DigitalOcean Spaces vs OneDrive and SharePoint files (Microsoft Graph)

DigitalOcean Spaces

Per-bucket access keys with read or read-write-delete grants, an 800 operations a second limit per bucket and a 99.9 per cent SLA are all published. The MCP server manages keys and CDN endpoints only, not objects, and the S3 reference documents no error codes. A payment method is required before any bucket is created.

OneDrive and SharePoint files (Microsoft Graph)

One REST surface covers personal OneDrive, work OneDrive and SharePoint libraries, with resumable uploads, sharing links that take an expiry date and per-file Selected permissions. The status page needs JavaScript, an app must be registered and consented to by a person, and the JavaScript client on npm lacks a token-leak fix merged in June 2026.

DigitalOcean Spaces

1. Set the endpoint to https://<region>.digitaloceanspaces.com and, in AWS SDKs other than Python's, set region to us-east-1 when creating a bucket
2. Ask for a limited access key with a Read or Read/Write/Delete grant on one bucket. A full access key can create, configure and delete every bucket
3. Do the object work through the S3 API. The MCP server and doctl cannot upload, list, move or delete files
4. Retry with exponential backoff on 503 Slow Down, and keep below 800 operations a second per bucket
5. Fetch presigned links from the origin host, not the CDN. The docs say presigned requests through the CDN are not cached and can double the bandwidth charge
6. Avoid many tiny objects. Each bills as at least 4 KiB on Standard and 128 KiB on Cold Storage, which also has a 30-day minimum

OneDrive and SharePoint files (Microsoft Graph)

1. Use PUT /content only up to 250 MB. Above 10 MiB Microsoft advises createUploadSession, with fragments in multiples of 320 KiB and under 60 MiB each
2. Send the bearer token on the createUploadSession POST only. The PUT calls to uploadUrl can return 401 if an Authorization header is included
3. Set expirationDateTime and scope on createLink. Without a scope the tenant's default link type is created, which may be wider than intended
4. Follow the 302 from GET /content straight away. Pre-authenticated download URLs can expire within minutes and need no Authorization header
5. Wait for Retry-After on 429 and 503. Throttled requests still count against the limits, and continued overuse can get the app blocked