Invoices, contracts and records that only their owner may download, some generated by your server and some uploaded by the user, with an ownership check on every read.
Three choices make that work:
* **A private bucket.** There is no public host, so an object cannot be fetched by URL at all.
* **A signed read URL per download.** Your route checks who is asking, then hands out a link that expires in minutes.
* **A row per document.** Your table holds the path, the display name and the owner, and it is the only index. The bucket is never asked what a user owns.
This recipe uses a private bucket. Create it as **private** in the Upstash Console, then follow the [Quickstart](/blob/overall/quickstart) for the token and the SDK.
***
## Files your server creates
A generated PDF is already on your server, so write it with `put`:
```ts lib/invoices.ts theme={"system"}
import "server-only"
import { Bucket } from "@upstash/blob"
import { db } from "./db"
import { renderInvoicePdf } from "./pdf"
const bucket = Bucket.fromEnv()
export async function storeInvoice(invoiceId: string) {
const invoice = await db.invoices.find({ id: invoiceId })
const pdf = await renderInvoicePdf(invoice)
const path = `invoices/${invoice.id}.pdf`
await bucket.put(path, pdf, { contentType: "application/pdf", cache: "no-store" })
await db.documents.upsert({
id: `invoice-${invoice.id}`,
ownerId: invoice.customerId,
name: `Invoice ${invoice.number}.pdf`,
path,
})
}
```
A stable path is right here: regenerating an invoice should replace the old one. On a private bucket `blob.url` is `undefined`, so the path is the only thing worth storing.
***
## Files the user uploads
The same table, filled from a browser upload. The bytes go straight to storage, and the row is written when the upload completes.
```ts lib/uploads.ts theme={"system"}
import "server-only"
import { BlobError, uniquePath, uploadHandler } from "@upstash/blob"
import { getUser } from "./auth"
import { db } from "./db"
export const uploads = uploadHandler({
constraints: { contentTypes: ["application/pdf"], maxSize: "50mb" },
onBeforeUpload: async ({ request, file }) => {
const user = await getUser(request)
if (!user) throw new BlobError("unauthorized")
return {
path: uniquePath`documents/${user.id}/${file.name}`,
cache: "no-store",
metadata: { owner: user.id },
}
},
onUploadComplete: async ({ uploadId, metadata, path, size, file }) => {
try {
// The browser retries this request on a flaky network, so upsert on uploadId.
await db.documents.upsert({
id: uploadId,
ownerId: metadata.owner,
name: file.name,
path,
size,
})
} catch (e) {
// A throw here deletes the object, so make it a deliberate refusal the user can retry from.
console.error("[uploads] could not record", path, e)
throw new BlobError("not_ready", { message: "could not save the document, try again" })
}
return { documentId: uploadId }
},
})
```
`cache: "no-store"` keeps a downloaded document out of the reader's browser cache once the link it came from is dead.
A throw out of `onUploadComplete` deletes the object, so the `catch` turns a database failure into a refusal the user can retry from. `not_ready` is the 503 code, the one that means try again. See [Upload handler](/blob/uploads/upload-handler#onuploadcomplete) and [Errors](/blob/reference/errors#the-codes).
***
## The route
Mount the handler, then bind the hooks to it.
```ts app/api/upload/route.ts theme={"system"}
import { uploads } from "@/lib/uploads"
export const { GET, POST } = uploads
```
```ts lib/upload-hooks.ts theme={"system"}
"use client"
import { uploadHooks } from "@upstash/blob/react"
import type { uploads } from "./uploads"
export const { useUpload } = uploadHooks{upload.error.message}
} {upload?.status === "done" &&Uploaded {upload.file.name}
} ) } ``` *** ## The download route Never put a signed URL in a page. Link to a route of your own, check ownership there, and sign at click time: ```ts app/api/documents/[id]/route.ts theme={"system"} import { Bucket } from "@upstash/blob" import { getUser } from "@/lib/auth" import { db } from "@/lib/db" const bucket = Bucket.fromEnv() export async function GET(request: Request, { params }: { params: Promise<{ id: string }> }) { const user = await getUser(request) if (!user) return new Response("Unauthorized", { status: 401 }) const { id } = await params const doc = await db.documents.find({ id, ownerId: user.id }) if (!doc) return new Response("Not found", { status: 404 }) // not 403: do not confirm it exists const { url } = await bucket.signedReadUrl(doc.path, { expiresIn: "2m", downloadAs: doc.name, }) return Response.redirect(url, 302) } ``` The page reads rows, never the bucket, and links every document to that route: ```tsx components/document-list.tsx theme={"system"} import { db } from "@/lib/db" export async function DocumentList({ userId }: { userId: string }) { const docs = await db.documents.findMany({ ownerId: userId }) return (