Ship day: CDN delivery, video & audio transformation, passwordless auth

2026-09-18 · Product · reading time 6 min

The last few weeks of building compressed into one release. Everything below is live in production today — not a roadmap. Here's what shipped, how it works, and how to use it.

1. CDN delivery — public files, edge-cached for a year

Every APULODI file was already stored durably. Now any file can be served publicly through a global CDN with one call:

await apulodi.files.update("file_123", { visibility: "public" });
const file = await apulodi.files.get("file_123");
file.publicUrl;
// → https://cdn.apulodi.dev/organizations/…/files/file_123/original

Design decisions we made deliberately:

• Unguessable, not unauthenticated. Public URLs are built from server-generated identities and never contain user input. Private files keep short-lived presigned URLs — nothing changes for them.
• Immutable per version. Replacing content writes a new versioned key, so a public URL always serves exactly what it served the day you embedded it. That's what makes a 1-year Cache-Control safe — verified with a real Miss → Hit from cloudfront round trip.
• The bucket stays private. CloudFront accesses storage through an Origin Access Control with an ARN-scoped policy. The CDN holds the only read grant; there is no public bucket.
• Variants inherit visibility. Public file? Its thumbnails and transformed derivatives are edge-cached too.

2. Media transformation — video & audio, same transform API

The transform endpoint you already use for image variants now handles video and audio through a bundled ffmpeg pipeline:

// Transcode to mp4 at 720p.
const v = await apulodi.files.transform("video_123", { format: "mp4", height: 720 });

// Extract a JPEG poster frame for <video poster>.
const poster = await apulodi.files.transform("video_123", { poster: true });

// Convert any audio input to mp3.
const a = await apulodi.files.transform("audio_123", { format: "mp3" });

const done = await apulodi.files.waitForVariant("video_123", v.id);

Same lifecycle as image variants: idempotent parameters, asynchronous processing, file.processed webhooks, derivatives stored beside the original. Inputs: mp4/webm/mov/mkv video and mp3/m4a/wav/ogg/aac/flac audio, up to 100 MB.

3. Passwordless auth — magic links & team invitations

Sign-up is now a single email field. You receive a single-use magic link (valid 15 minutes); clicking it creates the account and signs you in. Sessions last a week. Team invitations are finally usable too — owners invite by email, the invitee accepts a deep link, roles apply immediately.

And because email is now part of the platform, your workspace hears from us at the right moments: payment receipts, renewal reminders 3 days before expiry, grace warnings if a payment is late, downgrade notices, and quota alerts when a project hits a hard storage/bandwidth/file-count limit (rate-limited to one email per day per limit, via the event stream itself).

Also in this release

• Quota alert emails — owners are notified when a project hits a hard limit, deduplicated against the event stream.
• @apulodi/sdk@0.1.1 — visibility, publicUrl and the extended transform params are typed.
• Full mobile responsiveness across the dashboard, docs and landing pages.

Try it

Sign in at app.apulodi.dev — you'll be in with one email click — and read the new docs:

Media transformation, CDN delivery, and Account & team.

File infrastructure for Malawi — and everywhere else. More soon.