Serving assets from Storage

Public buckets

As mentioned in the Buckets Fundamentals all files uploaded in a public bucket are publicly accessible and benefit a high CDN cache HIT ratio.

You can access them by using this conventional URL:

1
https://[project_id].supabase.co/storage/v1/object/public/[bucket]/[asset-name]

You can also use the Supabase SDK getPublicUrl to generate this URL for you

1
const { data } = supabase.storage.from('bucket').getPublicUrl('filePath.jpg')
2
3
console.log(data.publicUrl)

Downloading

If you want the browser to start an automatic download of the asset instead of trying serving it, you can add the ?download query string parameter.

By default it will use the asset name to save the file on disk. You can optionally pass a custom name to the download parameter as following: ?download=customname.jpg

Programmatic downloads with query parameters

When using the SDK's download() method, you can pass additional query parameters to customize the download behavior:

1
import { createClient } from '@supabase/supabase-js'
2
3
const supabase = createClient('your_project_url', 'your_supabase_api_key')
4
5
// ---cut---
6
// Download with custom filename
7
const { data, error } = await supabase.storage.from('avatars').download('avatar1.png', {
8
  download: 'my-custom-name.png',
9
})

1
// Download with additional query parameters
2
final response = await supabase.storage
3
  .from('avatars')
4
  .download(
5
    'avatar1.png',
6
    queryParams: {
7
      'download': 'my-custom-name.png',
8
    },
9
  );

1
// Download with additional query parameters
2
let response = try await supabase.storage
3
  .from("avatars")
4
  .download(
5
    path: "avatar1.png",
6
    queryItems: [
7
      URLQueryItem(name: "download", value: "my-custom-name.png")
8
    ]
9
  )

Private buckets

Assets stored in a non-public bucket are considered private and are not accessible via a public URL like the public buckets.

You can access them only by:

• Signing a time limited URL on the Server, for example with Edge Functions.
• with a GET request the URL https://[project_id].supabase.co/storage/v1/object/authenticated/[bucket]/[asset-name] and the user Authorization header

Signing URLs

You can sign a time-limited URL that you can share with your users by invoking the createSignedUrl method on the SDK.

1
const { data, error } = await supabase.storage
2
  .from('bucket')
3
  .createSignedUrl('private-document.pdf', 3600)
4
5
if (data) {
6
  console.log(data.signedUrl)
7
}

Revoke signed URLs

To revoke all signed URLs, rotate your project's URL signing key, and then revoke the previous key. For more information, see URL Signing Keys.