Object storage

You bring the key

Provisore does not create access keys, for any provider. Hetzner has no API for it, since its S3 credentials exist only in its Console. Minting an AWS key would mean Provisore holding a key that can create IAM users, and one leak of that would hand over the account rather than one bucket. R2 tokens carry the same shape of risk.

So you create a key in your provider's console, scoped however you like, and paste it in. It is encrypted at rest, shown back only as its last four characters, and never returned in full to anything, including you. Disconnecting forgets the key and touches nothing in the store. Your buckets and everything in them stay where they are.

Connecting an account

Pick the provider and Provisore fills in the endpoint. For the three named providers you cannot type one. The endpoint is built from the region, or from your Cloudflare account ID, so it cannot be a typo.

Amazon S3           region                    # endpoint: s3.<region>.amazonaws.com
Cloudflare R2       account ID (32 hex)       # endpoint: <account>.r2.cloudflarestorage.com
Hetzner             fsn1 | nbg1 | hel1        # endpoint: <region>.your-objectstorage.com
Other S3-compatible endpoint + region         # your own https endpoint

The region goes into the request signature, so a region that does not match the bucket's is refused as an authentication failure rather than as a wrong region. R2 is always auto, which Cloudflare signs literally.

One connection covers every bucket its key can reach, and belongs to the team rather than to a server. You browse buckets without picking a machine first. Creating or changing a connection needs the admin or owner role, because it is a credential. Provisore stores no list of your buckets or objects. Every screen is read live, so a bucket you made in your provider's console is there.

Uploads and downloads do not pass through Provisore

When you upload, Provisore signs a URL and your browser sends the file straight to your provider. When you download, it signs a URL and your browser goes there. The object bytes never enter the control plane, so transfer speed is between you and your provider, and a multi-gigabyte object is never held in an API process.

A signed URL lasts fifteen minutes by default, an hour at most, and grants one method on one key. Treat it as a credential. Anyone holding it has that access until it expires. Minting one is recorded in the audit log for that reason, even though nothing was read at the time.

This is also why uploads need a CORS rule on the bucket and downloads do not. An upload is a scripted cross-origin request from the app to your provider. A download is a plain navigation, which is not a cross-origin request. The rule must allow PUT and the If-None-Match request header from the app’s origin. Provisore does not set the rule for you, because not every S3-compatible store implements bucket CORS. Set it once in the same console where you made the key.

The app asks before an upload replaces an object it can see in the folder listing. Amazon S3, Cloudflare R2 and Hetzner also refuse the write at the store unless you choose Replace, which catches a name the listing has not loaded. Another S3-compatible store replaces the object, so the listing check is the only warning there.

What it refuses

• A bucket that is not empty is not deleted. S3 refuses it and Provisore passes the refusal through rather than emptying the bucket as a side effect.
• A partly failed batch delete reports as a success, listing the keys your provider refused. The objects that were deleted are gone either way, and calling the whole thing a failure would send you looking for them.
• Folders cannot be selected. Deleting a folder means deleting everything inside it, which is a different question. Select the objects.
• Deleting objects needs the admin or owner role. Creating and deleting buckets does not, because S3 will not delete a non-empty bucket, so the operation cannot lose data by itself.

Nothing here is versioned by Provisore. A deleted object is gone from the store immediately. Whether you can get it back depends on your bucket's own versioning setting.

Limits

• One upload is one request, so the ceiling is your provider's single-request limit, which is 5 GB on AWS S3. There is no multipart upload, and Provisore enforces no size limit of its own, so a file above that ceiling fails at the provider.
• No upload progress bar. A single request reports nothing between sent and answered, so each file shows its state instead.
• A delete carries at most 1000 objects per request, which is the S3 limit.
• No CLI commands, and this is not where your backups are configured. A backup destination is set per server and is a separate credential.