Storage on SupaHost

Every SupaHost project runs its own Supabase Storage service. You get the same API as on Supabase Cloud: buckets, folders, uploads, downloads, public URLs, signed URLs and access rules written as Postgres Row Level Security policies. Code that uses supabase.storage works without changes once it points at your project URL.

This page explains how Storage is set up on SupaHost and where it differs from Supabase Cloud. The rest of the section covers each part in detail.

How Storage is set up

Each project's Storage API lives under its project URL:

https://app-one.acme.supahost.space/storage/v1

Two things make up your Storage data:

• File contents are stored on your instance's disk, in a directory that belongs to that project. Nothing is shared with other projects or other customers.
• Metadata (bucket settings, object names, sizes, owners, content types) is stored in the storage schema of the project's Postgres database, in the storage.buckets and storage.objects tables.

Because metadata lives in Postgres, access control is ordinary RLS on storage.objects. You write policies the same way you do for your own tables. See Storage access control.

The instance disk grows automatically as it fills, so you don't need to resize anything when you add files. The file storage quota on your plan is shared by all projects on the instance. See Storage limits and quotas.

What works the same as Supabase Cloud

• Public and private buckets.
• Uploads with upload(), update(), signed upload URLs, and options such as contentType, cacheControl and upsert.
• Downloads, public URLs and signed URLs.
• Listing, moving, copying and removing objects.
• RLS policies on storage.objects, including the helper functions storage.foldername(), storage.filename() and storage.extension().
• The Storage browser in Supabase Studio.

What is different

Public objects are served without an API key, the same as on Cloud. Every other Storage request needs your project's anon key (or a user's access token) in the request, which supabase-js adds for you.

A quick example

This uploads a recipe photo to a public bucket called recipe-photos and gets a URL you can put in an <img> tag.

import { createClient } from '@supabase/supabase-js'

const supabase = createClient(
  process.env.SUPABASE_URL!, // https://app-one.acme.supahost.space
  process.env.SUPABASE_ANON_KEY!
)

export async function saveRecipePhoto(recipeId: string, file: File) {
  const path = `${recipeId}/${crypto.randomUUID()}.jpg`

  const { error } = await supabase.storage
    .from('recipe-photos')
    .upload(path, file, { contentType: file.type, cacheControl: '86400' })

  if (error) throw error

  const { data } = supabase.storage.from('recipe-photos').getPublicUrl(path)
  return data.publicUrl
  // https://app-one.acme.supahost.space/storage/v1/object/public/recipe-photos/<recipeId>/<uuid>.jpg
}

The upload only succeeds if an RLS policy allows the signed-in user to insert into that bucket. A public bucket makes files readable by anyone, but it doesn't let anyone write.

Where to manage files

• Supabase Studio. Open Studio from Dashboard → your project → Database tab → Open Studio (or the Studio button in the project header). Studio's Storage page lets you create buckets, browse folders, upload and delete files, and edit policies. Opening Studio is owner only.
• SQL. Bucket settings and object metadata are rows you can query in Studio's SQL editor, for example select name, metadata->>'size' from storage.objects where bucket_id = 'recipe-photos'. Upload and delete files through the Storage API rather than by editing these tables, so the files on disk stay in step with the rows.
• AI agents over MCP. The SupaHost MCP server has list_storage_buckets and get_storage_config tools in its storage feature group. That group is off by default; list it in the features= parameter of the MCP URL to turn it on. See The SupaHost MCP server.

Backups and exports

Daily backups and point-in-time recovery cover your databases, including the storage schema with bucket and object metadata. The files themselves sit on the instance disk and aren't part of those backups, so a database restore doesn't roll files back.

To keep your own copy of files, use Dashboard → your project → Backups tab → Package files. It builds a .tar.gz of every file in the project along with buckets.json and objects.json (bucket settings and object metadata). Download links last 24 hours. See Exporting your data and Backups.

A branch created with "Copy data, users and files" gets its own copy of the parent's files. A schema-only branch keeps the bucket rows but starts with no objects. See Branching.

Next steps

• Buckets
• Uploading files
• Storage access control
• Serving and downloading files
• Full client reference: supabase-js Storage