Backblaze B2 Cloud Storage

Log in to the Backblaze console at secure.backblaze.com. In the left sidebar, click B2 Cloud Storage → Buckets. Click Create a Bucket. Give the bucket a name (lowercase letters, numbers, and hyphens only). For Files in Bucket, choose Private — this is important if you want to use download authorization tokens. Leave the default encryption settings unless your compliance requirements need SSE-B2. Click Create a Bucket. Next, click App Keys in the left sidebar. Click Add a New Application Key. Give it a descriptive name. Under Allow access to Bucket(s), select the specific bucket you just created rather than all buckets — this limits the blast radius if the key is ever compromised. Under Type of Access, select Read and Write. Optionally set an expiration date. Click Create New Key. Copy both the keyID and the applicationKey that are displayed — the applicationKey is shown only once. These two values go into your backend function's environment variables only. The keyID is analogous to an AWS access key ID; the applicationKey is analogous to the secret access key. You will use them together as HTTP Basic Auth credentials in the b2_authorize_account call.

The core of this integration is a backend proxy that handles the dynamic nature of the B2 auth flow. Deploy a Firebase Cloud Function or Supabase Edge Function with the following logic: The function calls b2_authorize_account at https://api.backblazeb2.com/b2api/v2/b2_authorize_account using HTTP Basic Auth (keyID:applicationKey Base64-encoded in the Authorization header). The response contains: authorizationToken (a Bearer token for subsequent calls), apiUrl (the account-specific base URL for all B2 API calls), and downloadUrl (the base URL for file downloads). Cache these three values in the function's memory or in Firestore — the token is valid for 24 hours. Next, expose a /getUploadUrl endpoint that: calls b2_get_upload_url at {apiUrl}/b2api/v2/b2_get_upload_url with the Authorization header set to {authorizationToken} and the bucketId in the request body. This returns a one-time uploadUrl and a per-upload authorizationToken. Return both to FlutterFlow. Also expose a /getDownloadAuth endpoint that calls b2_get_download_authorization with the bucket name, file name prefix, and validDurationInSeconds, returning a downloadAuthorizationToken. FlutterFlow uses this token as a query parameter to construct private download URLs. Finally, expose a /listFiles endpoint that calls b2_list_file_names and returns a clean JSON array of file objects.

1// Firebase Cloud Function — B2 native API proxy
2// functions/index.js (Node.js)
3const functions = require('firebase-functions');
4const axios = require('axios');
5
6const KEY_ID = functions.config().b2.key_id;
7const APP_KEY = functions.config().b2.app_key;
8const BUCKET_ID = functions.config().b2.bucket_id;
9const BUCKET_NAME = functions.config().b2.bucket_name;
10
11// Cache auth result (valid 24h)
12let cachedAuth = null;
13
14async function getAuth() {
15  if (cachedAuth && Date.now() < cachedAuth.expiresAt) return cachedAuth;
16  const credentials = Buffer.from(`${KEY_ID}:${APP_KEY}`).toString('base64');
17  const res = await axios.get(
18    'https://api.backblazeb2.com/b2api/v2/b2_authorize_account',
19    { headers: { Authorization: `Basic ${credentials}` } }
20  );
21  cachedAuth = {
22    token: res.data.authorizationToken,
23    apiUrl: res.data.apiUrl,
24    downloadUrl: res.data.downloadUrl,
25    expiresAt: Date.now() + 23 * 60 * 60 * 1000, // 23h to be safe
26  };
27  return cachedAuth;
28}
29
30exports.b2GetUploadUrl = functions.https.onRequest(async (req, res) => {
31  res.set('Access-Control-Allow-Origin', '*');
32  if (req.method === 'OPTIONS') return res.status(204).send('');
33  const auth = await getAuth();
34  const upload = await axios.post(
35    `${auth.apiUrl}/b2api/v2/b2_get_upload_url`,
36    { bucketId: BUCKET_ID },
37    { headers: { Authorization: auth.token } }
38  );
39  res.json({
40    upload_url: upload.data.uploadUrl,
41    upload_auth_token: upload.data.authorizationToken,
42  });
43});
44
45exports.b2GetDownloadAuth = functions.https.onRequest(async (req, res) => {
46  res.set('Access-Control-Allow-Origin', '*');
47  if (req.method === 'OPTIONS') return res.status(204).send('');
48  const { fileName, validSeconds } = req.body;
49  const auth = await getAuth();
50  const dlAuth = await axios.post(
51    `${auth.apiUrl}/b2api/v2/b2_get_download_authorization`,
52    { bucketName: BUCKET_NAME, fileNamePrefix: fileName, validDurationInSeconds: validSeconds || 900 },
53    { headers: { Authorization: auth.token } }
54  );
55  const downloadToken = dlAuth.data.authorizationToken;
56  const fileUrl = `${auth.downloadUrl}/file/${BUCKET_NAME}/${fileName}?Authorization=${downloadToken}`;
57  res.json({ download_url: fileUrl });
58});
59
60exports.b2ListFiles = functions.https.onRequest(async (req, res) => {
61  res.set('Access-Control-Allow-Origin', '*');
62  if (req.method === 'OPTIONS') return res.status(204).send('');
63  const auth = await getAuth();
64  const list = await axios.post(
65    `${auth.apiUrl}/b2api/v2/b2_list_file_names`,
66    { bucketId: BUCKET_ID, maxFileCount: 100 },
67    { headers: { Authorization: auth.token } }
68  );
69  res.json({ files: list.data.files.map(f => ({ name: f.fileName, size: f.contentLength, id: f.fileId })) });
70});
71

In FlutterFlow, create two API Groups. The first talks to your proxy to get upload URLs and download tokens. The second performs the actual file upload directly to B2's one-time upload URL. API Group 1 — name it B2Proxy. Set the base URL to your Firebase function base URL (https://us-central1-your-project.cloudfunctions.net). Add a Content-Type header: application/json. Add three API Calls: - getUploadUrl: method GET, endpoint /b2GetUploadUrl. In the Response & Test tab, add JSON paths $.upload_url and $.upload_auth_token. - getDownloadAuth: method POST, endpoint /b2GetDownloadAuth. Body: {"fileName":"{{fileName}}","validSeconds":900}. Add fileName variable (String). JSON path: $.download_url. - listFiles: method GET, endpoint /b2ListFiles. JSON paths: $.files[*].name, $.files[*].size, $.files[*].id. API Group 2 — name it B2Upload. This group has a variable base URL because B2's upload endpoint is returned dynamically. In practice, you will use the full upload_url returned by getUploadUrl as the endpoint for a single API Call named uploadFile. Set method to POST. Add these headers as variables (not static): Authorization bound to the upload_auth_token variable, Content-Type bound to the file MIME type, X-Bz-File-Name bound to the filename (URL-encoded), X-Bz-Content-Sha1 bound to the file content hash or the literal string do_not_verify_sha1 for simplicity during development. Body type: Binary.

1// B2Proxy API Group — reference config
2{
3  "base_url": "https://us-central1-your-project.cloudfunctions.net",
4  "calls": [
5    {
6      "name": "getUploadUrl",
7      "method": "GET",
8      "endpoint": "/b2GetUploadUrl",
9      "response_paths": ["$.upload_url", "$.upload_auth_token"]
10    },
11    {
12      "name": "getDownloadAuth",
13      "method": "POST",
14      "endpoint": "/b2GetDownloadAuth",
15      "body": { "fileName": "{{fileName}}", "validSeconds": 900 },
16      "response_paths": ["$.download_url"]
17    },
18    {
19      "name": "listFiles",
20      "method": "GET",
21      "endpoint": "/b2ListFiles",
22      "response_paths": ["$.files[*].name", "$.files[*].size", "$.files[*].id"]
23    }
24  ]
25}
26
27// B2Upload API Call — headers from variables
28{
29  "name": "uploadFile",
30  "method": "POST",
31  "endpoint": "{{uploadUrl}}",
32  "headers": {
33    "Authorization": "{{uploadAuthToken}}",
34    "Content-Type": "{{contentType}}",
35    "X-Bz-File-Name": "{{fileName}}",
36    "X-Bz-Content-Sha1": "do_not_verify_sha1"
37  },
38  "body_type": "binary"
39}
40

On your upload page, wire the following action sequence in the Action Flow Editor for an Upload button: Step 1: File Picker action — lets the user select a file. Store the file bytes in a Page State variable fileBytes and the file name in fileName. Step 2: API Call action → B2Proxy → getUploadUrl — this returns a one-time uploadUrl and an uploadAuthToken. Store both in Page State variables (uploadUrl, uploadAuthToken). The upload URL is single-use — request it immediately before the upload, not in advance. Step 3: API Call action → B2Upload → uploadFile — set the endpoint variable uploadUrl to the Page State variable uploadUrl, uploadAuthToken to the stored token, contentType to the appropriate MIME type (image/jpeg, application/pdf, etc.), fileName to the Page State fileName (URL-encode any spaces as %20), and the binary body to fileBytes. Step 4: On success (response code 200), add a Snackbar action (File uploaded successfully) and trigger a backend query refresh on your file list. For the file list, add a ListView with a Backend Query → B2Proxy → listFiles. Display $.files[*].name as the file name. For each file's View button, add an API Call action → B2Proxy → getDownloadAuth binding fileName to the list item's $.files[*].name. After the call, add a Launch URL action bound to the returned $.download_url to open the file in the device browser, or load it into a WebView widget.

Start testing in FlutterFlow's Run mode with a small image file (under 100 KB) to verify the proxy calls work. Because the upload goes to a dynamic URL returned by the proxy, you should see two API Call actions in sequence in the action flow — the first returning the uploadUrl and the second consuming it. Check common failure points: open your Firebase console → Functions → Logs while running a test upload. If b2_authorize_account fails, check that the keyID and applicationKey environment variables are set correctly. If the upload returns a 401, confirm the uploadAuthToken is being passed in the Authorization header and that you are not trying to reuse a single-use upload URL for a second file. For private bucket downloads, test the getDownloadAuth flow with a file you know exists. The returned download_url includes the Authorization token as a query parameter — this is how B2 authorizes private file access without requiring the app to send a Bearer header (which would mean putting credentials in the app). For large files (over 100 MB), the single-call upload path may time out on slow connections. The native B2 API's large-file API (b2_start_large_file → b2_get_upload_part_url → b2_upload_part × N → b2_finish_large_file) handles this. Add a proxy endpoint for each step and implement the chunked upload in a Custom Action in Dart. If the two-step auth proxy and dynamic URL wiring feels complex for your current stage, RapidDev's team builds FlutterFlow integrations like this regularly — get a free scoping call at rapidevelopers.com/contact.