clover's git

the-knife

1	---
2	title: Buckets
3	description: Prisma Buckets provision S3-compatible object storage inside a project, and Bucket access keys mint the S3 credentials — access key, one-time secret, endpoint, and the provider-side bucket name.
4	---
5
6	A `Prisma.Bucket` is an Object Store bucket inside a Prisma
7	project. A `Prisma.BucketAccessKey` is an access key for one bucket and
8	yields the S3 credentials your app connects with.
9
10	```typescript
11	import * as Prisma from "alchemy/Prisma";
12
13	const bucket = yield* Prisma.Bucket("uploads", {
14	project,
15	name: "uploads",
16	});
17
18	const key = yield* Prisma.BucketAccessKey("uploads-key", {
19	bucket,
20	role: "read_write",
21	});
22	```
23
24	## Bucket access key outputs
25
26	```typescript
27	key.accessKeyId; // S3 access key ID
28	key.secretAccessKey; // S3 secret, Redacted — returned once at creation
29	key.endpoint; // S3-compatible endpoint URL
30	key.bucketName; // provider-side S3 bucket name (e.g. user-<id>)
31	```
32
33	Prisma returns `secretAccessKey` exactly once, in the create
34	response. Alchemy persists it `Redacted` in state and never re-reads
35	it from the API, so keep your state store somewhere durable.
36
37	S3 clients must use `key.bucketName` — the provider-side name — as
38	the bucket, not the friendly display name you chose on the bucket:
39
40	```typescript
41	const app = yield* Prisma.Compute("api", {
42	project,
43	path: "./app",
44	env: {
45	S3_ENDPOINT: key.endpoint,
46	S3_BUCKET: key.bucketName,
47	S3_ACCESS_KEY_ID: key.accessKeyId,
48	S3_SECRET_ACCESS_KEY: key.secretAccessKey,
49	},
50	});
51	```
52
53	## Roles
54
55	A key's `role` is `"read"` or `"read_write"` and is fixed at
56	creation — changing it (or the key's name or bucket) replaces the
57	key and mints fresh credentials.
58
59	## Deletion
60
61	Destroying a bucket deletes its objects and revokes any remaining
62	keys server-side. A `Prisma.BucketAccessKey` destroyed after its bucket
63	tolerates the already-revoked key.
64
65	## Branch-scoped buckets
66
67	Pass `branchId` to scope a bucket to a branch, e.g. for per-preview
68	storage:
69
70	```typescript
71	const previewBucket = yield* Prisma.Bucket("preview-uploads", {
72	project,
73	branchId: preview.branchId,
74	});
75	```
76
77	## The bucket bindings
78
79	Inside a Prisma Compute app, AWS Lambda function, or Cloudflare Worker, bind the bucket instead of wiring credentials by hand. `Prisma.ReadBucket`, `Prisma.WriteBucket`, and `Prisma.ReadWriteBucket` each mint a scoped `Prisma.BucketAccessKey` for the bucket, carry its credentials into the host, and resolve to a typed client at runtime:
80
81	```typescript
82	Effect.gen(function* () {
83	const uploads = yield* Prisma.ReadWriteBucket(bucket);
84
85	return {
86	fetch: Effect.gen(function* () {
87	yield* uploads.put("hits", "1");
88	const object = yield* uploads.get("hits");
89	return yield* HttpServerResponse.text(
90	object === null ? "" : yield* object.text(),
91	);
92	}),
93	};
94	}).pipe(Effect.provide(Prisma.ReadWriteBucketBinding));
95	```
96
97	`ReadBucket` mints a `read`-role key, so its credential genuinely cannot write. The store has no write-only role, so `WriteBucket` carries a `read_write` credential and enforces write-only at the client.
98
99	## Where next
100
101	- [Compute](/prisma/compute/apps) — the host the bindings deliver to.
102
103	Reference:
104
105	- [Bucket API reference](/providers/prisma/bucket)
106	- [BucketAccessKey API reference](/providers/prisma/bucketaccesskey)
107	- [ReadBucket](/providers/prisma/readbucket) / [WriteBucket](/providers/prisma/writebucket) / [ReadWriteBucket](/providers/prisma/readwritebucket)