Google Cloud Storage

Upload-Here uses a service account that can create objects in your bucket. It does not need read or delete access.

1. Create a service account

1. In the Google Cloud console open IAM & Admin → Service Accounts → Create service account.
2. Name it, e.g. upload-here, and click Create and continue. Skip project-level roles — we'll grant access on the bucket only.
3. Open the new service account → Keys → Add key → Create new key → JSON. A JSON file is downloaded; keep it safe.

2. Grant access to your bucket

Open Cloud Storage → Buckets → your bucket → Permissions → Grant access:

• Principal: the service account email (upload-here@<project>.iam.gserviceaccount.com)
• Role: Storage Object Creator (roles/storage.objectCreator)

Optional: also grant a role containing storage.objects.list (for example a custom role with only that permission). With it, we can check whether a file name is already taken and keep the original name when it isn't. Without it, every uploaded file gets a timestamp suffix so nothing is overwritten.

3. Configure CORS on the bucket

Save the following as cors.json:

[
  {
    "origin": ["https://new.upload-here.com"],
    "method": ["PUT", "POST", "OPTIONS"],
    "responseHeader": ["Content-Type", "Content-Range", "Range", "x-goog-resumable"],
    "maxAgeSeconds": 3600
  }
]

Apply it with the gcloud CLI (Cloud Shell works too):

gcloud storage buckets update gs://YOUR-BUCKET --cors-file=cors.json

4. Add the credentials to Upload-Here

Go to Dashboard → Storage → Google Cloud, paste the entire contents of the JSON key file, enter your bucket under Test bucket and click Test & save.