1---
2title: Create the upload backend
3description: Add a Neon project, a migrated branch, private storage, and managed authentication.
4---
5
6Start with `src/resources.ts` in the [complete example](https://github.com/alchemy-run/alchemy/tree/main/examples/neon). Resource declarations run inside an `Effect.gen`; importing this module does not create cloud infrastructure.
7
8## Create the project
9
10```diff lang="typescript"
11+const project = yield* Neon.Project("Project", { region: "aws-us-east-2" });
12```
13
14The project holds the backend's branches. Ohio supports this tutorial's combined Postgres, storage, and Function use case.
15
16## Add an application branch
17
18```diff lang="typescript"
19+const branch = yield* Neon.Branch("Backend", { project });
20```
21
22The resource reference carries the project identity without manually copying an ID or connection string.
23
24## Define upload records
25
26```diff lang="sql"
27+CREATE TABLE uploads (
28+ id uuid PRIMARY KEY,
29+ owner_id text NOT NULL,
30+ object_key text NOT NULL UNIQUE,
31+ filename text NOT NULL,
32+ content_type text NOT NULL,
33+ expected_bytes bigint NOT NULL CHECK (expected_bytes BETWEEN 1 AND 10485760),
34+ actual_bytes bigint,
35+ status text NOT NULL DEFAULT 'awaiting_upload'
36+ CHECK (status IN ('awaiting_upload', 'ready', 'rejected')),
37+ created_at timestamptz NOT NULL DEFAULT now(),
38+ processed_at timestamptz
39+);
40```
41
42Put this in `migrations/0001_uploads.sql`; the row records ownership and processing state independently of the stored file.
43
44## Index the owner's journal
45
46```diff lang="sql"
47+CREATE INDEX uploads_owner_created ON uploads (owner_id, created_at DESC);
48```
49
50This index serves the API's owner-filtered, newest-first listing without making the filename or object key an authorization boundary.
51
52## Record delivery identities
53
54```diff lang="sql"
55+CREATE TABLE upload_events (
56+ invocation_id text PRIMARY KEY,
57+ object_key text NOT NULL,
58+ processed_at timestamptz NOT NULL DEFAULT now()
59+);
60```
61
62The event's invocation ID becomes the database's deduplication key; this is application idempotency, not a claim that Neon delivers exactly once.
63
64## Apply the migration
65
66```diff lang="typescript"
67 const branch = yield* Neon.Branch("Backend", {
68 project,
69+ migrations: "./migrations",
70 });
71```
72
73Alchemy applies the migration before dependent Functions deploy and stores its applied history in the branch.
74
75## Add a private bucket
76
77```diff lang="typescript"
78+const uploads = yield* Neon.Bucket("Uploads", { branch, access: "private" });
79```
80
81Anonymous object URLs cannot read files from this bucket; the API will authorize a user before issuing a signed URL.
82
83## Allow browser PUT requests
84
85```diff lang="typescript"
86 const uploads = yield* Neon.Bucket("Uploads", {
87 branch,
88 access: "private",
89+ cors: [{ AllowedOrigins: ["*"], AllowedMethods: ["PUT"], AllowedHeaders: ["content-type"], MaxAgeSeconds: 300 }],
90 });
91```
92
93CORS permits the browser to send a signed PUT without cookies; it grants no storage authorization. Wildcard origins avoid a bucket-to-website dependency cycle. The signed URL remains the capability required to upload.
94
95## Make tutorial cleanup explicit
96
97```diff lang="typescript"
98 const uploads = yield* Neon.Bucket("Uploads", {
99 branch,
100 access: "private",
101+ forceDestroy: true,
102 });
103```
104
105The complete declaration retains the CORS rule above. `forceDestroy` allows destroy to erase the example's uploaded files; omit it for a bucket whose contents must block deletion.
106
107## Enable managed authentication
108
109```diff lang="typescript"
110+const auth = yield* Neon.Auth("Auth", {
111+ branch,
112+ name: "Upload journal",
113+ allowLocalhost: true,
114+ emailAndPassword: {
115+ enabled: true,
116+ require_email_verification: false,
117+ send_verification_email_on_sign_up: false,
118+ },
119+});
120```
121
122This configures Neon's managed Better Auth service, not a self-hosted authentication server. The relaxed email and localhost settings are for the tutorial only.
123
124## Select the API's browser origin policy
125
126```diff lang="typescript"
127+const appOrigin = yield* Effect.sync(() => process.env.UPLOAD_APP_ORIGIN ?? "*");
128```
129
130Return `appOrigin` with the backend resources for the Function's environment. The default permits cross-origin bearer-token API calls without cookies; an explicit known origin restricts browser access without depending on the not-yet-created website URL. JWT verification remains mandatory in both modes.
131
132## Keep deployment and runtime credentials separate
133
134Neon injects database and storage credentials into same-branch Functions. `NEON_API_KEY` belongs only in your deployment environment, never in Function env props, browser variables, or stack outputs. Storage scopes cover a branch and descendants; a bucket-bound client is not provider-enforced per-bucket IAM, and a read-only client cannot remove the broader credentials injected into its host process.
135
136Continue with [Functions and processing](/neon/tutorial/functions/).