Storage documentation

01 · QUICKSTART

Prepare your first upload

Once Pipe confirms upload access, connect your wallet and sign in to the storage workspace. Add credit, wait for payment confirmation, then create an S3 key. Use the HTTPS gateway supplied by Pipe in place of the endpoint placeholder below. Your client must use path-style addressing, and your key must allow the bucket you choose.

AWS CLI

export PIPE_STORAGE_ENDPOINT='<your-storage-endpoint>'
export AWS_ACCESS_KEY_ID='<access key>'
export AWS_SECRET_ACCESS_KEY='<secret shown once>'
export AWS_DEFAULT_REGION=us-east-1
export AWS_REQUEST_CHECKSUM_CALCULATION=when_required
export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required

aws --endpoint-url "$PIPE_STORAGE_ENDPOINT" \
  s3api create-bucket --bucket example
aws --endpoint-url "$PIPE_STORAGE_ENDPOINT" \
  s3 cp ./photo.jpg s3://example/photo.jpg
aws --endpoint-url "$PIPE_STORAGE_ENDPOINT" \
  s3 cp s3://example/photo.jpg ./download.jpg

02 · BILLING

How prepaid USDC credit works

Confirm upload access with Pipe before purchasing credit. Storage credit is purchased with Circle USDC on Solana. Your wallet approves the amount shown at checkout. Once payment is confirmed and credit appears in your account, you can create an S3 key.

Open Billing for current service rates, available top-up amounts, and payment history. The dashboard shows available, spent, and reserved credit. If a payment is interrupted, return to Billing to resume or check its status before starting another.

03 · ACCESS

Scope every S3 key

Creating an S3 key requires purchased storage credit. After Pipe confirms upload access, sign in with your wallet and fund your account. You can then create a key for your wallet or a linked storage identity and limit it to specific buckets and an optional object prefix.

Open the S3 API keys panel after credit appears in your account and choose Create API key. The panel also lets you rotate or revoke existing keys. Existing secret keys cannot be recovered; rotation issues a new secret before disabling the old key.

Link a CLI identity

Use Linked accounts to manage an existing CLI storage identity from your wallet. Linking requires signatures from both your connected wallet and the CLI identity. Enter its public key and signed proof; keep its private key in your CLI environment.

04 · S3 COMPATIBILITY

What works with standard clients

Use the credentials from your environment for the examples below. Configure optional request and response checksums only when required; checksum trailers are not supported.

Use SigV4 headers or presigned URLs for ordinary fixed-payload requests. Buckets are virtual namespaces constrained by each credential's scope.

Python · boto3

import boto3

# AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY come from your environment.
s3 = boto3.client(
    "s3",
    endpoint_url="<your-storage-endpoint>",
    region_name="us-east-1",
    config=boto3.session.Config(
        signature_version="s3v4",
        s3={"addressing_style": "path"},
        request_checksum_calculation="when_required",
        response_checksum_validation="when_required",
    ),
)
s3.put_object(Bucket="example", Key="hello.txt", Body=b"hello")

JavaScript · AWS SDK v3

import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";

// Credentials are read from your server environment.
const s3 = new S3Client({
  endpoint: "<your-storage-endpoint>",
  region: "us-east-1",
  forcePathStyle: true,
  requestChecksumCalculation: "WHEN_REQUIRED",
  responseChecksumValidation: "WHEN_REQUIRED",
});

await s3.send(new PutObjectCommand({
  Bucket: "example",
  Key: "hello.txt",
  Body: "Hello, Firestarter!",
}));

05 · MULTIPART

Large objects, assembled on complete

Multipart uploads keep each part durable and replaceable, then materialize one final object when the completion list is accepted. The upload book survives router failover.

06 · STREAMING

AWS streaming-chunk signatures

PutObject and UploadPart accept AWS's chained streaming payload mode for clients that cannot precompute a fixed body hash. The router verifies each framed chunk before forwarding decoded bytes to storage.

x-amz-content-sha256: STREAMING-AWS4-HMAC-SHA256-PAYLOAD
content-encoding: aws-chunked
x-amz-decoded-content-length: <decoded bytes>

Trailer signatures, checksum trailers, SigV4a, and presigned streaming requests are not part of the v1 contract.

07 · BOUNDARIES

Know the beta limits