Crate
Ein Speicher für die Dateien Ihrer Anwendungen: ein Schlüssel je Anwendung, kurze Adressen, drei Zugriffsstufen und signierte Links, Vorschaubilder, Webhooks, Papierkorb und Zugriffsprotokoll.
One store for the files of your applications
Crate is the central store that the applications a team runs turn to when they need to keep and serve a file. Each application connects with its own key and uploads the file to a single endpoint; Crate keeps the file on its own disk, gives it a short address that reveals nothing about where it sits, checks access against your rules and records every access.
The product came out of our own need. In a team running dozens of applications, every product carries its own upload code, its own folder layout and its own access rule; a thumbnail is produced separately in five places, a deleted file never comes back, and nobody knows who looked at which file when. Crate was written to gather that work in one place; today the files of the applications in the family live here.
As a deliberate product decision, files are kept in Crate's own storage rather than in a third-party object store; there is no separate storage account to open or configure. Storing files needs no account, the application's key is enough; entering the panel uses a Vosetu Passport account.
- A key per application; development, test and production environments kept apart
- A short address: renewing it invalidates the old one instantly
- Three access levels: public, private, secure; time-limited signed links
- Thumbnails, webhooks, trash and recovery, access log
The screens of the panel
Applications upload, the team manages from the panel. Keys are generated here, environment limits are drawn here, files are browsed here, and what was deleted by mistake comes back from here.
Applications
Registered applications, their names and keys; renewing a key affects one application independently; last use date and address recorded.
Environments
Development, test and production run apart; storage quota, upload size, allowed extensions, signed-link lifetime, thumbnail widths, webhook address and versioning per environment.
Keys
Read or write keys; an application carries several keys at once so a key is rotated without downtime; expiring or permanent.
File browser
The files of every application on one screen; filters by application, environment, access level, reference and date; image preview without leaving the list.
Access log
Every read and write recorded: requesting application, action and address. Read-only; filterable to failed attempts.
Trash
A removed file waits in the trash for a period set per environment; recovery returns it exactly where it was; immediate permanent deletion is also possible.
Home dashboard
Application and environment counts, total files, quota usage, daily uploads and downloads of recent weeks, latest failed requests.
Integration
Ready request examples for upload, download, signed links, address renewal and image derivatives; personal API tokens.
The heart of the flow
The journey of a file
The application is registered in the panel, its environment chosen, its key generated. The upload request is identified by the key; the file arrives as a multipart form or a text body. Crate first checks the environment's limits: size, quota, allowed extensions, and whether the file's actual content matches its extension. Formats that can carry active content are rejected regardless of extension. An accepted file is written to its own disk and the short address returns in the response. Uploading again with the same file key updates the file in place; if overwriting is switched off, an error returns instead of a silent replacement.
- Size, quota and extension limits per environment; content checked from the actual bytes
- Overwrite by default; an error when it is switched off
- With versioning on, a replaced file is kept and can be restored
- Signed upload: the browser uploads directly without seeing the key
Address and access
Every file gets an address made of a short token and its own extension; the address carries no folder name or internal structure and stays the same even if the file changes later. For applications that prefer to see structure there is also a path-based address built from named segments; the two forms work side by side. If an address was shared more widely than intended it is renewed without touching the file, and the old one stops resolving instantly. The access level travels with the file and is decided again on every request: a public file opens for anyone with the address, a private or secure file is served only with the application's key or a signed link that expires. A secure file is downloaded rather than opened in the browser and gets the shortest-lived link.
- Short address or path-based address; both side by side
- Address renewal only with a write key; the old one drops permanently
- Access decided on every request, not only at upload
- Signed link: limited time without the key; the duration is capped
Images and distribution
A smaller version of an image is prepared alongside the original at the widths allowed for the environment; width, height, format and quality are requested through the address, and if the format is left empty it is chosen to match the visitor's browser. A size not on the list is rejected, so derivatives never escape control. When a file is uploaded, replaced, deleted, restored or its address renewed, a signed notification goes to the environment's webhook address; if the receiver does not respond, delivery is retried a few times.
- Thumbnails only at allowed widths; images only
- Format explicit or automatic by browser
- One webhook address per environment covers every file event
- Signed notification: the source is verified to be Crate
Deletion, recovery and the trail
Deletion has three separate verbs. A removed file first goes to the trash and waits there for the period set for the environment; recovery returns it exactly where it was. An application can instead ask for immediate permanent removal. Emptying the trash deletes only what is filtered at that moment, never everything at once. All of this, and every read, lands in a read-only access log: the requesting application, the action, the address and the outcome. Nothing here can be edited or deleted; to see what was refused and why, filter down to failed attempts.
- Move to trash, delete permanently, empty trash: three separate verbs
- Waiting period per environment
- Read-only access log; filter to failures
- Personal API tokens for scripting against the management screens
The capability catalogue
- A single upload endpoint, one key per application
- Multipart form or text body
- Overwrite on / off
- Versioning: a replaced file is kept and restored
- Signed upload: straight from the browser
- Size, quota, extension and content checks
- Application registration: name, description
- Development / test / production environments
- Quota, size limit, allowed extensions per environment
- Read and write keys; expiring or permanent
- Key rotation without downtime
- Last use date and address of a key
- Short (opaque) address
- Path-based address; form chosen per environment
- Address renewal: the old one invalid instantly
- Extension mismatch rejected
- Public / private / secure
- Access decided on every request
- Time-limited signed links; capped
- A secure file is downloaded, not opened in the browser
- The key never reaches the browser
- Thumbnails: allowed widths, format, quality
- Automatic format by browser
- Webhooks: upload, delete, restore, purge, address renewal
- Signed notification and retries
- File browser: filters, preview, detail
- Reference and labels
- Read-only access log
- Trash, recovery, permanent delete, empty trash
- Home dashboard: quota, files, daily uploads / downloads
- Personal API tokens
- Brands and branches
- Module market
- Subscription status and quotas
- Sign-in with Vosetu Passport; no local password
- Turkish and English
Setup and packages
Crate runs in the cloud on a subscription: the panel and the store are with us, your applications only upload and read with their keys. Connecting an application installs nothing on your server and opens no separate storage account; it is called with a plain HTTP request from any language. To show a file to a visitor the key is never handed to the browser; either a public address or a signed link produced on the application's own server is used.
Packages scale with how many applications you connect and how much storage and how many files you use; applications beyond the included number are added for a monthly fee. The entry package covers the upload endpoint, short addresses, the three access levels, address renewal and the access log; the team package adds webhooks, thumbnails and trash with recovery; the enterprise package comes with a wider quota. Every package starts with a free trial that asks for no card; the current list and prices are on the product's own pricing page.
When the quota is full, new uploads are rejected until the package is upgraded; existing files stay accessible. If something goes wrong on the billing side the service does not cut itself off: the files your applications serve keep being served.
- Cloud subscription; nothing to install and no separate storage account
- Packages by applications, storage and file count
- Free trial without a card
- Uploads stop when the quota is full, existing files keep being served
Your first file in five steps
1 · Register the application
Sign in to the panel with Passport, enter the application's name; pick its environment and generate a write key.
2 · Draw the environment's limits
Set the storage quota, upload size, allowed extensions, signed-link lifetime and thumbnail widths.
3 · Upload the first file
Call the upload endpoint from the application with the key header; the short address in the response is the way to reach the file.
4 · Set up access
Serve public files by address; for private and secure files produce signed links on your application's server.
5 · Connect distribution
Enter the webhook address so other systems hear file events; request thumbnails for images using the allowed widths.
Technology
- .NET 9 Web API
- PostgreSQL as index only; files on its own disk
- Cached download path
- Background jobs: trash cleanup, maintenance, webhook delivery
- Upload and read from any language over plain HTTP
- Application key header
- Signed links and signed upload
- Personal API tokens
- Angular 20
- Turkish and English, light / dark theme
- Docker containers, continuous delivery with Jenkins
- Passport single sign-on
- Subscription and quotas from the central subscription service
A file store is doing its job when the application can answer 'who opened this file, when and with which address'. That is why Crate decides access again on every request and records every request.
Frequently asked
What is Crate and what is it for?
Crate is a file store that gathers the file keeping and serving of many applications into one centre. Applications upload to a single endpoint with their own keys; Crate keeps the file on its own disk, gives it a short address, checks access on every request by its public, private or secure level, prepares thumbnails, reports file events through webhooks and records every access.
Where are the files kept?
In Crate's own storage, on its own disk. No third-party object storage service is used; there is no separate account to open or configure. The database serves only as an index.
How do I connect my application to Crate?
You register the application in the panel, choose its environment and generate its key. The application calls the upload endpoint with an HTTP request carrying that key as a header; the language does not matter and no extra library is needed. The panel has ready request examples for upload, download, signed links and address renewal.
How do I decide who can open a file?
You choose the access level when uploading and can change it later. A public file opens for anyone with the address. A private or secure file is served only to a request carrying the application's key or to a signed link that expires; a secure file is downloaded rather than opened in the browser and gets the shortest-lived link. The decision is made again on every request.
What do I do if an address was shared with the wrong people?
You renew the address. The file is neither moved nor re-uploaded; the moment the new address is issued the old one stops resolving and never comes back. Only a key with write permission can renew.
Does a file deleted by mistake come back?
Yes. A removed file first goes to the trash and waits there for the period set for the environment; recovery returns it exactly where it was, with the same address. An application can instead have a file deleted permanently at once; then it does not come back.
How are thumbnails produced?
You define the widths allowed for the environment; the application requests a smaller version by adding a width, an optional height, format and quality to the image's address. If the format is left empty it is chosen to match the visitor's browser. A size not on the list is rejected; it applies to images only, other files are served as uploaded.
What happens when the quota is full?
New uploads are rejected until the package is upgraded; existing files stay accessible and keep being served. The state shows on the subscription screen. If something goes temporarily wrong on the billing side the service does not cut itself off.
Move your files into one store
Tell us how many applications you have and where the files live today; we will connect the first application together and set up environment limits and access levels around your routine. You will be talking to the team that wrote the product, not a sales team.
Machen wir heute den ersten Schritt
Beschreiben Sie Ihren Bedarf in einer Nachricht; wir melden uns innerhalb von 24 Stunden.