Overview
What BringBucket is and how the BYOC model works.
BringBucket is a file management dashboard that connects to your own S3-compatible cloud storage. Instead of storing your files on our servers, we act as a secure UI layer on top of buckets you already own — at AWS, Cloudflare, MinIO, Supabase, and more.
Your data, your cloud
Files never touch BringBucket servers. They live in the bucket you connected.
Encrypted credentials
Access keys are encrypted with AES-256-GCM before being stored in our database.
Any S3-compatible provider
Works with AWS S3, Cloudflare R2, MinIO, Supabase Storage, and more.
Getting Started
From sign-up to managing your first file in under 5 minutes.
Create your account
Go to Onboarding
Select your cloud provider
Enter your credentials
Verify the connection
Start managing files
Connecting Providers
Step-by-step credential guides for each supported provider.
All providers use the same S3-compatible API. The differences are in where to find your credentials and what endpoint URL to use.
AWS S3
- Log in to the AWS Management Console and open the S3 service. Create a new bucket or use an existing one. Note the bucket name and the region (e.g.
us-east-1). - Open IAM → Users and create a new user. On the permissions step, attach the following inline policy (replace
YOUR_BUCKET_NAME):{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::YOUR_BUCKET_NAME", "arn:aws:s3:::YOUR_BUCKET_NAME/*" ] }] } - Under the new IAM user, go to Security credentials → Access keys and create an access key. Copy both the Access Key ID and the Secret Access Key.
- In BringBucket, select AWS S3 and fill in:
Cloudflare R2
- Log in to the Cloudflare dashboard. Open R2 Object Storage from the left sidebar, then click Create bucket.
- On the R2 overview page, copy your Account ID shown in the top right. Your endpoint will be:
https://<account-id>.r2.cloudflarestorage.com - Go to Manage R2 API tokens (link on the R2 overview). Create a new token with Object Read & Write permissions, scoped to your bucket. Copy the Access Key ID and Secret Access Key.
MinIO (Self-hosted)
MinIO is a self-hosted S3-compatible server. You need a running MinIO instance accessible over the internet (or your private network if BringBucket is self-deployed).
- Open the MinIO Console (usually at
http://localhost:9001) and log in as admin. - Go to Buckets → Create Bucket. Give it a name.
- Go to Identity → Users → Create User. Assign the
readwritepolicy (or a custom policy). - Under the user, create a Service Account to get an access key and secret.
Supabase Storage
- Open your project in the Supabase dashboard. Go to Storage → Buckets and create a bucket. Set it to private for full access control.
- Go to Settings → API. Copy your Project URL and the service_role secret (under Project API keys).
- Your S3 endpoint is derived from your project URL — replace
https://<ref>.supabase.cowithhttps://<ref>.supabase.co/storage/v1/s3.
File Manager
Uploading, organizing, previewing, and deleting files.
Uploading files
Click the Upload button in the toolbar, or drag and drop files directly onto the file list area. Multiple files can be selected at once. Progress is shown per-file in a toast notification.
Creating folders
Click + New Folder in the toolbar. Folders are virtual prefixes in your S3 bucket — they do not consume storage on their own.
Navigating
Click any folder to open it. The breadcrumb trail at the top shows your current path. Click any segment to jump back to that level.
Selecting a file
Click any file row to open the File Details panel on the right. From there you can preview (for images), download, rename, share, or delete the file.
Searching
Use the search bar at the top of the file list to filter files by name within the current folder. Search is case-insensitive and matches partial names.
Renaming a file or folder
Select the file, then click Rename in the Details panel. For S3 providers, renaming copies the object to the new key and deletes the old one — this is a standard S3 operation.
Deleting
Select the file, then click Delete in the Details panel. A confirmation dialog appears. Deletions are permanent and cannot be undone from BringBucket.
Sharing & Links
Generate a shareable link for any file in your bucket.
Creating a share link
Select any file in the file manager, then click Share in the File Details panel. BringBucket generates a short, public link:
https://app.bringbucket.com/share/[token]How it works
When a visitor opens the share link, BringBucket uses your stored credentials to generate a time-limited pre-signed URL directly from your S3 bucket. The file is served from your cloud provider — not from BringBucket's servers.
Copying the link
After clicking Share, the link is automatically copied to your clipboard and shown in a toast. You can also re-open the share dialog from the Details panel at any time.
Security Model
How BringBucket handles your credentials and protects your data.
Credential storage
Your access key ID and secret access key are encrypted with AES-256-GCM using a server-side key before being written to our database. The encryption key is never stored alongside the credentials.
No file access
BringBucket never stores your files. All uploads and downloads are streamed directly between your browser and your S3 bucket. Our server acts as a credential broker, not a data store.
Transport security
All communication between the browser, BringBucket servers, and your cloud provider is encrypted over TLS 1.2+. We enforce HTTPS on all endpoints and reject plain HTTP connections.
Least-privilege recommendation
We recommend creating a dedicated IAM user or service account with only the permissions BringBucket needs: list, get, put, and delete on a single bucket. Avoid using root or admin credentials.
Revoking access
To revoke BringBucket's access to your bucket, delete or disable the IAM user / API token in your cloud provider's console. You can also delete the bucket connection from BringBucket's dashboard, which removes the encrypted credentials from our database.
Have a security concern?
Please email us at security@bringbucket.com or open a ticket on the Support page.