Vercel Private Blob is now generally available
Vercel Private Blob graduates from beta and is now available for all plans, enabling secure storage of sensitive files with granular access control. Features include private stores, Signed URLs for temporary scoped access, and OIDC authentication for Functions and CLI to eliminate static credentials.
Vercel Private Blob is now generally available for all plans. Store sensitive files like user-uploaded photos, invoices, and agent memory, and control exactly who can read them. Private stores, Signed URLs, and OIDC authentication all graduate from beta with this release.
Vercel Private Blob uses the same Blob API as public blobs. Specify when uploading a blob:access: 'private'
Functions running on Vercel now authenticate to Vercel Private Blob with a short-lived, auto-rotating OIDC token scoped to the project, with no static read-write token in your environment.
The Vercel CLI also supports OIDC authentication, so you can read from and write to a private store from your terminal without a long-lived token. For stores still using a static token, you can upgrade to OIDC and revoke the old credential from the dashboard.
Mint a URL scoped to a single operation, pathname, and an expiration date you choose for up to 7 days, then hand it to a client to perform a , , , or operation on a single object, without ever exposing your store credentials.PUTGETHEADDELETE
Signed URLs work well when you want to grant temporary, narrow access to a private object without putting your server in the data path:
Learn more about Vercel Private Blob in the .documentation
OIDC authentication
Signed URLs
Let a user download a private file, like an invoice, a report, or an export, with a link that expires.
Share an object with a third party or external service for a fixed window.
Hand an agent one-off access to clean up a specific object.
delete
Source: original entry ↗