prices for Pro and Business. If you tell us what you're building, we'll talk you through early access.

See pricingGet early access