Connect cloud storage (S3, Dropbox, Drive, OneDrive, SharePoint, Box) Pro

Sometimes the files already live somewhere else — a bucket the engineering team writes to, a Dropbox folder the marketing team keeps current, a SharePoint library that is already the company’s system of record. FileDeck Pro can list those files as documents without you copying anything into WordPress: the library, the search, the access rules and the download links are FileDeck’s, and the bytes stay where they are.

FileDeck Pro — cloud storage is included in all Pro plans. Documents → Cloud storage. See pricing

The providers

Provider	How you connect	How downloads are served
Amazon S3 (and S3-compatible: Cloudflare R2, Wasabi, DigitalOcean Spaces, MinIO)	Access key ID + secret, region, bucket, optional endpoint	Redirect to a short-lived signed URL, generated per download
Dropbox	OAuth — your own Dropbox app	Redirect to a short-lived link
Google Drive	OAuth — your own Google Cloud OAuth client	Streamed through your site (Drive has no redirectable link); Docs, Sheets and Slides are exported to PDF on the way out
OneDrive	OAuth — your own Microsoft Entra (Azure) app	Redirect to a short-lived link
SharePoint	OAuth — the same kind of Entra app, with site-level permission	Redirect to a short-lived link
Box	OAuth — your own Box custom app	Redirect to a short-lived link

Browsing, attaching and scheduled pull are read-only: FileDeck lists and fetches, and never writes to your cloud account. (The one feature that does write is the optional vault offload, covered below.) Connecting a provider is an administrator-level action, because the browser can see the whole account.

Connecting Amazon S3

1. Go to Documents → Cloud storage and pick the Amazon S3 tab.
2. Fill in Access key ID, Secret access key, Region and Bucket name. Leave Endpoint blank for Amazon S3; for S3-compatible storage put the service host there (no https://, no bucket) — for Cloudflare R2 use region auto.
3. Click Connect and test. FileDeck lists the bucket immediately, so a wrong key, region or bucket name fails here rather than silently later.

The bucket does not need to be public. Private objects are served through a short-lived signed link generated at download time, so your access rules stay in charge of who gets one.

The minimum IAM policy

For browsing, attaching and scheduled pull, the key only needs to list the bucket and read objects from it. A policy scoped to one bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::YOUR-BUCKET"
    },
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::YOUR-BUCKET/*"
    }
  ]
}

Replace YOUR-BUCKET with your bucket name. That is everything the features on this page need.

Vault offload is the exception: it mirrors protected files into your bucket, so it additionally needs s3:PutObject and s3:DeleteObject on arn:aws:s3:::YOUR-BUCKET/*. Add those two actions only if you turn offload on.

Connecting an OAuth provider (Dropbox, Drive, OneDrive, SharePoint, Box)

The OAuth providers all follow the same three-step shape, because FileDeck uses your app rather than a shared FileDeck one — the connection is between your site and your cloud account, with no third party in the middle.

1. Copy the redirect URI. Open Documents → Cloud storage, pick the provider’s tab, and copy the redirect URI shown there. It is specific to your site, and it must be entered in the provider’s console exactly.

2. Create the app in the provider’s console and give it read access:

   Provider	Console	What to create
   Dropbox	dropbox.com/developers/apps	An app with the files.metadata.read and files.content.read scopes
   Google Drive	console.cloud.google.com/apis/credentials	An OAuth client of type Web application, with the Drive API enabled and the drive.readonly scope
   OneDrive	Azure portal → App registrations	A Web app registration with the Files.Read and offline_access delegated permissions
   SharePoint	Azure portal → App registrations	A Web app registration with the Sites.Read.All and offline_access delegated permissions
   Box	app.box.com/developers/console	A Custom App (OAuth 2.0) with the "Read all files and folders" application scope

3. Paste the app credentials and connect. Enter the Client ID and Client secret into the provider’s tab, save them, then click Connect — you are sent to the provider to approve access and returned to the same screen, which then says Connected. A dot next to the tab name marks every connected provider.

Credentials and tokens are stored encrypted in your site’s database, and Disconnect on the same tab removes them.

SharePoint works with SharePoint Online (Microsoft 365) only; on-premise SharePoint has no Graph endpoint and is not supported. Its browser goes one level deeper than the others — sites first, then each site’s document libraries, then folders.

Attaching files by hand

Once a provider is connected, Browse & attach appears under it. Click through the folder tree, tick the files you want, optionally choose a category to file them under, and click Add selected to library. Each file becomes an ordinary FileDeck document — title, category, access rules, download counting, all as usual — that points at the cloud object instead of an uploaded file.

There is no duplicate check here — attaching the same file twice gives you two documents pointing at the same cloud file. The scheduled pull below does check.

Pulling a folder on a schedule

Hand-picking gets old when a folder keeps gaining files. Scheduled pull maps a folder to a category and lets FileDeck do the picking:

1. Browse to the folder you want in Browse & attach.
2. Under Scheduled pull → Add a rule, the Folder reference is pre-filled with the folder you are looking at (leave it blank for the whole account).
3. Choose the Category new documents should go into, and click Add rule.

From then on, roughly hourly, any new file under that folder is added to your library automatically. Run pull now does it immediately if you don’t want to wait, and each rule shows when it last ran and how many documents it created.

Two things worth knowing about the pull:

• It is one-way and additive. Documents FileDeck already created are never changed, re-titled or removed — including when the file disappears from the cloud folder. Deleting is always your decision. It also never re-imports a file it has already created a document for: each document records the provider and the file’s reference, and the pull skips references it already holds.
• It never runs twice over the same file. Overlapping runs (the schedule firing while you click Run pull now) are detected, and the second one is skipped with a notice rather than importing everything a second time.

How downloads work

A cloud-backed document downloads through FileDeck’s normal download route, so access rules, download counting and the activity log all apply exactly as they do for uploaded files. What happens after that depends on the provider: most redirect the visitor to a freshly generated, short-lived link, while Google Drive is streamed through your site because Drive gives no redirectable URL.

Cloud files can also be included in zip downloads — FileDeck fetches them at build time, subject to the archive’s size budget.

Limits worth knowing before you commit

• File contents are not searched. Search inside documents indexes files stored on your own site; a cloud-backed document is found by its title, description, category and tags, not by the text inside the file.
• The connection is a dependency. If a provider is disconnected, or its app credentials are revoked, those documents stay in the library but cannot be downloaded until it is reconnected.
• Very large files are refused for operations that need the whole file on disk (building a zip), where a size budget applies.

If a cloud download fails, the provider tab is the first place to look — a disconnected provider is by far the most common cause. See downloads not working for the rest.

FAQ

Does FileDeck copy my files into WordPress?

No. Attaching a cloud file creates a document that references it. The bytes stay in your bucket or account, and your WordPress uploads folder does not grow.

Can FileDeck upload to, or delete from, my cloud storage?

Not for the features on this page — the permissions in the tables above grant listing and reading, nothing else. The optional vault offload is the one feature that writes: it mirrors copies of your protected files into an S3-compatible bucket, and removes a copy when its document goes. Nothing else writes.

Do I need to make my S3 bucket public?

No, and you should not. Private objects are served through a short-lived signed link created per download, after FileDeck has checked the visitor is allowed the file.

Can I connect more than one provider?

Yes. Each provider has its own tab, its own connection and its own pull rules, and documents from all of them sit in the same library.