--- title: Build a private file upload app with Vercel Blob description: Build an owner-only file library with private Vercel Blob storage, authenticated downloads, and checks for cross-user access. url: "https://vercel.com/kb/prompts/build-private-file-upload-app" last_updated: 2026-11-07 related_resources: "[Use private Vercel Blob storage](https://vercel.com/docs/vercel-blob/private-storage)": "Serve private files through an authenticated application route." "[Vercel Blob security](https://vercel.com/docs/vercel-blob/security)": "Understand private storage authentication and credential handling." "[Vercel Blob SDK reference](https://vercel.com/docs/vercel-blob/using-blob-sdk)": "Check supported upload, read, and listing APIs for your integration." --- # Build a private file upload app with Vercel Blob Build an owner-only file library with private Vercel Blob storage, authenticated downloads, and checks for cross-user access. Build a file library where signed-in users can upload, list, and download their own documents. Private Vercel Blob storage holds the files, while the app checks who can access each one. Open your existing project or start in an empty workspace. You need an authentication choice, an ownership metadata store, and a private Blob store for live verification. The handoff does not transfer your repository or credentials. You get an upload flow and an owner-only listing backed by authorization checks. Synthetic files and service mocks support local tests before you connect real storage or handle private documents. ## Agent prompt ```text Build a private file library where each signed-in user can upload, list, and download only their own files using Vercel Blob. Keep sharing, public links, deletion, and inline file previews outside this first version. Read repository instructions and inspect the framework, package manager, authentication, database, Blob SDK version, UI patterns, and tests. Reuse existing choices. If an intended existing project is missing, ask me to open or import it. In an empty workspace, use Next.js and ask for the authentication and metadata-store choices before committing to external providers. Continue local UI and adapter work with clearly labeled fixtures while those choices are pending. Verify private storage support and current SDK APIs for the installed version. Use a private Blob store and keep storage credentials server-side. A private store does not establish application ownership: persist a file record containing a generated identifier, authenticated owner, storage pathname, original display name, size, and upload state. Resolve ownership from the server session, never a client-supplied user ID. Generate storage paths on the server and authorize upload, list, and download independently. Reject arbitrary storage URLs or pathnames from clients. Start with bounded server uploads and a documented file-type allowlist. Validate actual bytes and enforce byte limits while reading, within current hosting limits; do not trust filename or MIME headers alone. Preserve cookie-authenticated mutation protections. Record pending and completed states so failed uploads or metadata writes cannot create a completed entry for a missing file. Document cleanup of orphaned objects without deleting unrelated files. Serve downloads through an authenticated owner-checking route using the private Blob SDK. Return attachments with safe filenames and content types, disable content sniffing, and prevent shared or persistent browser caching of sensitive responses. Never expose storage tokens or render uploaded HTML. Provide labeled controls, keyboard access, progress or pending status, and recoverable errors. With synthetic files and two test users, verify upload-to-download success, isolation on list and download, unauthenticated rejection, tampered file IDs, oversized or unsupported files, and recovery after storage or metadata failure. Mock external storage for repeatable tests; report live checks separately. Run relevant type, lint, and UI checks. Finish with local run steps, configuration names, actual results, and remaining storage/authentication setup. Ask before creating paid resources, uploading real private documents, or deploying. ``` ## Related resources - [Use private Vercel Blob storage](https://vercel.com/docs/vercel-blob/private-storage): Serve private files through an authenticated application route. - [Vercel Blob security](https://vercel.com/docs/vercel-blob/security): Understand private storage authentication and credential handling. - [Vercel Blob SDK reference](https://vercel.com/docs/vercel-blob/using-blob-sdk): Check supported upload, read, and listing APIs for your integration. ## Try other prompts - [Build a document extraction app with structured output](/kb/prompts/build-document-extraction-app): Turn document text into validated fields with the AI SDK, including missing-value handling and a reviewable JSON result. - [Add regression tests for a critical user flow](/kb/prompts/add-critical-flow-regression-tests): Protect a key Next.js user journey with isolated tests for visible outcomes, failure recovery, and relevant access boundaries. ## Reference Architecture Choose a stack and work through the decisions behind it, with curated documentation, guides, templates, and courses to help you build. - [Agent stack](/kb/architecture/agents): Build and operate agents with models, tools, and durable workflows. - [Web applications](/kb/architecture/web): Choose rendering, data, authentication, and caching approaches. - [Backends](/kb/architecture/backends): Choose a runtime, connect services, and run background work. [Browse all stacks](/kb/architecture) ## Build with prompts Build an app, extend an agent, or improve your project with ready-to-use prompts for your coding agent. [Browse the prompt library](/kb/prompts) ยท [Read the Markdown index](/kb/prompts.md)