FireOTA
Set upNew

Multi-Cloud Sovereign Storage

Connect your own cloud storage: Cloudflare R2, AWS S3, MinIO, GCS, Azure, or BYOU.

4 sections Edit this page on GitHub

Total code sovereignty (Zero-Proxy)

FireOTA enforces zero proprietary bundle hosting. Customer application code and OTA bundles live exclusively in your own cloud buckets. FireOTA coordinates release metadata, deterministic rollout percentages, version compatibility and telemetry, but never stores your compiled JavaScript on its servers.

1. Developer / CI

GitHub Actions / CLI

$ npx fireota release

→ Compiles JS bundle

→ Archives into .fota

→ Computes SHA-256 hash

Customer Cloud Storage
Data Plane

Cloudflare R2, AWS S3, MinIO, GCS, Azure or BYOU CDN.

📦 stores .fota packages
FireOTA Control Plane
Metadata Only

Channels, staged rollouts, runtime matching, device telemetry.

🛡️ 0 bundle bytes stored

3. Mobile Applications

React Native / Expo SDK

1. Checks FireOTA for manifest

2. Downloads direct from your bucket

3. Verifies SHA-256 before apply

Zero-Proxy Sovereign ArchitectureYour compiled JavaScript never touches FireOTA servers. Mobile devices stream directly from your storage or CDN.
Zero-Proxy Architecture: FireOTA coordinates metadata and rollout percentages while bundles stream directly from your own cloud bucket to mobile devices with SHA-256 verification.

Tip: Recommended for OTA: Cloudflare R2. Cloudflare R2 has zero data egress fees, making it substantially more cost-effective for high-volume mobile updates than standard AWS S3.

Supported cloud providers

ProviderAuthentication
Cloudflare R2Account ID + Access Key + Secret Key
Amazon S3Region + IAM Access Key + Secret Key
MinIO / S3Endpoint URL + Access Key + Secret Key
Google Cloud (GCS)Service Account JSON Key
Azure BlobAccount Name + Account Key
Bring Your Own URLNone required (SHA-256 validated)
Firebase StorageGoogle OAuth Flow

How to connect a storage target

Open Storage in the sidebar and click Connect Storage:

  1. 1
    Select your cloud provider (e.g. Cloudflare R2, Amazon S3, MinIO, GCS, or Azure). For Cloudflare R2, generate an API token with Object Read & Write permission:
    dash.cloudflare.com/.../r2/default/buckets/mobile-ota-releases

    R2 Object Storage > Buckets

    mobile-ota-releases

    Zero Egress Bandwidth Fees

    Bucket Size

    38.4 MB

    Egress Bandwidth

    $0.00 / Free

    Custom Domain

    ota.mycompany.com

    S3 API Compatibility Configuration

    S3 Endpoint URL:https://<account-id>.r2.cloudflarestorage.com
    API Token Permission:Object Read & Write
    Cloudflare R2 Console: Bucket configured with custom domain and unlimited zero data egress bandwidth for mobile updates.
  2. 2
    Fill in the bucket name and API credentials. Credentials are encrypted at rest with AES-256-GCM.
  3. 3
    Click Verify & Connect. FireOTA immediately runs an automated live write, read, and delete test probe:
    fireota.example.com/projects/connect

    Connect Cloud Storage Target

    FireOTA stores metadata only. All bundle packages are stored in and served directly from your sovereign bucket.

    Cloudflare R2

    Recommended · $0 Egress

    Amazon S3

    AWS IAM SigV4

    MinIO / S3

    Self-hosted / Private

    Google Cloud

    Service Account JSON

    Azure Blob

    Shared Key

    BYOU

    Bring Your Own URL

    Target Label

    Production Cloudflare R2

    Cloudflare Account ID

    8f7b2c90e1a4d538201fa7b98c3e2104

    Bucket Name

    mobile-ota-releases

    Public Domain / CDN URL (Optional)

    https://ota.mycompany.com

    For zero egress custom domain streaming

    Access Key ID

    cf_r2_fota_98a71c0b3d

    Secret Access Key

    ••••••••••••••••••••••••••••••••
    Automated Health Check Probe (Completed in 218ms)Verified & Ready

    ✓ Endpoint reachable via AWS SigV4 handshake (HTTP 200 OK)

    ✓ Write probe: Created fireota/.healthcheck-probe

    ✓ Read probe: Byte stream integrity verified 100%

    ✓ Cleanup probe: Deleted temporary healthcheck object

    🔒 Credentials are encrypted at rest with AES-256-GCM.

    Cancel Save & Connect Target
    Connecting a cloud storage target: Live probe automatically verifies AWS SigV4 handshake, write, read, and delete permissions before saving.
  4. 4
    When you create an app in Add Application, select your verified storage target. You can monitor all connected targets, CDN endpoints, and linked apps from the Storage dashboard:
    fireota.example.com/projects

    Storage Targets

    Connected cloud storage buckets and sovereign CDN endpoints.

    Connect Storage

    Production Cloudflare R2

    Cloudflare R2

    bucket: mobile-ota-releases · endpoint: https://ota.mycompany.com

    2 apps connectedVerified

    AWS S3 West Backup

    Amazon S3

    bucket: company-mobile-assets · endpoint: us-west-2

    1 app connectedVerified

    Corporate CDN (BYOU)

    Bring Your Own URL

    bucket: External CDN · endpoint: https://cdn.mycompany.com

    1 app connectedActive
    Storage Targets Dashboard: Monitor and manage connected cloud buckets, custom CDNs, and linked mobile applications.

Bring Your Own URL (BYOU) in CI/CD

If your CI/CD pipeline already uploads bundles to internal storage or a corporate CDN, you can register and publish updates in one step without giving FireOTA any cloud credentials:

1

Build in CI/CD

Bundles JS & packages .fota with SHA-256 hash

npx react-native bundle
2

Upload to Your CDN

CI pushes .fota to your S3, R2, or Akamai CDN

aws s3 cp release.fota s3://cdn/...
3

Register Release

Registers download URL & hash (sub-second)

fireota release --bundle-url ...
4

Device Download

Mobile device streams from CDN & checks hash

SHA-256 match → atomic swap
Why BYOU? Enterprise pipelines keep full control of code artifacts and CDN caching. FireOTA only stores metadata and never requires cloud credentials.
Bring Your Own URL (BYOU) Pipeline: CI/CD hosts the .fota archive on your corporate CDN and registers the cryptographically signed release with FireOTA in milliseconds.

Publish a release by pointing directly to your CDN URL and providing the bundle SHA-256 hash:

bash
npx fireota release \
  --app 83822cef-... \
  --platform android \
  --runtime 1.4.0 \
  --channel production \
  --bundle-url https://cdn.mycompany.com/updates/v1.4.0.fota \
  --bundle-hash 9b1e4c...a07d \
  --bundle-size 1928374

FireOTA distributes the external download URL to devices during updates/check. The client SDK verifies the SHA-256 hash before running the bundle to ensure 100% cryptographic integrity.

Was this page helpful?