Vercel Blob

Vercel's managed object storage (@vercel/blob) for files — uploads, downloads, and public/private assets — with time-bound signed URLs that scope a single client operation to one object and an expiry.

Vercel Blob stores files behind a CDN; the SDK handles put/get/head/del and client-side uploads. It is the storage primitive paired with Next.js apps that need user uploads or generated assets. Source: Vercel docs, https://vercel.com/docs/vercel-blob, 2026-06-12

Signed URLs

Shipped 2026-06-02: generate a scoped URL with an expiry so a client can upload, download, inspect, or delete one specific object without access to the whole store. Source: Vercel changelog "Signed URLs are now available for Vercel Blob", https://vercel.com/changelog/signed-urls-are-now-available-for-vercel-blob, 2026-06-02

• Scoped to a single operation (put, get, head, or delete), a single pathname, and an expiry you choose (up to 7 days).
• The signature covers the operation and constraints, so a URL signed for a GET cannot be reused as a PUT.
• API: issueSignedToken + presignUrl (@vercel/blob).

This controls exactly how untrusted clients interact with the store — the public-pattern counterpart to internal zero-config storage like Shopify Quick (which relies on a trust boundary instead of per-object scoping).

Source Snapshot

As of 2026-07-04, npm reports @vercel/blob 2.5.0 as latest, 0.9.0-canary.0 as canary, and 2.4.2-4f3596e-20260625125357 as snapshot, with registry time.modified at 2026-06-25T17:03:15Z. The signed-URL changelog launched against @vercel/blob 2.4.0; use the current package unless reproducing the launch-era example. Source: npm registry, 2026-07-04; Vercel changelog, 2026-06-02

SDK quick start

pnpm add @vercel/blob
vercel env pull   # BLOB_READ_WRITE_TOKEN and/or OIDC vars

• On Vercel: prefer OIDC (VERCEL_OIDC_TOKEN + BLOB_STORE_ID) — short-lived, auto-rotated. Source: Vercel Blob SDK docs, https://vercel.com/docs/vercel-blob/using-blob-sdk, 2026-06-13
• Off Vercel / client uploads: BLOB_READ_WRITE_TOKEN or presigned URLs via issueSignedToken.
• Core server ops: put, head, del, list; client uploads: handleUpload / handleUploadPresigned.

Local emulator (Jun 2026)

Chris Tate (@ctatedev, Vercel Labs) shipped a Vercel Blob emulator — build and test file uploads locally against the same @vercel/blob SDK with no real blob store, no dashboard setup, and no test cleanup. Point VERCEL_BLOB_API_URL at the emulator and the SDK talks to it instead of production. Designed to run locally, in CI, and in no-network sandboxes. Source: X/@ctatedev, 2026-06-11 (311 likes, 202 bookmarks; demo video)

This is the storage analog of the local-emulator pattern Kevin already routes (real AWS via Floci; Stripe via Chris Tate's offline Stripe skill) — fast, deterministic, offline tests without provisioning a cloud store.

Stack fit

• Next.js uploads — user-generated content, OG images from Security and Review Skills pipelines, ElevenLabs SFX from Media Generation Skills stored as blobs.
• Signed URLs — untrusted clients upload/download one object without store-wide credentials (Jun 2026).
• Private blobs — Vercel Blob supports public and private storage; use private + signed GET for agent-generated artifacts not meant to be hot-linked.
• Local/CI tests — the emulator (VERCEL_BLOB_API_URL) keeps upload tests offline and deterministic, same as Floci for AWS.
• Pair with Vercel Workflows for async generation → blob write; debug with Vercel Curl (Vercel CLI).

Source: Vercel knowledge updates — Blob public/private, 2026-06-13

---

Timeline

• 2026-06-02 | Time-bound signed URLs added to Vercel Blob — per-operation, per-pathname, expiry up to 7 days; a GET URL can't be reused as PUT. @vercel_dev, 78 likes / 15 bookmarks. Source: X/@vercel_dev, 2026-06-02
• 2026-07-04 | Source-reviewed the signed-URL changelog and refreshed the package snapshot: @vercel/blob is now 2.5.0 latest; the changelog's 2.4.0 instruction is launch-era minimum context, not the current package version. Source: Vercel changelog; npm registry, 2026-07-04
• 2026-06-13 | Quality remediation: SDK install, OIDC vs read-write token, presigned upload path. Source: Vercel docs, 2026-06-13
• 2026-06-11 | Chris Tate (@ctatedev) shipped a local Vercel Blob emulator — same @vercel/blob SDK, no real store, runs in CI / no-network sandboxes via VERCEL_BLOB_API_URL. 311 likes, 202 bookmarks. Source: X/@ctatedev, 2026-06-11