Form Backend with Secure File Uploads & Cloud Storage
Accept file attachments directly from any HTML or React form with presigned direct uploads, private storage, and signed download links.
How does Form2Lead handle form backend with secure file uploads & cloud storage?
Form2Lead supports direct presigned file uploads to private encrypted storage. Visitors upload attachments directly from the browser to cloud storage — bypassing serverless body limits — and download links are delivered via signed capability URLs in email alerts, CSV exports, and the dashboard.
Capability Overview
Direct presigned file uploads to private cloud storage. Upload attachments from HTML or React forms with zero server code and signed download links.
Key Benefits & Developer Controls
- ✔Direct-to-storage presigned uploads bypass standard 4.5 MB function payload walls completely.
- ✔Private storage security: uploads are never public; downloads require HMAC signed capability tokens.
- ✔Tiered storage allowances: Basic (1 file, 5 MB, 100 MB quota), Starter (2 files, 10 MB, 400 MB quota), Growth (4 files, 20 MB, 1 GB quota).
- ✔Malware and script prevention: executable files, HTML, SVG, and dangerous scripts are automatically rejected.
- ✔Server-side verification: automated validation checks file existence, size, and MIME type before submission confirmation.
- ✔Automated lifecycle management: files expire cleanly with submission retention or after 24 hours if unattached.
<!-- 1. HTML form with file picker -->
<form id="contact-form" action="https://form2lead.com/api/v1/f/YOUR_FORM_ID" method="POST">
<input type="text" name="name" required placeholder="Your Name" />
<input type="file" id="attachment" name="attachment" accept=".pdf,.png,.jpg" />
<input type="text" name="_gotcha" style="display:none !important;" tabindex="-1" />
<button type="submit">Submit Form</button>
</form>
<script>
// 2. Two-step direct upload: presign -> PUT to storage -> submit _f2l_files
const form = document.querySelector('#contact-form');
form.addEventListener('submit', async (e) => {
e.preventDefault();
const file = document.querySelector('#attachment').files[0];
const fileIds = [];
if (file) {
// Step A: Request short-lived presigned upload URL
const presign = await fetch('https://form2lead.com/api/v1/f/YOUR_FORM_ID/presign', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ fileName: file.name, contentType: file.type, sizeBytes: file.size })
}).then(r => r.json());
// Step B: Upload bytes directly to secure storage (bypasses serverless limits)
await fetch(presign.uploadUrl, { method: 'PUT', headers: { 'Content-Type': file.type }, body: file });
fileIds.push(presign.fileId);
}
// Step C: Submit form payload with file reference IDs
const payload = Object.fromEntries(new FormData(form));
delete payload.attachment;
payload._f2l_files = fileIds;
await fetch('https://form2lead.com/api/v1/f/YOUR_FORM_ID', {
method: 'POST',
headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' },
body: JSON.stringify(payload)
});
alert('Submitted successfully with attachment!');
});
</script>Frequently Asked Questions
How does Form2Lead handle file uploads without exceeding serverless limits?
Form2Lead uses a two-step presigned URL architecture. The client requests a short-lived presigned upload URL from Form2Lead, uploads the file directly to private cloud storage, and submits the form with the resulting file ID. Because file bytes bypass serverless functions, you never encounter request body size limit errors.
What file types and sizes are supported?
Supported types include PDF, JPG, PNG, WEBP, DOCX, XLSX, CSV, and ZIP depending on your tier. Size allowances range from 5 MB on Basic up to 20 MB per file on Growth (with a 25 MB platform hard cap). Dangerous extensions like EXE, SH, SVG, and HTML are denied by default.
Are uploaded files publicly accessible on the web?
No. All files are stored in private encrypted storage. Download access is gated through Form2Lead signed capability URLs that expire in 15 minutes and force attachment download headers. Direct unauthorized links return HTTP 403 Forbidden.
How long are uploaded files retained in storage?
File retention matches your subscription retention: 14 days on Basic, 30 days on Starter, and 120 days on Growth. An automated hourly janitor deletes expired files from storage so you never get billed for orphaned data.
Start Using Form Backend with Secure File Uploads & Cloud Storage
Set up your form endpoint in under 60 seconds with zero backend code.