Upload flow

  1. Admin/client POSTs to the management API to register an asset row (filename, mime, size). API returns an HMAC-signed upload token with a bound storage key.

  2. Client PUTs the bytes to /storage/v1/<key>?t=<token>. Storage verifies the HMAC, size and mime, then streams to S3.

  3. Reads go through /storage/v1/<key> (range-supported) or /storage/v1/<key>/m/<transforms> for on-the-fly resize / format conversion.

Image transforms

Append /m/<width>x<height>/<filters> to any asset URL. Results are cacheable at the proxy. Example: /storage/v1/spaces/1/assets/42/photo.jpg/m/800x600/filters:format(webp).