Close to your users.Clear about access.

Delivery starts with the access you intended.

A file arriving in storage is not permission to publish it. Customer documents need a different path from website images, and a cached copy must not quietly outlive the access you meant to grant. Fortly puts these choices beside the bucket: signed links for protected files, or an explicitly published folder for public assets. S3 stays authenticated either way.

Open Storage, select a bucket and choose Delivery. The default is disabled. Start with signed links, choose a cache lifetime and generate a URL for an exact object. For public assets, select a folder such as public/, review the file count and examples, then confirm the exposure. Nothing outside that folder becomes public, and an upload by itself does not activate delivery.

Cache the body. Check the permission.

Fortly uses a dedicated Cloudflare Worker to keep eligible file bodies at the edge. Each request still checks current bucket ownership, delivery scope, object version, signing-key access and the shared delivery budget before receiving bytes. A cache hit is a faster source of the body, not a permanent authorization decision. If that check cannot complete, Fortly refuses the request instead of serving stale private data.

An overwrite selects a new object version automatically. Deleting an object or pausing delivery blocks subsequent requests, including hits. Purge cache starts a fresh cache generation for new requests across edge locations. Existing physical copies expire in the background; the control does not pretend that a local cache delete instantly erases every copy around the world. Already downloaded files cannot be recalled.

Choose an edge cache lifetime from one minute to 24 hours. That lifetime controls reuse of unchanged bytes; it does not extend a private link's expiry. Browsers revalidate public responses, while signed responses remain private and no-store. Body-cache reuse happens inside the Worker after the current access decision. Cloudflare's Cache API is per-location and best effort, so a repeat read is eligible for a hit rather than guaranteed one.

Full GET bodies up to 16 MiB can enter the cache. Larger objects stream from the origin without whole-file buffering. A single byte range bypasses the body cache, HEAD returns metadata without file bytes, and a matching ETag can return 304. The response reports HIT, MISS or BYPASS so a developer can inspect what happened instead of guessing from a spinner.

A cache you can actually inspect.

Follow admitted requests and processed body bytes over the last hour, day, week or 30 days. Switch between request and data-transfer charts without losing the window. Inspect points, toggle series, open the data table or export CSV. The view follows Fortly’s light and dark themes and stacks naturally on a phone.

HIT, MISS and BYPASS are only the start. See when metadata reads, conditional responses, byte ranges or large objects skip the body cache. Review measured response and authorization timing, HTTP statuses and recorded edge locations. Select a breakdown to inspect matching receipts, then use the opaque request ID to correlate a response without putting a signed URL into support logs.

A bounded cache check tests a small file with real metadata and repeat reads, reporting what the edge actually did. It does not pretend that a second request must hit an asynchronous, location-local cache. New telemetry remains separate from stored-file capacity and financial settlement.

The coverage boundary is visible: this dashboard reports the admitted-request ledger. Rejected or failed edge requests before admission are outside its counters, and old measurements remain unmeasured. It is not a claim to duplicate Cloudflare’s zone-wide analytics. Explore cache metrics, request inspection and coverage.

From a private upload to a useful URL.

Upload through the console or your S3 client, then return to the same object in Files. Its actions offer Create delivery link when the file falls inside an enabled delivery scope. Private console links default to 15 minutes. Public folder links remain stable while that scope is published. The console identifies which kind of link it creates and explains the action that will block future requests.

For server-generated private links, use the app's existing read-only or read/write bucket credential with Fortly's documented CDN signing helper. This is a separate delivery-token format, not an AWS presigned URL pointed at a different host. Keep S3 SDK traffic on the S3 endpoint, and CDN URLs on cdn.fortly.com. The console and docs show both paths explicitly.

Folder scope applies to future uploads too. Publishing public/ includes public/logo.png but does not include publicity/private.png or private/invoice.pdf. Public mode requires a nonempty folder and an explicit confirmation, with a preview before saving. Changing the bucket's display name does not move files or change the stable S3 name used in delivery URLs.

Follow the complete setup and server signing example · Explore the underlying storage workflow

The stored file counts once. Delivery is visible.

Your original object remains in the existing shared storage allowance alongside participating Project files, multipart data and pending cleanup. A cached edge body does not become a second customer stored-object charge. Delivery requests and processed response bytes are separate measurements, with account-wide operational budgets spanning all buckets.

Both hits and misses reserve their expected response bytes before serving. Concurrent edges cannot all spend the same remaining allowance. Completion receipts reconcile reservations to processed bytes; an interrupted response records its progress, and a missing receipt remains conservatively reserved. HEAD and 304 contribute requests without a full-object byte charge. A byte range contributes its selected response body.

Delivery shows requests, processed data, pending admission, hit rate and failures for the current UTC month, plus the account's shared budget. Reaching a configured request or byte budget pauses new CDN delivery and preserves stored files and authenticated S3 access. These are measurable limits, not an invented overage price, prepaid wallet or automatic invoice. Payment settlement is a separate integration.

Understand stored capacity and delivery budgets before a larger import or public launch.

Retire access without retiring the app.

Use a separate key for each integration. Rotate it, verify the replacement and revoke the previous key when the cutover is complete. Revocation blocks that key's subsequent S3 and signed CDN requests, even when an old body remains cached. Console-generated links use a hidden read-only signer that can be revoked together; separately scoped application keys and public folder URLs remain unaffected.

Pause delivery when a distribution should stop answering, or narrow a public prefix to remove its publication scope. Resuming can make previously issued, unexpired links usable again, so revoke the signing key when those links must remain blocked. An application-user permission change should also be reflected in the app's decision to issue new links. A delivered URL remains a bearer credential until it expires or its access is retired.

Fortly strips cookies and client authorization from origin requests, does not put signing queries into cache identities, and uses a separate origin for customer files. Untrusted HTML, SVG and other active documents use attachment and sandbox protections. Edge request logs are disabled by default because private URLs are credentials. Object names, content and signing material are excluded from the delivery usage ledger and MCP discovery.

Know what is enabled before you depend on it.

Delivery is available on hosted Fortly and starts disabled for each new bucket. Choose signed links for private files or explicitly confirm one public asset folder. The account-wide monthly safety limits are 100,000 admitted requests and 10 GiB of response-body budget, shared across buckets; Delivery shows current usage and remaining headroom. These limits do not introduce an automatic usage charge. Self-hosted operators configure and verify the dedicated Worker, private origin and budgets using the linked rollout guide.

This release does not provide custom delivery domains, image resizing, tiered caching, automatic overage billing or object recovery retention. PostgreSQL restores do not rewind bucket files. Use supported operations, test your chosen content types and keep separate copies when your retention policy requires them. The documentation explains current boundaries beside runnable examples.