Docs

CDN

Serve images, downloads, fonts and small websites from a bucket at stable addresses that browsers and Cloudflare can cache, with images resized on the fly.

Addresses

https://drive.example.com/cdn/my-bucket/images/photo.jpg for any bucket with the CDN on.
Your own domain, like https://cdn.example.com/images/photo.jpg: add it in Settings > Domains (or on the bucket's CDN page) and pick the bucket. Folders answer with their index.html, so a bucket can host a small static site.

Public buckets (or public prefixes) are served to everyone. Private objects need a signed link. Make a bucket public in its Permissions.

Caching

Every file has an ETag and Last-Modified, so repeat visits get a quick "not modified".
Addresses with ?v= or a content hash in the name (like app.3f9a1c2b.js) are cached for a year.
Everything else uses the bucket's cache time (an hour unless you change it). A Cache-Control set on the object wins.
Text (HTML, CSS, JavaScript, JSON, SVG) is compressed with brotli or gzip. Video and audio support ranges, so players can seek.

Image resizing

Add parameters to an image address:

w and h: width and height in pixels. Sizes snap up to a fixed list, and images never grow past their original size.
fit=cover crops to fill both, fit=contain (the default) fits inside.
format=webp, avif, jpeg, png, or auto to pick the best the browser accepts.
q: quality from 1 to 100.

html

<img src="https://drive.example.com/cdn/my-bucket/images/photo.jpg?w=800&format=auto"
     srcset="https://drive.example.com/cdn/my-bucket/images/photo.jpg?w=480&format=auto 480w,
             https://drive.example.com/cdn/my-bucket/images/photo.jpg?w=800&format=auto 800w,
             https://drive.example.com/cdn/my-bucket/images/photo.jpg?w=1600&format=auto 1600w"
     sizes="(max-width: 800px) 100vw, 800px" loading="lazy" alt="">

Resized copies are made once and kept on disk. To keep a public address from being used to wear out the server, each image has at most 40 sizes, sources are limited to 60 MB and 100 megapixels, and each visitor can cause 60 new sizes a minute. Turn resizing off on the bucket's CDN page if you don't need it.

Hotlink protection

List the sites that may embed your files, like example.com or *.example.com. Requests from other sites get a 403. You choose whether requests without a referrer (direct visits, apps) are allowed.

Signed links

A signed link opens one object until it expires, even in a private bucket. Make one on the bucket's CDN page, or with the API:

shell

curl -X POST https://drive.example.com/api/v1/buckets/my-bucket/sign \
  -H "authorization: Bearer YOUR-API-TOKEN" -H "content-type: application/json" \
  -d '{"key": "reports/2026.pdf", "expires_in": 86400}'

Cloudflare

In front of Cloudflare, add the zone id and an API token with the Cache Purge permission on the bucket's CDN page. Objects that change or are deleted are then purged from Cloudflare's cache right away. Resized images are separate addresses: use ?v= in your pages, or Purge everything after big changes.

Safety

On the server's own address every CDN response is sandboxed, so an HTML or SVG file in a bucket can never run scripts as the app. On your own domain (where nobody is ever signed in) pages work normally.

An admin can turn the CDN off, or limit it to some people, in Admin > Features. Buckets keep working over S3 either way. See Storage buckets (S3) to make one.