When a logistics platform stores an AI-generated image, the application server should authorize the upload without carrying the image bytes. That boundary matters more than the storage brand: a presigned URL lets the API authenticate the request, while the worker or browser sends the image directly to object storage. For a multi-tenant system, generate the URL only after validating the tenant-owned bucket and key, and treat the resulting object key as an auditable write decision.

TL;DR: create a presigned upload URL for /v1/storage/object/presign/{bucket}/{key}\ , bind the intended Content-Type\ and any other required headers to that request, then issue an HTTP PUT\ with the image bytes. Keep the URL short-lived, never expose storage credentials, and make the object key collision-resistant because this storage surface has no If-Match\ conditional write or object versioning.

Start with the tenant boundary

Suppose a route receives a dispatch ID and an image produced for a delivery exception.…