Answer
The client asks your API for an upload; the API checks who they are and what they may upload, then signs a URL for one object key that expires in minutes. The client PUTs the file directly to object storage with it. Your servers handle a small request instead of gigabytes.