Vercel Private Blob is now generally available
By Steven Van ·
Private Blob storage, Signed URLs, and OIDC authentication leave beta and are now available to all Vercel plans.
Vercel Private Blob is generally available on all plans. Private stores, Signed URLs, and OIDC authentication all graduate from beta with this release, giving developers a way to store sensitive files, such as user-uploaded photos, invoices, and agent memory, while controlling exactly who can read them.
- Private stores require authentication for every read and write, and use the same Blob API as public storage: specify access: 'private' when uploading with put().
- Functions running on Vercel now authenticate to private stores with a short-lived, auto-rotating OIDC token scoped to the project, so no static read-write token needs to sit in the environment. The Vercel CLI also supports OIDC, for reading and writing from a terminal without a long-lived token. Stores still on a static token can upgrade to OIDC and revoke the old credential from the dashboard.
- Signed URLs scope access to a single operation (PUT, GET, HEAD, or DELETE), a single pathname, and an expiration of up to seven days, so a client can be handed temporary access to a private object without ever seeing the store's credentials.
Vercel
The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.
View Vercel →