Skip to main content
Cloud infrastructure for modern software

File infrastructure, without the infrastructure overhead.

Afara gives engineering teams a deterministic control plane for file uploads, storage governance, and private retrieval. Define versioned upload policies, issue short-lived presigned transfers directly to private object storage, and verify every completed object via provider HeadObject before activating records.

Launch Private Alpha Console Explore SDK & API Inspect Design System
Zero Proxy Bytes Client streams directly to private storage via presigned PUT; application servers never buffer file payloads.
HeadObject Verification Completion never trusts client claims—actual byte size, ETag, and MIME are verified against storage.
Private-Only Storage Public bucket URLs are rejected at startup. Retrieval uses short-lived signed GET URLs (900s TTL).
Multi-Tenant RBAC Strict Organization → Project → Storage Resource isolation with 5 canonical roles and HMAC API keys.
Upload Session State Machine
control-plane: active (private)
POST /v1/projects/prj_alpha_01/upload-sessions session.status = "created" · quota reserved 
// Request (Idempotency-Key: idem_upl_9042)
{
  "storageResourceId": "sr_primary_vault",
  "policyId": "pol_documents_v3",
  "fileName": "q4-audit-evidence.pdf",
  "contentType": "application/pdf",
  "declaredSizeBytes": 4194304,
  "checksumSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
}

// 201 Created — Presigned direct-to-storage instruction
{
  "data": {
    "session": {
      "id": "ups_01J9AFARA88X2",
      "status": "created",
      "policyVersion": 3,
      "reservedBytes": 4194304,
      "expiresAt": "2026-11-13T15:45:00.000Z"
    },
    "uploadInstruction": {
      "method": "PUT",
      "uploadUrl": "https://<presigned-storage-endpoint>/...",
      "requiredHeaders": { "content-type": "application/pdf" }
    }
  }
}
Policy version snapshot bound; quota reserved transactionally before presigning. Run in Console →
Deterministic Control Plane

How Afara separates control-plane governance from data-plane bytes.

Traditional upload endpoints stream multi-megabyte payloads through application processes, exhausting memory and leaving orphan objects when requests fail. Afara coordinates policy validation, quota locking, and object verification around direct storage transfers.

01 / POLICY & QUOTA LOCK

Declarative Session Creation

Your backend or client requests an upload session with an Idempotency-Key. Afara validates MIME type, byte limits, and checksum rules against the immutable Upload Policy version and locks organization quota.

Contract: POST /v1/projects/:id/upload-sessions
02 / DIRECT STORAGE PUT

Zero-Proxy Byte Transfer

Afara returns a short-lived presigned PUT URL (900s default TTL) scoped to the exact tenant object key and declared content length. The client transfers bytes directly to Cloudflare R2 private storage.

Data Plane: PUT <presignedUrl> (0 app-server bytes)
03 / HEADOBJECT VERIFICATION

Authoritative Completion

When the client calls /complete, Afara performs an authoritative HeadObject check against storage to verify object existence, actual byte size, ETag, and SHA-256 digest before marking the file active.

Contract: POST /v1/.../upload-sessions/:id/complete
04 / PRIVATE RETRIEVAL & DELETION

Signed GET & Fail-Closed Delete

Files remain private at rest. Authorized callers mint short-lived signed download URLs (900s TTL) that increment egress ledgers, or execute provider-first deletion that releases storage quota only after storage confirmation.

Contract: POST /v1/.../files/:id/download-url
Architecture & Governance

Engineered for multi-tenant isolation and auditability.

Every resource in Afara belongs to a strict hierarchy: Organization → Project → Storage Resource → Upload Policy → API Key → Upload Session → Verified File.

AF-630 · Versioned Governance

Immutable Upload Policy Snapshots

Upload rules live in versioned control-plane policies rather than scattered controller middleware. Updating a policy mints a new immutable version while in-flight upload sessions remain bound to the exact policy snapshot active when they were created.

  • MIME Allowlist: Exact content-type enforcement
  • Byte Ceiling: Per-file max size validation
  • Integrity: Optional SHA-256 digest binding
  • Expiry TTL: Configurable presigned window
AF-625 · Access Control

5-Role RBAC & Scoped HMAC Keys

Human operators authenticate with Firebase ID tokens mapped to five roles (Owner, Admin, Developer, Billing, Viewer). Services authenticate with project-scoped afr_live_* / afr_test_* API keys stored as HMAC-SHA256 digests.

  • Key Format: afr_live_<id>_<secret>
  • Verification: Timing-safe HMAC-SHA256
ADR-004 & AF-646 · Storage Security

Private-Only Buckets & Provider-First Deletion

Afara refuses to boot if public R2 URLs or *.r2.dev domains are configured. Internal storage bucket names and object keys are redacted from customer API responses, and file deletion verifies provider object removal before releasing quota.

  • Access Mode: Private-only enforced
  • Signed GET TTL: 900 seconds default
AF-624 & AF-647 · Transactional Ledger

Concurrency-Safe Quota Reservations & Reconciliation

Quota checks never rely on eventual consistency. Afara reserves bytes atomically when an upload session is created, reconciles actual verified bytes upon HeadObject completion, and releases reserved bytes when sessions are cancelled, expired, or deleted.

  • Reservation: Atomic byte lock on session create
  • Idempotency: Replay-safe mutation keys
  • Reconciliation: Drift detection & repair
  • Audit Trail: Append-only organization events
Developer Experience

Clean TypeScript primitives and a live inspectable API.

Integrate with the @afara/sdk client or call the versioned /v1/* REST endpoints directly. Test the running control-plane health endpoint right from this page. 

import { AfaraClient } from '@afara/sdk';

const afara = new AfaraClient({
  apiKey: process.env.AFARA_API_KEY, // afr_live_<keyId>_<secret>
  projectId: 'prj_alpha_01',
});

// 1. Reserve quota & mint policy-bound upload session
const { session, uploadInstruction } = await afara.uploadSessions.create({
  storageResourceId: 'sr_primary_vault',
  policyId: 'pol_documents_v3',
  fileName: 'architecture-ledger.pdf',
  contentType: 'application/pdf',
  declaredSizeBytes: file.size,
});

// 2. Upload bytes directly to private storage
await fetch(uploadInstruction.uploadUrl, {
  method: uploadInstruction.method,
  headers: uploadInstruction.requiredHeaders,
  body: file,
});

// 3. Trigger authoritative HeadObject verification
const { file: verifiedFile } = await afara.uploadSessions.complete(session.id);

// 4. Issue short-lived signed download URL (default 900s TTL)
const download = await afara.files.createDownloadUrl(verifiedFile.id, {
  expiresInSeconds: 900,
});
GET /api/health (Live Runtime) Ready 
{
  "status": "probing_control_plane..."
}
Open Full Operator Sandbox →
Transparent Scope & Commercial Plans

Predictable quota tiers built on honest engineering posture.

Afara v1 focuses on private S3-compatible object storage governance over Cloudflare R2. Every organization starts on the Alpha Free plan with strict quota enforcement and zero hidden proxy charges.

Active Default

Alpha Free

$0/mo
  • Storage Quota1 GiB
  • Monthly Egress Quota5 GiB
  • Max Single File Size25 MiB
  • Projects Included1 Project
  • Signed GET / PUT TTL900 seconds
Start in Alpha Free Console
Developer Tier

Developer

$9/mo
  • Storage Quota25 GiB
  • Monthly Egress Quota100 GiB
  • Max Single File Size250 MiB
  • Projects Included5 Projects
  • Versioned Upload PoliciesUnlimited
Configure in Console
Production Teams

Pro

$29/mo
  • Storage Quota100 GiB
  • Monthly Egress Quota500 GiB
  • Max Single File Size2 GiB
  • Projects Included20 Projects
  • 5-Role RBAC & Audit LogsIncluded
Configure in Console
Interactive Private Alpha

Provision a storage resource and run a verified upload session.

Launch directly into the Afara Console with the interactive operator sandbox enabled. Inspect organization quotas, mint project-scoped API keys, and test the three-stage upload lifecycle end to end.

Sandbox ready · No external credentials required for interactive preview.