How can I limit the size of files uploaded by my users?

The auth.max_size property limits the Assembly’s total expected upload size in bytes, such as 1048576 (1 MiB), rather than each file separately. This includes the multipart request body, or the initial Assembly request bytes plus its resumable uploads. Exceeding the limit stops the entire Assembly with an error, including files that individually fit within the limit.

Set the limit in a stored Template or in the Assembly request’s auth object. For signature-based browser uploads, authenticate the user on your backend, sign only authorized instructions containing the permitted limit and Template selection, and require Signature Authentication. Keep the Auth Secret and Assembly-creation Bearer tokens on the trusted backend; valid Bearer authentication bypasses the signature requirement. A stored Template’s limit is checked independently of the request’s limit. Follow verifying an upload’s user.

Do not rely on this limit to reject every oversized transfer before it starts. For resumable uploads, the declared or received size becomes available through tus updates, and the Assembly checks the limit when a finished upload is processed. A deferred upload’s size is not known at creation, and bytes may already have transferred before the Assembly rejects it.

If you want to just ignore the files that exceed a certain size, but process all others, then please use 🤖/file/filter.