Wasabi

Log in to the Wasabi console at console.wasabisys.com. Click Buckets in the left sidebar, then click Create Bucket. Give the bucket a unique name (all lowercase, no spaces), select the region closest to your users (for example us-east-1, eu-central-1, ap-southeast-1), and leave versioning and logging settings as default for a basic setup. Click Create Bucket. Note the exact region you chose — you will need it to construct the correct Wasabi endpoint URL. Each Wasabi region has its own endpoint: us-east-1 uses s3.us-east-1.wasabisys.com, us-west-1 uses s3.us-west-1.wasabisys.com, eu-central-1 uses s3.eu-central-1.wasabisys.com, and so on. Using the wrong endpoint for your bucket's region causes signature mismatches and 403 errors. Next, click Access Keys in the left sidebar and then Create Access Key. Give it a name and optionally restrict it to specific buckets. Click Create and copy both the Access Key ID and the Secret Access Key immediately — the Secret Access Key is shown only once. These credentials will live only in your backend function environment variables, never in FlutterFlow.

Deploy a backend function that holds your Wasabi credentials and generates presigned URLs on demand. The function uses the AWS SDK for JavaScript (or Python's boto3 equivalent) pointed at your Wasabi regional endpoint instead of the default AWS S3 endpoint. In your Firebase console, create a new HTTP Cloud Function named wasabiPresign. The function accepts a POST request with a JSON body containing the desired operation (PUT for upload or GET for download), the object key (the path and filename within the bucket), and optionally the content type for PUT operations. It uses the AWS SDK's getSignedUrlPromise to generate a presigned URL valid for 900 seconds (15 minutes) and returns it in the response. For the S3 client configuration, set the endpoint to your Wasabi region's URL, set the region to match, and provide your Wasabi access key ID and secret. The AWS SDK treats Wasabi's endpoint as an S3-compatible service — this is the whole point of the S3-compatible interface. For listing objects (to display a file browser), add a separate /list endpoint that calls s3.listObjectsV2 and returns a clean JSON array of object keys. This avoids sending the raw XML response from Wasabi to FlutterFlow.

1// Firebase Cloud Function — Wasabi presign proxy
2// functions/index.js (Node.js)
3const functions = require('firebase-functions');
4const AWS = require('aws-sdk');
5
6const s3 = new AWS.S3({
7  endpoint: 'https://s3.us-east-1.wasabisys.com', // Change to your region
8  region: 'us-east-1',
9  accessKeyId: functions.config().wasabi.access_key_id,
10  secretAccessKey: functions.config().wasabi.secret_access_key,
11  signatureVersion: 'v4',
12});
13
14const BUCKET = functions.config().wasabi.bucket;
15
16exports.wasabiPresign = functions.https.onRequest(async (req, res) => {
17  res.set('Access-Control-Allow-Origin', '*');
18  if (req.method === 'OPTIONS') return res.status(204).send('');
19
20  const { operation, key, contentType } = req.body;
21  if (!operation || !key) {
22    return res.status(400).json({ error: 'Missing operation or key' });
23  }
24
25  const params = {
26    Bucket: BUCKET,
27    Key: key,
28    Expires: 900, // 15 minutes
29    ...(operation === 'PUT' && contentType ? { ContentType: contentType } : {}),
30  };
31
32  const method = operation === 'PUT' ? 'putObject' : 'getObject';
33  const url = await s3.getSignedUrlPromise(method, params);
34  res.json({ url, expires_in: 900 });
35});
36
37exports.wasabiList = functions.https.onRequest(async (req, res) => {
38  res.set('Access-Control-Allow-Origin', '*');
39  if (req.method === 'OPTIONS') return res.status(204).send('');
40
41  const { prefix } = req.query;
42  const data = await s3.listObjectsV2({
43    Bucket: BUCKET,
44    Prefix: prefix || '',
45  }).promise();
46
47  const objects = data.Contents.map(obj => ({
48    key: obj.Key,
49    size: obj.Size,
50    last_modified: obj.LastModified,
51  }));
52  res.json({ objects });
53});
54

In FlutterFlow, you need two API Groups. The first talks to your backend proxy to get the presigned URL. The second makes the actual PUT to Wasabi using the presigned URL. Create API Group 1 — name it WasabiProxy. Set the base URL to your Firebase function base URL (for example https://us-central1-your-project.cloudfunctions.net). Add a Content-Type header with value application/json. Add an API Call named getPresignedUrl: method POST, endpoint /wasabiPresign. In the Request Body, set type JSON with body {"operation":"{{operation}}","key":"{{key}}","contentType":"{{contentType}}"}. Add variables: operation (String), key (String), contentType (String). In the Response & Test tab, generate JSON paths including $.url. Add a second API Call named listObjects: method GET, endpoint /wasabiList?prefix={{prefix}}. Add a prefix variable (String, default empty). Generate JSON paths for $.objects[*].key and $.objects[*].last_modified. Create API Group 2 — name it WasabiUpload. Set the base URL to https://s3.{your-region}.wasabisys.com. This group will have only one API Call named uploadToPresignedUrl: method PUT, endpoint /{{presignedPath}} (the path portion of the presigned URL). Add a Content-Type header with value {{contentType}} and a variable for contentType. The body type is Binary. Note: in practice you will PUT directly to the full presigned URL returned by your proxy — in FlutterFlow this means using an API Call with the complete presigned URL as the endpoint and no additional auth headers, since the signature is baked into the URL.

1// WasabiProxy API Group — reference
2{
3  "base_url": "https://us-central1-your-project.cloudfunctions.net",
4  "headers": { "Content-Type": "application/json" },
5  "calls": [
6    {
7      "name": "getPresignedUrl",
8      "method": "POST",
9      "endpoint": "/wasabiPresign",
10      "body": {
11        "operation": "{{operation}}",
12        "key": "{{key}}",
13        "contentType": "{{contentType}}"
14      }
15    },
16    {
17      "name": "listObjects",
18      "method": "GET",
19      "endpoint": "/wasabiList"
20    }
21  ]
22}
23

If your FlutterFlow app will run in a browser (web build), Wasabi must allow cross-origin PUT requests from your app's domain. Without CORS configuration, browser uploads fail with an XMLHttpRequest error even though the presigned URL is valid. In the Wasabi console, select your bucket → Properties → CORS Configuration (or Bucket Policies → CORS). Enter a CORS policy that allows PUT and GET from your app's origin. For development, allow all origins with * — tighten this to your specific domain before production. Now wire the upload action flow in FlutterFlow. On your upload button, create this sequence in the Action Flow Editor: 1) File Picker action — lets the user select a file and returns file bytes and the original filename. Store both in Page State variables (fileBytes, fileName). 2) API Call action → WasabiProxy → getPresignedUrl — pass operation=PUT, key={{fileName}}, contentType=image/jpeg (or the appropriate MIME type). Store the returned $.url in a Page State variable named presignedPutUrl. 3) API Call action → WasabiUpload → uploadToPresignedUrl — set the endpoint to {{presignedPutUrl}} (the full URL from step 2), body type Binary bound to fileBytes, Content-Type header matching what you passed to getPresignedUrl. 4) On success, call WasabiProxy → listObjects to refresh the file list. For the object list view, add a ListView with backend query WasabiProxy → listObjects and display $.objects[*].key as the file name in each list item.

Test the upload flow on both platforms. On mobile (Android APK or iOS TestFlight build), the PUT to a presigned URL should work without any CORS configuration since mobile apps do not enforce CORS. On web, open the browser developer tools Network tab to confirm the PUT request to the Wasabi presigned URL returns a 200 status. If you see a CORS error, return to the Wasabi console and verify the CORS policy is saved and references your app's domain or *. Presigned URLs expire after the configured window (900 seconds in the example proxy). If a user spends more than 15 minutes on the upload screen before tapping Upload, the URL will be expired and the PUT will return a 403 AccessDenied error. Handle this in the action flow: before executing the PUT, check whether more than 10 minutes have passed since requesting the URL (use a Page State variable to track the request timestamp), and if so, call getPresignedUrl again to fetch a fresh URL. For displaying uploaded images, construct the public object URL: https://s3.{region}.wasabisys.com/{bucket}/{key} if the bucket has public read access, or call your proxy's /wasabiPresign endpoint with operation=GET to generate a presigned download URL for private objects. If you need help building or tuning the presign proxy or the FlutterFlow upload flow, RapidDev's team handles FlutterFlow integrations like this regularly — schedule a free scoping call at rapidevelopers.com/contact.