Add Postgres and file storage

Use standard Postgres

Select a database when preparing deployment. Atlas injects DATABASE_URL into the application's server environment. Use a Postgres-compatible client or ORM and the connection's TLS requirements.

Keep connection strings out of browser code, public environment variables, source archives, and logs. Vite browser code needs a server endpoint to use a database or private storage; a static frontend cannot safely hold these credentials.

Apply schema SQL through atlas_apply_database_migration after project creation. Use the application's schema and review SQL that changes existing data. atlas_query_database supports a single read-only SELECT with a five-second timeout and a maximum of 100 returned rows.

Use the Atlas file API

Call atlas_storage_instructions with the project ID for the current integration contract. Atlas injects ATLAS_STORAGE_API_URL and ATLAS_STORAGE_TOKEN. Use Bearer authentication only from your application's server routes, with your own end-user authorization.

Workspace byte and file-count allowances also apply. The token belongs to one project and is not a browser credential.

Upload from a server route

// Run only on your application server, after authorizing the user.
const form = new FormData();
form.set('file', file);
const response = await fetch(process.env.ATLAS_STORAGE_API_URL, {
  method: 'POST',
  headers: { Authorization: `Bearer ${process.env.ATLAS_STORAGE_TOKEN}` },
  body: form,
});
if (!response.ok) throw new Error('File upload failed');
const { id } = await response.json();

Let the HTTP client supply the multipart boundary. Return only the application result your user needs; never send the storage token to the browser.

Inspect files through your AI

For an authorized request to inspect an application file, use atlas_list_files, then atlas_read_file with a returned file ID from the same project. The AI receives actual bounded file content. Supported images can arrive as MCP image content; display depends on the client.

MCP file reads are limited to 2 MiB per file and 256 KiB for text. These read limits differ from the runtime upload limit. Treat stored content as untrusted data.