Plain terms.
Short answers to the things people ask before they sign up. Email k@khaos.studio if yours isn't here.
Pricing
One plan, sold by the terabyte. Full breakdown lives on the pricing page.
Is there a free tier?
No. Every owner subscribes — $20/TB/mo monthly or $14/TB/mo annual prepay. The minimum is one TB, which covers most early use comfortably.
How are TB blocks billed?
Storage is sold in whole-TB blocks. Adjusting capacity applies on the next billing period; you don't get retroactively charged for overshoot.
If you exceed your provisioned capacity, uploads fail until you bump capacity (or delete bytes). We don't silently upsize you.
Is egress billed separately?
No under normal use. Accounts have a 2x plan-TB monthly soft cap to protect against hotlink abuse. At the cap, public download requests return HTTP 429 with a dashboard path to review the account.
BYOK extensions egress from your bucket — your provider, your bill.
Can I cancel?
Yes. Monthly cancels at the end of the period. Annual prepay refunds the unused portion if you cancel within the first 30 days. After that the prepaid term runs out and the account moves to month-to-month or freezes — your choice.
Storage & BYOK
By default Khaos manages the bytes. You can extend with your own bucket whenever you want.
Where do my files actually live?
Default storage is Cloudflare R2 in an account we manage. Metadata, search, signed URLs, and sync state live in our control plane on AWS.
If you attach a BYOK connection, the bytes for assets uploaded to that connection live in your bucket. We never replicate them out.
Do I need my own storage?
No. Khaos storage is the default — pick a TB plan and upload. BYOK is an extension for users who want to keep their Khaos bill flat while still using the dashboard, sharing, sync, and metadata.
What providers can I bring?
Cloudflare R2 and any S3-compatible store (AWS S3, Backblaze B2, MinIO, etc.). Add a connection in the console; we run HEAD/LIST/PUT/DELETE probes against the bucket before persisting.
Are my BYOK credentials safe?
Encrypted at rest under a per-account KMS key. Never logged in plaintext, never echoed back through the API, never replayable. The CLI / SDK never see them after the initial submit.
Sharing & spaces
A space groups assets. The visibility setting controls whether the share URL resolves.
What's the difference between private, public, and protected?
private (default) is owner-only — useful for grouping without sharing. The share URL is inert.
public resolves for anyone with the URL. Recipients see the asset gallery, can play media inline, and can download originals.
protected resolves for anyone with the URL plus the password. Same gallery once they unlock.
Do public spaces expire?
No. A public space stays public until you change its visibility or delete it. Signed download URLs inside the manifest auto-refresh in the viewer so recipients never see a stale link.
Can I share a single asset?
Yes — create a space for it and publish the asset. Spaces are also the abstraction we'll use for scheduled-expiration share links once that ships.
Can I see who downloaded what?
Per-space access logging is on the roadmap. Today, the only signal is the egress counter on your usage page.
Accounts & access
Humans sign in through the console. Machines use API keys.
How do I sign up?
Email and password registration via Cognito at app.khaosstorage.com. Verify your email and you're in.
Can I use API keys to log into the console?
No. The console is human-only — API keys exist for scripts, ingest agents, sync clients, and integrations. They're scoped (read / write / admin) and the raw key is shown exactly once at creation.
Team accounts? Multiple users on one bucket?
Not yet — single owner per account today. Multi-user / org accounts are a planned addition; reach out if your use case is blocked on it and we'll prioritize accordingly.
API & CLI
A single TypeScript SDK and a single-binary CLI cover the same surface as the API.
How do I install the CLI?
curl -fsSL https://khaosstorage.com/install | sh — drops khaos-storage and the khs alias on your PATH.
Run khs update any time to upgrade in place.
Where's the API reference?
The docs page has every endpoint with code samples. The full openapi.yaml is in the repo and stays in lock-step with the deployed surface — CI fails on drift.
What does the SDK handle for me?
Single-PUT under 100 MiB and multipart above, in-flight part bounding, SHA-256 hashing, retries, and the create/presign/complete dance. client.upload(source) is the one-call surface.
Do you have a Python or Go SDK?
Not yet. The OpenAPI spec is the path of least resistance for now — generate a client with openapi-generator or hand-roll against the bearer + envelope contract.