# Lockwell, object storage that shows its work > Private, multi-tenant, encrypted S3-compatible object storage with first-party Go, Node, and Java SDKs plus an opt-in Native Wire transport. Object storage that shows its work: every claim is a measurement you can re-run from the repository. ## Table of Contents ### Getting started - [Getting started](/guide/getting-started.md): Run Lockwell with Docker, install an SDK, store your first file, and hand the browser a direct upload URL, in about five minutes. - [Concepts in plain words](/guide/concepts.md): Plain-words definitions of the handful of terms the Lockwell docs use, from tenants and scoped keys to surfaces, bearer tokens, and signed URLs. - [Installation](/guide/installation.md): Install Lockwell's Go, Node, Java, Native Wire, SolidStart, and Spring integrations, then configure credentials, retries, TLS, and runtime boundaries. - [Client configuration](/guide/client-configuration.md): Configure Lockwell SDK endpoints, regions, TLS trust, timeouts, retries, cancellation, concurrency, progress, and response correlation in Go, Node, and Java. - [The three surfaces](/guide/the-three-surfaces.md): One Lockwell server exposes S3, native, and Admin interfaces over one shared domain pipeline; Native Wire is an opt-in binary transport for the native data plane. - [Native Wire (LNW/1)](/guide/native-wire.md): Lockwell Native Wire (LNW/1) architecture, security, setup, limits, rollout, and failure semantics. - [Migration and compatibility](/guide/migration.md): Migrate an S3 application to Lockwell without overstating compatibility, and understand native SDK language and feature boundaries. - [When not to use Lockwell](/guide/when-not-to-use.md): The disqualification checklist. What Lockwell refuses to do, what it does instead, and which tool to reach for when a refusal rules it out. If a row on this page matches your workload, do not use Lockwell. ### Working with objects - [Upload & download](/guide/data-operations.md): Write and read object bytes with the Lockwell native and S3 clients, including buffered and streaming PutObject, GetObject, ranges, versions, and HeadObject. - [Listing & pagination](/guide/listing-objects.md): List the keys in a Lockwell bucket with prefix, delimiter, and common-prefix semantics, plus full pagination loops on the native and S3 clients. - [Copying objects](/guide/copying-objects.md): Duplicate objects server-side with Lockwell CopyObject, including cross-bucket copies, source and destination conditionals, and large-object UploadPartCopy. - [Deleting objects](/guide/deleting-objects.md): Delete one object, a specific version, or up to 1000 objects in a batch with Lockwell, and understand how delete markers interact with versioning. - [Conditional writes & idempotency](/guide/conditional-writes.md): Gate Lockwell writes on an object's current state with If-None-Match and If-Match, and make retried writes replay-safe with idempotency keys. - [Checksums and integrity](/guide/checksums.md): Verify Lockwell object integrity end to end with CRC32, CRC32C, CRC64NVME, SHA1, and SHA256 digests on single, multipart, and edge-runtime writes. - [Object tags](/guide/object-tags.md): Attach up to 10 key/value tags to a Lockwell object, get/set/delete the replace-on-write tag set, and tag a specific version in a versioned bucket. - [Versioning](/guide/versioning.md): Keep every write of a key with Lockwell versioning, list versions and delete markers, restore a deleted object, and handle suspended-state null versions. - [Multipart uploads](/guide/multipart-uploads.md): Upload large objects in parts with Lockwell, covering the create-upload-complete lifecycle, per-part checksums, resuming, UploadPartCopy, and abort. - [Object lock](/guide/object-lock.md): Apply write-once-read-many protection to Lockwell object versions with retention modes and legal holds, enforced with the same WORM invariants on the native and S3 paths. ### Multi-tenant apps - [Tenancy and auth](/guide/tenancy-and-auth.md): How Lockwell isolates customers with tenants, scoped access keys, native bearer tokens, signed URLs, and RBAC admin tokens, and the fail-closed posture behind them. - [The app kit](/guide/app-kit.md): LockwellKit composes the admin and native clients so an app can provision tenants, get per-tenant clients, configure browser CORS, sign browser URLs, and verify webhooks with almost no glue. - [Signed URLs](/guide/signed-urls.md): Native signed URLs let a browser PUT or GET object bytes directly to Lockwell with no credential, scoped to one method and one object and time-limited. - [Webhooks](/guide/webhooks.md): Lockwell POSTs a signed HMAC-SHA256 event to your endpoint on object create or remove, and verifyWebhook checks each delivery in constant time. - [Edge runtimes](/guide/edge-runtimes.md): The Node SDK provides a node-free /edge entry designed for Cloudflare Workers, Vercel Edge, Bun, and Deno; named Bun, Deno, workerd, and Vercel Edge Runtime smokes pass; hosted provider deployment evidence remains pending. ### Operating Lockwell - [Deployment](/guide/deployment.md): Deploy Lockwell as one container with one volume via Docker Compose, with two listeners, an at-rest master key, TLS at the proxy, and online backups. - [Operations and observability](/guide/operations-and-observability.md): Use Lockwell native and admin SDKs for health, readiness, quotas, keys, audit queries, request correlation, and safe operator workflows. - [Errors and retries](/guide/errors-and-retries.md): Handle Lockwell SDK errors with structured codes and Is* helpers, and tune S3 or Java native retry policy behavior for safe retries. ### SDKs - [SDKs](/sdks.md): First-party Lockwell SDKs for Go, Node, and Java, plus the opt-in LNW/1 TypeScript, SolidStart, and Spring server integrations. ### Languages - [Go SDK](/sdks/go.md): The first-party Lockwell SDK for Go, split into five standard-library-only packages for the S3, LNW/1 native-wire, legacy native JSON, admin, and app-kit surfaces. - [Node SDK](/sdks/node.md): The first-party Lockwell SDK for Node.js and Next.js, an encrypted alternative to the AWS S3 SDK with the shared LNW/1 core and an edge-safe compatibility entry. - [Java SDK](/sdks/java.md): The first-party Lockwell SDK for the JVM, with a JDK 25 native binary LNW/1 data plane and explicit S3, HTTP/JSON, and JSON Admin compatibility surfaces. ### Production guides - [Java HTTP-native compatibility client](/sdks/java-native.md): Production notes for the Java LockwellNativeClient, including bearer-token management, safe native retries, Retry-After handling, request timeouts, and TangibleShift ERP-style integration defaults. - [`@kelphect/sdk-native` (Node and Bun)](/sdks/bun-native.md): Server-only @kelphect/sdk-native LNW/1 client for Node 22+ and Bun 1.4+. - [`@kelphect/sdk-solidstart`](/sdks/solidstart.md): SolidStart v2 server integration for Lockwell LNW/1 with Node, Bun, and supported Nitro presets. - [`@kelphect/sdk-nextjs`](/sdks/nextjs.md): Server-only Next.js 16.3 adapter for Lockwell LNW/1 on Node 22+ and Bun 1.4+. - [Nuxt 4.5+ Native Wire](/sdks/nuxt.md): Use Lockwell's binary LNW/1 data plane safely from Nuxt 4.5+ and supported Nitro Node or Bun servers. - [Spring Boot Native Wire starter](/sdks/java-spring-wire.md): Spring Boot 4.1 and JDK 25 Lockwell Native Wire starter with TLS, streaming, Object Lock, and metrics. ### API reference - [S3 operations reference](/reference/s3-operations.md): The full matrix of S3 operations the Lockwell data-plane client supports, with key options, shared by the Go, Node, and Java SDKs. - [Native data-plane API](/reference/native-api.md): The wire-level reference for the Lockwell native JSON data-plane API at /api/v1/, including bearer-token auth, routes, signed URLs, and error shapes. - [Native Wire reference](/reference/native-wire.md): Machine-oriented LNW/1 frame, capability, operation, field, limit, and error reference. - [Admin API](/reference/admin-api.md): The wire-level reference for the Lockwell JSON Admin API at /admin/api/v1/, covering bearer-token auth, RBAC roles, tenant lifecycle, keys, quotas, and audit. - [SDK capability index](/reference/sdk-capabilities.md): Machine-checkable capability and public-symbol index for Lockwell's Go, Node/TypeScript, Java, Native Wire, and merged server framework integrations. - [Documentation provenance and licensing](/reference/content-provenance.md): Source authority, licensing, generated artifacts, canonical URLs, and machine-fetchable formats for Lockwell's public technical documentation. ### API reference - [S3 operations reference](/reference/s3-operations.md): The full matrix of S3 operations the Lockwell data-plane client supports, with key options, shared by the Go, Node, and Java SDKs. - [Native data-plane API](/reference/native-api.md): The wire-level reference for the Lockwell native JSON data-plane API at /api/v1/, including bearer-token auth, routes, signed URLs, and error shapes. - [Native Wire reference](/reference/native-wire.md): Machine-oriented LNW/1 frame, capability, operation, field, limit, and error reference. - [Admin API](/reference/admin-api.md): The wire-level reference for the Lockwell JSON Admin API at /admin/api/v1/, covering bearer-token auth, RBAC roles, tenant lifecycle, keys, quotas, and audit. - [SDK capability index](/reference/sdk-capabilities.md): Machine-checkable capability and public-symbol index for Lockwell's Go, Node/TypeScript, Java, Native Wire, and merged server framework integrations. - [Documentation provenance and licensing](/reference/content-provenance.md): Source authority, licensing, generated artifacts, canonical URLs, and machine-fetchable formats for Lockwell's public technical documentation. ### Other - [Benchmarks](/benchmarks.md): The full benchmark ledger as an explorable table. Lockwell vs MinIO with our open harness and with MinIO's own tool (warp), every operation, size, and concurrency, throughput and latency views, the caveats that matter, and the commands that reproduce every row. - [Lockwell, almacenamiento de objetos que muestra sus cuentas](/es.md): Almacenamiento de objetos privado, multi-tenant y cifrado, compatible con S3, con SDKs oficiales para Go, Node y Java. Cada afirmación es una medición, y el repositorio incluye las herramientas para repetirla. - [Lockwell, armazenamento de objetos que mostra as contas](/pt.md): Armazenamento de objetos privado, multi-tenant e cifrado, compatível com S3, com SDKs oficiais para Go, Node e Java. Cada afirmação é uma medição, e o repositório traz as ferramentas para a repetir. - [Lockwell, Objektspeicher, der seine Rechnung offenlegt](/de.md): Privater, multi-tenant, verschlüsselter, S3-kompatibler Objektspeicher mit offiziellen SDKs für Go, Node und Java. Jede Aussage ist eine Messung, und das Repository liefert die Werkzeuge, um sie zu wiederholen.