Storage
Storage is where the things you make in the hub are kept, and where you decide who can reach them. Every document, note, uploaded file and table of data in your workspace has a home here. You give that home a name and hand out access to it. You move files in and out.
You open it from the Storage row in the workspace rail. Tokens are part of Storage: the keys a program uses to reach your data without signing in as you. Every product has a Storage of its own as well, so a product's data is kept and shared the same way a workspace's is.
Topics
- Buckets: the named places your data is grouped into, and how access flows down from a bucket to what it holds.
- Uploads and downloads: moving files in and out, and the quota that bounds them.
- Tokens: keys that let a program, an application or an agent reach your data.
- All Data: browse and edit the rows behind any feature.
Everything Storage does on the site, a program can do over the API: make and arrange buckets, start and finish uploads, fetch downloads, mint and revoke tokens, and read and write the rows a bucket holds.
Buckets and bucket types are plain resources with list, create, read, update and delete. They are under the bucket tag in the REST reference.
Uploads and downloads are the storage routes. One call starts an upload and returns where to put the bytes, a second records that the upload finished, and a download call returns the file. The storage quota is read from the usage routes.
Tokens are minted, listed and revoked through the auth routes. A token's scope is a list of path prefixes, such as /content/markdown or /project:read.
The bucket data plane is what a storage token reaches: the rows of one bucket, by bucket and bucket type, with the verbs C (create), R (read), U (update) and D (delete). The grant on the bucket is the ceiling for the bucket type, and the type's grant is the ceiling for the row.
The full list of routes, with each one's parameters, body and responses, is the REST reference on the help site. An agent reaches a persona's storage through the tools listed in the MCP reference.
A bucket names and permits; it never stores. Rows live in their own tables, under the workspace's tenancy. A bucket gives them an address and a line of permission. That keeps data free to move and keeps the schema honest about where a row is.
A grant is a ceiling at every level. The bucket's grant bounds the bucket type's, which bounds the row's. A narrower grant lower down can never widen what was given above.
A new surface is a new scope, not a new kind of token. A new kind of token means a new set of columns, a new revocation path and a governance review. A scope uses what exists.
The secret is shown once. The hub keeps only the fingerprint, and the Tokens pane holds the minted secret in memory so that a redraw does not lose it before you copy it.
Tokens are off the rail. A personal token is issued from the product it is used against, so Tokens is a part of Storage and of each product rather than a row of its own.
All Data is one home for everything else. The separate Storage and Customers editors were folded into it, so each table has exactly one editor.