PIPE Storage docs — S3, multipart, and streaming uploads

01 · QUICKSTART

Upload your first object

Storage uses path-style addressing. Create credit and an S3 key from the storage workspace, then point your client at the endpoint below.

Endpointhttps://api.pipedev.networkRegion: us-east-1 (or any explicit client region)

export AWS_ACCESS_KEY_ID='<access key>'
export AWS_SECRET_ACCESS_KEY='<secret shown once>'
export AWS_DEFAULT_REGION=us-east-1

aws --endpoint-url https://api.pipedev.network \
  s3api create-bucket --bucket example
aws --endpoint-url https://api.pipedev.network \
  s3 cp ./photo.jpg s3://example/photo.jpg
aws --endpoint-url https://api.pipedev.network \
  s3 cp s3://example/photo.jpg ./photo.jpg

AWS CLI reference Open storage workspace

02 · BILLING

Fund usage with prepaid USDC

Storage credit is purchased with Circle USDC on Solana. The wallet signs an exact x402 payment, Pipe settles it, and the credit becomes available after finalized confirmation.

WritesCharged by bytes written and replicated.

ReadsCharged by bytes served to the client.

MultipartEach durable part and final materialization write is billed.

The dashboard shows available, spent, and reserved credit. A retry of the same payment invoice cannot double-credit the account.

03 · ACCESS

Scope every S3 key

Authenticate to the dashboard by signing a short-lived message with your wallet. Create a key for a credit identity and limit it to specific buckets and an optional object prefix.

Open the storage workspace, sign in, and use the S3 access panel to create, rotate, or revoke credentials. Existing secret keys cannot be recovered; rotation issues a new secret before disabling the old key.

01Connect a Solana walletMessage signing is required for the storage account.

02Sign in securelyThe session is held in a secure, HttpOnly cookie.

03Create S3 credentialsThe secret is displayed once. Copy it into your secret manager.

04Rotate before expiryA replacement keeps the same scope and is created before the old key is revoked.

05Revoke when finishedRevocation stops future authorization without deleting objects.

Never paste an S3 secret into a browser bundle, commit it, or share it in a support ticket.

04 · S3 COMPATIBILITY

What works with standard clients

Use SigV4 headers or presigned URLs for ordinary fixed-payload requests. Buckets are virtual namespaces constrained by each credential's scope.

BucketHEAD · PUT · DELETE · ListObjectsV2

ObjectPUT · GET · HEAD · DELETE · byte ranges

MultipartCreate · upload part · list · complete · abort

AuthSigV4 headers · fixed presigned URLs

import boto3

s3 = boto3.client(
    "s3",
    endpoint_url="https://api.pipedev.network",
    region_name="us-east-1",
    aws_access_key_id="<access key>",
    aws_secret_access_key="<secret>",
    config=boto3.session.Config(
        signature_version="s3v4",
        s3={"addressing_style": "path"},
    ),
)
s3.put_object(Bucket="example", Key="hello.txt", Body=b"hello")

05 · MULTIPART

Large objects, assembled on complete

Multipart uploads keep each part durable and replaceable, then materialize one final object when the completion list is accepted. The upload book survives router failover.

1CreateMultipartUploadReceive an upload ID for a bucket and key.

2UploadPartSend parts 1–10,000. Reusing a part number replaces the prior part.

3ListPartsInspect durable parts and their quoted BLAKE3 ETags.

4CompleteMultipartUploadSubmit a sorted, unique XML list; parts stream in order into the final write.

Multipart ETags are quoted Lattice BLAKE3 hashes, not AWS MD5 multipart ETags.

06 · STREAMING

AWS streaming-chunk signatures

PutObject and UploadPart accept AWS's chained streaming payload mode for clients that cannot precompute a fixed body hash. The router verifies each framed chunk before forwarding decoded bytes to storage.

x-amz-content-sha256: STREAMING-AWS4-HMAC-SHA256-PAYLOAD
content-encoding: aws-chunked
x-amz-decoded-content-length: <decoded bytes>

ChainedEvery chunk signature uses the previous signature as its seed.

BoundedIndividual chunks default to 16 MiB and are capped by the service.

TerminalThe signed zero-length final chunk is required.

Trailer signatures, checksum trailers, SigV4a, and presigned streaming requests are not part of the v1 contract.

07 · BOUNDARIES

Know the beta limits

Multipart expirationUploads expire after 24 hours by default; terminal records remain for another 24 hours for idempotent retries.

Completion XMLCompleteMultipartUpload bodies are limited to 2 MiB.

Single-range readsOne range request is limited to a 32 MiB window during beta.

Not supportedVersioning, lifecycle rules, object lock, managed SSE/KMS, ACLs, object tags, UploadPartCopy, browser POST forms, and checksum trailers.

Pipe object ETags are content identities, not AWS's MD5 or multipart-MD5 values. Do not build integrity checks around AWS ETag assumptions.

Storage docs for builders.