File Uploads

PocketBase handles file storage natively — files are attached to records via file fields, stored alongside your instance’s data, and served over the same HTTPS domain. No separate object storage service to configure — though if you want one, PocketBase can also store files in any S3-compatible bucket (admin panel → Settings → Files storage).

Step 1: Add a file field

Open the admin panel and edit your collection
Add a file field (e.g., avatar or attachments)
Configure it:
- Max files — single file or multiple
- Max size — per-file size limit
- Allowed mime types — e.g., restrict to image/png, image/jpeg
- Thumb sizes — pre-defined thumbnail dimensions like 100x100

Step 2: Upload from your app

The SDK accepts plain objects containing File/Blob values:

// from an <input type="file"> element
const input = document.querySelector("#avatar");

await pb.collection("users").update(userId, {
  avatar: input.files[0],
});

Multi-file fields take arrays, and you can append to existing files with the + modifier:

await pb.collection("posts").update(postId, {
  "attachments+": [file1, file2], // keep existing, add new
});

To delete a specific file, set the field to the filenames you want to keep, or use the - modifier:

await pb.collection("posts").update(postId, {
  "attachments-": ["old_report_kx1anv0q.pdf"],
});

Step 3: Display files

Each uploaded file gets a unique filename stored on the record. Build the URL with the SDK:

const record = await pb.collection("users").getOne(userId);
const url = pb.files.getURL(record, record.avatar);
// https://<instance-name>.pocketbasecloud.com/api/files/users/<id>/<filename>

Thumbnails

For image files, request a thumbnail on the fly with the thumb parameter:

const thumbUrl = pb.files.getURL(record, record.avatar, {
  thumb: "100x100",
});

Supported formats include exact crops (100x100), width-only (100x0), height-only (0x100), and fit-inside (100x100f).

Protected files

By default, files are publicly accessible to anyone with the URL. To require authorization, enable Protected on the file field. Protected files are served only with a short-lived file token:

const token = await pb.files.getToken();
const url = pb.files.getURL(record, record.document, { token });

Access follows the collection’s View API rule, so the same ownership rules that protect the record protect its files.

Storage and backups

Files count toward your instance’s disk usage, and they’re included in the automatic backups PocketBase Cloud takes of your instance. On the Free plan, total instance storage is limited to 50MB — upgrade to Starter or Pro for more headroom.