Best of · Everyday APIs
Best file storage and sharing APIs for AI agents
The 10 highest-scoring of 14 file storage and sharing APIs on the Anchor benchmark, with a pick for each need and where each one falls short. Scores come from public evidence, re-checked as vendors change.
- 14 ranked
- 6 agent-ready
- 14 hosted endpoints
- Updated 9 October 2026
Top three
Picks by need
Worked out from the scores, prices and facts, so they change when the research does.
Schema & documentation
Amazon S3 BB
92/100 on schema & documentation, against 83 for the overall leader.
Maintenance & community
90/100 on maintenance & community, against 85 for the overall leader.
Transparency & trust
90/100 on transparency & trust, against 75 for the overall leader.
Lowest paid price per GB
$0.005 per GB, the lowest of the 6 listings here with a paid price in this unit (free allowances aside).
Also Cloudflare R2, $0.01 per GB.
Self-hosting under an open licence
self-hosted, Apache-2 licence.
Also Backblaze B2, self-hosted, MIT licence.
The shortlist
| # | Tool | Grade | Best for | Price | Where |
|---|---|---|---|---|---|
| 1 | Google Drive API + MCP |
A 79.6 | Agents working on files that people already keep in Drive, inside a Workspace organisation with admin controls. | Free | hosted |
| 2 | Amazon S3 Amazon Web Services |
BB 77.9 | Best when the rest of the stack is on AWS or the job needs versioning, Object Lock, replication or event notifications, and when an operator wants per-prefix, per-hour credentials for an agent. | $0.005 / 1k req | hosted |
| 3 | Cloudflare R2 Cloudflare |
BB 77.1 | Files an agent stores and then serves to the public, where free egress dominates, and for operators who want short-lived, path-scoped credentials. | $0.0045 / 1k req | hosted |
| 4 | Azure Blob Storage Microsoft Corporation |
BB 75.7 | Agents and runtimes already on Azure, where a managed identity writes to one container with no stored key, and jobs that need tiers, immutability or geo-redundant copies. | $0.005 / 1k req | hosted |
| 5 | Supabase API + MCP Supabase |
BB 75.6 | Agents building on or administering Supabase projects, and for retrieval that wants vectors, full-text and SQL filters in one database. | $25 / mo | hosted and local |
| 6 | Backblaze B2 Backblaze |
BB 75.3 | Cheap bulk storage that an agent writes and a CDN serves, and for operators who want an MCP server with real guardrails. | $0.01 / GB | hosted and local |
| 7 | Box API + MCP Box |
B 69.4 | Agents working inside an enterprise's existing Box content with admin oversight, Box AI extraction and audit needs. | Your plan | hosted |
| 8 | Dropbox API + MCP Dropbox |
B 68.2 | An agent acting on a person's or team's existing Dropbox files, especially a solo user on the free plan. | Your plan | hosted |
| 9 | OneDrive and SharePoint files (Microsoft Graph) Microsoft |
B 65.3 | Agents working on files that already live in a Microsoft 365 tenant or a personal OneDrive, where sharing has to follow the tenant's own policy. | Your plan | hosted |
| 10 | DigitalOcean Spaces DigitalOcean, LLC |
B 63.2 | Teams already on DigitalOcean that want object storage with a CDN and a flat $5 entry price for up to 250 GiB, with free transfer to Droplets in the same region. | $5 / mo | hosted |
4 more are ranked in the full table.
How to choose
- Egress fees on downloadsEstimate the egress charge for the downloads the agent will make, because storage that is cheap to keep can cost more once files are read back out.
- Expiring share link behaviourTest that a share link stops working at its expiry time, since an agent that sends a link to someone else depends on the expiry being enforced.
- Access controls and deletionCheck who can delete or list files under each credential, because an agent given write access to a bucket can remove files it was never meant to touch.
- Jurisdiction and legal entityRead which legal entity and jurisdiction hold the stored files, since the location of the data can shape which rules apply to what the agent uploads.
How the benchmark tests this category. An agent uploads a large file, lists a folder, shares a link that expires and deletes the file. We check the upload path, access controls, link expiry, and the storage and egress costs.
Each one in detail
Google Drive API + MCP
A 79.6/100REST API for a user's or a Workspace organisation's Drive, files, folders, permissions and share links, with resumable uploads and change feeds.
Verdict No charge for API calls within quota, counted in quota units per minute per project and per user. OAuth consent, scope verification and a Cloud project before an agent can list a folder.
Choose it for Agents working on files that people already keep in Drive, inside a Workspace organisation with admin controls.
Strengths
- No charge for API calls within quota, counted in quota units per minute per project and per user
- Public discovery document, refreshed three times in September 2026, and 40-odd documented error reasons with backoff advice
- Official MCP server with eight tools, none that delete or share, and a setup page that warns about prompt injection
Weaknesses
- OAuth consent, scope verification and a Cloud project before an agent can list a folder
- The MCP server is Developer Preview and needs your own OAuth client and programme membership
- expirationTime can't be set on domain or anyone shares, so a public link never expires on its own
Price FreeAuth OAuthx402 nohosted
Amazon S3
BB 77.9/100AWS object storage for files, backups and application data, accessed through an API.
Verdict STS session credentials with session policies, so an agent can hold one prefix for an hour. Egress to the internet is billed per GB after 100 GB a month.
Choose it for Best when the rest of the stack is on AWS or the job needs versioning, Object Lock, replication or event notifications, and when an operator wants per-prefix, per-hour credentials for an agent.
Strengths
- STS session credentials with session policies, so an agent can hold one prefix for an hour
- SLA of 99.9 per cent a month on Standard, and documented rates of 3,500 writes and 5,500 reads a second per prefix
- Conditional writes, and conditional deletes since 16 September 2025, make retried calls safe
Weaknesses
- Egress to the internet is billed per GB after 100 GB a month
- The pricing page renders the Standard table by script, so an agent reading it sees no Standard rate
- Signup needs a person in a browser, though since October 2026 most new accounts aren't asked for a payment card
Price $0.005 / 1k reqAuth API keyx402 nohosted
Cloudflare R2
BB 77.1/100S3-compatible object storage with no egress fees.
Verdict Free egress and a monthly free tier of 10 GB-month plus 1 million writes, though enabling R2 needs a checkout with a payment method on the account. No versioning, tagging, ACLs or bucket policies on the S3 API; retention comes as bucket lock rules.
Choose it for Files an agent stores and then serves to the public, where free egress dominates, and for operators who want short-lived, path-scoped credentials.
Strengths
- Free egress and a free tier of 10 GB-month plus 1 million writes a month
- Temporary credentials bound to a bucket, operations and paths that expire on their own
- An error table of 29 codes, each with an HTTP status and a recommended fix
Weaknesses
- No versioning, tagging, ACLs or bucket policies on the S3 API; retention comes as bucket lock rules
- Presigned URLs don't work on custom domains and can't do POST form uploads
- One write a second to the same object key, with a 429 above that
Price $0.0045 / 1k reqAuth API keyx402 nohosted
Azure Blob Storage
BB 75.7/100Microsoft Azure's object storage for files, backups and application data. Agents call a REST API or the Azure SDKs on a storage account, signing in with Microsoft Entra ID, an account key or a shared access signature.
Verdict Microsoft Entra ID roles can be scoped to one container, and a user delegation signature hands out a link that expires within seven days. Account keys with full access stay enabled until the owner turns them off, request logs are off until configured, and an Azure account needs a person, a phone number and a payment card.
Choose it for Agents and runtimes already on Azure, where a managed identity writes to one container with no stored key, and jobs that need tiers, immutability or geo-redundant copies.
Strengths
- Microsoft Entra ID roles such as Storage Blob Data Reader can be assigned on one container, with no stored key for workloads on Azure
- A user delegation shared access signature is signed with Entra credentials, lasts at most seven days and can be limited by permission, IP address and protocol
- SLA of 99.9 per cent on the hot tier, 99.99 per cent for reads on RA-GRS accounts, in the 1 October 2026 SLA document
Weaknesses
- Shared Key authorisation with the account's access keys is allowed until the owner sets
AllowSharedKeyAccessto false - Request logs are not collected until a diagnostic setting routes the StorageRead, StorageWrite and StorageDelete categories somewhere
- Requests and responses use headers and XML, and every authorised call must carry
x-ms-version
Price $0.005 / 1k reqAuth OAuth or keyx402 nohosted
Supabase API + MCP
BB 75.6/100Hosted Postgres with an auto-generated REST API (PostgREST), GraphQL, auth, storage, realtime and Edge Functions, plus a Management API and an official MCP server.
Verdict OAuth 2.1 with dynamic client registration, plus personal access tokens scoped to chosen projects and permissions. Several multi-hour platform incidents between 27 August and 30 September.
Choose it for Agents building on or administering Supabase projects, and for retrieval that wants vectors, full-text and SQL filters in one database.
Strengths
- OAuth 2.1 with dynamic client registration, plus personal access tokens scoped to chosen projects and permissions
read_only,project_refandfeaturescut the server from 34 tools to as few as 6 and run SQL as a read-only role- Destructive SQL and cost-bearing creates ask for confirmation through elicitation since v0.13.0
Weaknesses
- Several multi-hour platform incidents between 27 August and 30 September
- Read-write with seven feature groups is the default, and the agent plugin has no read-only option
- Untrusted data in tables can still steer an agent that reads it, as Supabase says itself
Price $25 / moAuth OAuth or keyx402 nohosted and local
Backblaze B2
BB 75.3/100Object storage at $6.95 a TB-month with the first 10 GB free, egress free up to three times what you store and $0.01 a GB after, and no charge for most API calls.
Verdict $6.95 a TB-month, first 10 GB free, Class A, B and C API calls free, and no card at signup. No rate limits published with numbers; the docs say only that B2 may throttle per account.
Choose it for Cheap bulk storage that an agent writes and a CDN serves, and for operators who want an MCP server with real guardrails.
Strengths
- $6.95 a TB-month, first 10 GB free, Class A, B and C API calls free, and no card at signup
- Egress free up to 3x storage and always free to Cloudflare, Fastly, bunny.net and other partners
- Official MCP server with 40 annotated tools, capability-aware registration and a confirm or block gate on destructive tools
Weaknesses
- No rate limits published with numbers; the docs say only that B2 may throttle per account
- status.backblaze.com renders only with JavaScript, so its incident history can't be read by a script
- STS temporary credentials are in Limited Availability for Enterprise customers only, from 30 September 2026
Price $0.01 / GBAuth API keyx402 nohosted and local
Box API + MCP
B 69.4/100Enterprise content platform with a REST API for files, folders, shared links, collaborations, metadata and Box AI, published as OpenAPI with year-based API versions.
Verdict Public OpenAPI 3.0 spec with 297 operations, year-based API versions and an llms.txt of Markdown pages. 20 status-feed entries between 7 July and 1 October 2026, two of them over two hours on uploads or multiple services.
Choose it for Agents working inside an enterprise's existing Box content with admin oversight, Box AI extraction and audit needs.
Strengths
- Public OpenAPI 3.0 spec with 297 operations, year-based API versions and an llms.txt of Markdown pages
- At least 24 months between deprecation and retirement of an API version, with Deprecation response headers
- Official remote MCP server with OAuth, 57 tools and 22 riskier ones off until an admin enables them
Weaknesses
- 20 status-feed entries between 7 July and 1 October 2026, two of them over two hours on uploads or multiple services
- MCP server needs Business or above, a three-seat minimum, and admin enablement per tool group
- The MCP server asks for root_readwrite, so a connected agent can write wherever its user can once tools are on
Price Your planAuth OAuthx402 nohosted
Dropbox API + MCP
B 68.2/100HTTP API v2 for a user's or team's Dropbox, files, folders, upload sessions to about 2 TiB, shared links with passwords and expiry, file requests and change cursors.
Verdict Typed Stone spec of 281 routes with per-route OAuth scopes and error unions, updated 1 October 2026. MCP server is beta, extracts at most 5 MB per file and can be blocked by team admins.
Choose it for An agent acting on a person's or team's existing Dropbox files, especially a solo user on the free plan.
Strengths
- Typed Stone spec of 281 routes with per-route OAuth scopes and error unions, updated 1 October 2026
- Granular OAuth scopes and App folder apps that see one folder
- Official hosted MCP server with OAuth and dynamic client registration, no app to register
Weaknesses
- MCP server is beta, extracts at most 5 MB per file and can be blocked by team admins
- Link expiry and passwords aren't available to Basic accounts
- No numeric rate limits published; the developer terms let Dropbox cap calls at its discretion
Price Your planAuth OAuthx402 nohosted
OneDrive and SharePoint files (Microsoft Graph)
B 65.3/100Drive and driveItem endpoints of Microsoft Graph for files in OneDrive, OneDrive for work or school and SharePoint document libraries. Calls upload, download, list, search, share by link or invitation, and delete files and folders.
Verdict One REST surface covers personal OneDrive, work OneDrive and SharePoint libraries, with resumable uploads, sharing links that take an expiry date and per-file Selected permissions. The status page needs JavaScript, an app must be registered and consented to by a person, and the JavaScript client on npm lacks a token-leak fix merged in June 2026.
Choose it for Agents working on files that already live in a Microsoft 365 tenant or a personal OneDrive, where sharing has to follow the tenant's own policy.
Strengths
- Upload sessions resume after a dropped connection, report
nextExpectedRanges, and acceptIf-Matchand@microsoft.graph.conflictBehavior(fail by default) createLinktakesexpirationDateTimeand a scope ofanonymous,organizationorusers, and returns the existing link when one of that type exists- Selected scopes limit an application to chosen sites, lists, folders or files, each with a read, write, owner or fullcontrol role
Weaknesses
- Link and scope types are plain strings in the OpenAPI, and path addressing such as
/root:/folder/file.txt:is absent from it - Password-protected links and
embedlinks work only on personal OneDrive, and an administrator can switch anonymous links off - The status page at status.cloud.microsoft shows nothing without JavaScript, so no incident history could be read
Price Your planAuth OAuthx402 nohosted
DigitalOcean Spaces
B 63.2/100DigitalOcean Spaces is S3-compatible object storage with a built-in CDN, sold as a $5 monthly subscription. Agents use it through AWS S3 SDKs with a Spaces access key, and manage keys through the DigitalOcean API or MCP server.
Verdict Per-bucket access keys with read or read-write-delete grants, an 800 operations a second limit per bucket and a 99.9 per cent SLA are all published. The MCP server manages keys and CDN endpoints only, not objects, and the S3 reference documents no error codes. A payment method is required before any bucket is created.
Choose it for Teams already on DigitalOcean that want object storage with a CDN and a flat $5 entry price for up to 250 GiB, with free transfer to Droplets in the same region.
Strengths
- Spaces access keys can be limited to named buckets with read or read-write-delete grants, and are created through
/v2/spaces/keysor the control panel - Limits are published with numbers, 800 operations a second per new bucket, with exponential backoff advised on
503 Slow Down - The Spaces SLA of 2 December 2025 gives 99.9 per cent monthly uptime per bucket, with credits of 10, 25 and 100 per cent
Weaknesses
- The Spaces MCP server has ten tools for access keys and CDN endpoints. None reads, writes, lists or shares an object
- The access guide and the limits page say keys cannot be created through the API, while the API reference documents
POST /v2/spaces/keys - The limits page lists
list-objects-v2pagination as unsupported, and the compatibility page says to useListObjectsV2for new applications
Price $5 / moAuth API keyx402 nohosted
Head to head
- Amazon S3 vs Google Drive API + MCP BB 77.9 vs A 79.6
- Cloudflare R2 vs Google Drive API + MCP BB 77.1 vs A 79.6
- Azure Blob Storage vs Google Drive API + MCP BB 75.7 vs A 79.6
- Amazon S3 vs Cloudflare R2 BB 77.9 vs BB 77.1
- Amazon S3 vs Azure Blob Storage BB 77.9 vs BB 75.7
- Azure Blob Storage vs Cloudflare R2 BB 75.7 vs BB 77.1
Questions
What are the highest-rated file storage and sharing APIs for AI agents?
Google Drive API + MCP has the highest benchmark score of the 14 ranked file storage and sharing APIs, 79.6 (A). Amazon S3 is second with 77.9 (BB).
How many file storage and sharing APIs are agent-ready?
6 of the 14 ranked here grade BB or better, the bar for agent-ready on the Anchor benchmark.
Which file storage and sharing APIs accept x402 payments?
None of the ranked listings here accepts x402 for its main call yet.
Which of these file storage and sharing APIs is cheapest?
By published paid prices, Bunny Storage, at $0.005 per GB, the lowest of the 6 listings here with a paid price in this unit (free allowances aside). Plans, volume tiers and free allowances change the sum, so check the listing's price table.
How is this list ranked?
By the Anchor benchmark score out of 100, a weighted mean of the scored categories minus deductions for negative events, from public evidence re-checked as vendors change. Listings cannot pay for a place. The latest assessment behind this page is from 9 October 2026.
How this list is made
The order is the Anchor benchmark score, the same number as on each listing and in the top list. Each listing is graded from public evidence against the benchmark checklist, and the picks above are worked out from those grades, prices and facts. No listing pays for its place, and paid audits or listing help never change a score.
Full ranked table · 75 head-to-head comparisons · Best tools in every category