Introduction

s3BEAR is a secure S3 gateway for AI workloads. It serves images and files from private S3 storage to LLMs and browsers without ever making a bucket public.

The problem

Multimodal LLMs (Claude, GPT-4o, Gemini) take images as HTTPS URLs. But your images live in a private S3 bucket. Teams reach for bad options: making the bucket public, hand-rolling presigned URLs across scripts, or proxying through app code where every service re-implements auth and MIME checks.

The solution

s3BEAR is the single gated door between your private storage and the outside world. It sits in front of any backend that exposes a compatible S3 API and becomes the only access path. AWS S3, MinIO, Ceph, and Wasabi are common examples, not a fixed provider list:

• Mint an expiring, revocable HTTPS URL for one object and pass it straight to an LLM API. It works while valid, then returns 410 Gone.
• Serve images to the browser from private buckets with JWT permission checks and a MIME allow-list.
• Resize on the fly (?w=1024&format=webp&q=80) to hand right-sized images to models instead of raw originals.
• Every request is permission-checked, quota-limited, and audit-logged in one place.

Continue to Quick Start to run s3BEAR locally in 60 seconds.