> ## Documentation Index
> Fetch the complete documentation index at: https://archie.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# File Manager

> Connect your project to a cloud storage provider — S3, Google Cloud Storage, Azure Blob, or Filestack — to serve uploads and assets.

The File Manager is where you connect your project to a cloud storage provider. Pick a provider, paste in credentials, and the [REST file endpoints](/features/backend/rest-api-explorer/file-management) and the [Assets feature](/features/assets/overview) start using it as their backing store. No new code on your end.

To open it, navigate to **App Services → File Manager** in the Backend Console.

<img src="https://mintcdn.com/archie-e998dbf6/Qol4EJyOu33nszYZ/features/backend/app-services/file-manager-overview.png?fit=max&auto=format&n=Qol4EJyOu33nszYZ&q=85&s=807a5f625116190e996e9c0151060b2d" alt="File Manager overview and storage options" width="1866" height="1022" data-path="features/backend/app-services/file-manager-overview.png" />

## Per-environment configuration

File storage providers are scoped per environment. Each [environment](/features/backend/environments/overview) has its own set of configured providers — useful for keeping `dev` uploads in a separate bucket from `production`.

When you branch a new environment, you can optionally tick **File storage providers** in the branching modal to copy the configuration. Each copy gets a new unique identifier so it can be edited independently.

## Supported providers

<CardGroup cols={2}>
  <Card title="Amazon S3" icon="aws">
    Connect an AWS S3 bucket via Access Key ID and Secret Access Key.
  </Card>

  <Card title="Google Cloud Storage" icon="google">
    Connect a GCP bucket via a service account credentials JSON.
  </Card>

  <Card title="Azure Blob Storage" icon="microsoft">
    Connect an Azure Storage container via account name and access key.
  </Card>

  <Card title="Filestack" icon="paperclip">
    Connect a Filestack bucket via the API key from your Filestack dashboard.
  </Card>
</CardGroup>

To configure a provider, click **Configure** next to it and fill in the credentials. The provider becomes available immediately to the file endpoints.

### Amazon S3

| Field                 | What goes in it                                                           |
| --------------------- | ------------------------------------------------------------------------- |
| **Bucket Name**       | Exact name of the S3 bucket where files will be stored.                   |
| **Access Key ID**     | Public identifier for the AWS IAM user authorized to write to the bucket. |
| **Secret Access Key** | Private key paired with the Access Key ID. Stored encrypted.              |
| **Region**            | AWS region code where the bucket lives (e.g., `us-east-1`).               |

<img src="https://mintcdn.com/archie-e998dbf6/Qol4EJyOu33nszYZ/features/backend/app-services/file-manager-amazon-s3.png?fit=max&auto=format&n=Qol4EJyOu33nszYZ&q=85&s=61c92a20dc21c56e50bbe158d38873de" alt="Amazon S3 configuration" width="591" height="921" data-path="features/backend/app-services/file-manager-amazon-s3.png" />

### Google Cloud Storage

| Field                | What goes in it                                                 |
| -------------------- | --------------------------------------------------------------- |
| **Bucket Name**      | Name of the bucket created in your GCP console.                 |
| **Project ID**       | Unique identifier of the GCP project.                           |
| **Credentials JSON** | Complete contents of the service account credentials JSON file. |

<img src="https://mintcdn.com/archie-e998dbf6/Qol4EJyOu33nszYZ/features/backend/app-services/file-manager-google-cloud-storage.png?fit=max&auto=format&n=Qol4EJyOu33nszYZ&q=85&s=5c30c135e7aa4737dfd4c61c952d9a4d" alt="Google Cloud Storage configuration" width="591" height="912" data-path="features/backend/app-services/file-manager-google-cloud-storage.png" />

The service account needs the **Storage Object Admin** role on the bucket — enough to create, read, and delete objects but not to manage the bucket itself.

### Azure Blob Storage

| Field              | What goes in it                                         |
| ------------------ | ------------------------------------------------------- |
| **Container Name** | Name of the container within your storage account.      |
| **Account Name**   | Name of the Azure Storage Account.                      |
| **Access Key**     | Storage account access key for authenticating requests. |

<img src="https://mintcdn.com/archie-e998dbf6/Qol4EJyOu33nszYZ/features/backend/app-services/file-manager-azure-blob-storage.png?fit=max&auto=format&n=Qol4EJyOu33nszYZ&q=85&s=cececf38faf80cd2f544a922a5144c32" alt="Azure Blob Storage configuration" width="592" height="815" data-path="features/backend/app-services/file-manager-azure-blob-storage.png" />

### Filestack

| Field           | What goes in it                                                    |
| --------------- | ------------------------------------------------------------------ |
| **Bucket Name** | Name of the bucket associated with your Filestack storage backend. |
| **API Key**     | Filestack API Key from your Filestack dashboard.                   |

<img src="https://mintcdn.com/archie-e998dbf6/Qol4EJyOu33nszYZ/features/backend/app-services/file-manager-filestack.png?fit=max&auto=format&n=Qol4EJyOu33nszYZ&q=85&s=f6eb27838ca5c4aa8ad5e93df12e6b9d" alt="Filestack configuration" width="590" height="827" data-path="features/backend/app-services/file-manager-filestack.png" />

## Uploading and retrieving files

The configured provider backs the standard file endpoints. You don't call the storage provider directly — Archie handles signing, validation, and access control.

* **REST:** `POST /api/rest/files`, `GET /api/rest/files/{id}`, `DELETE /api/rest/files/{id}`. Full reference at [REST → File management](/features/backend/rest-api-explorer/file-management).
* **Records:** Store the returned `fileId` on a record (typically in a JSONB or text field) and re-issue the signed download URL when you need to serve the file.
* **Assets:** Files appear in the [Assets](/features/assets/overview) section of the project, browseable through the dashboard.

## Supported MIME types

The upload endpoint accepts a broad allowlist by prefix:

| Category  | Examples                                                       |
| --------- | -------------------------------------------------------------- |
| Images    | All `image/*` (jpeg, png, gif, webp, svg+xml, bmp, tiff, avif) |
| Video     | All `video/*` (mp4, webm, quicktime)                           |
| Audio     | All `audio/*` (mpeg, wav, ogg)                                 |
| Text      | All `text/*` (plain, csv, html, xml)                           |
| Documents | `application/pdf`, MS Office, OpenXML formats                  |
| Archives  | `application/zip`, `application/gzip`, `application/x-tar`     |
| Data      | `application/json`, `application/xml`                          |
| Generic   | `application/octet-stream`                                     |

Unsupported types return `422 Unprocessable Entity` from the upload endpoint.

## Permissions

Who can upload, list, download, and delete files is governed in [Role-Based Access](/features/backend/app-services/role-based-access) like every other endpoint. For per-record file access (a user can only download files attached to records they own), reference the file from a Data Model record and govern access through that table's permissions.

## FAQ

<AccordionGroup>
  <Accordion title="Can I configure more than one provider at the same time?">
    Yes — every supported provider can be configured concurrently. When uploading, you select the target provider via the `providerType` form field. Useful for migrations or tiered storage (hot in S3, cold in Glacier-backed S3, archived in another bucket).
  </Accordion>

  <Accordion title="Are credentials copied when I branch an environment?">
    Only if you explicitly tick **File storage providers** in the branching modal. The copy gets a new ID, so future edits don't propagate back. Branching never copies authentication-provider secrets — those stay env-specific by design.
  </Accordion>

  <Accordion title="What happens to existing files if I switch providers?">
    They stay in the old provider until you migrate them. Archie tracks the provider per file, so old uploads keep resolving to their original bucket. Run a migration script if you want to consolidate.
  </Accordion>

  <Accordion title="What's the maximum upload size?">
    Enforced at the gateway. Exceeding it returns `413 Payload Too Large`. For very large files, use a direct-to-storage upload pattern through your provider's SDK and store only the resulting object key in Archie.
  </Accordion>

  <Accordion title="How do I attach a file to a record?">
    Upload the file to get a `fileId`, then store that `fileId` on a JSONB or text field on the record. Re-issue the signed URL through the download endpoint when you need to serve it. See [REST → File management](/features/backend/rest-api-explorer/file-management).
  </Accordion>
</AccordionGroup>
