diff --git a/packages/env/src/constant.ts b/packages/env/src/constant.ts
index fed34a0164..3551c50a40 100644
--- a/packages/env/src/constant.ts
+++ b/packages/env/src/constant.ts
@@ -17,6 +17,7 @@ export const enum MessageCode {
   leaveWorkspaceFailed,
   downloadWorkspaceFailed,
   refreshTokenError,
+  blobTooLarge,
 }
 
 export const Messages = {
@@ -65,4 +66,11 @@ export const Messages = {
   [MessageCode.refreshTokenError]: {
     message: 'Refresh token failed',
   },
-} as const;
+  [MessageCode.blobTooLarge]: {
+    message: 'Blob too large',
+  },
+} as const satisfies {
+  [key in MessageCode]: {
+    message: string;
+  };
+};
diff --git a/packages/workspace/src/affine/__tests__/api.spec.ts b/packages/workspace/src/affine/__tests__/api.spec.ts
index e050fec750..4f0f6b8ebd 100644
--- a/packages/workspace/src/affine/__tests__/api.spec.ts
+++ b/packages/workspace/src/affine/__tests__/api.spec.ts
@@ -101,6 +101,21 @@ describe('api', () => {
     document.removeEventListener('affine-error', listener);
   });
 
+  test('blob too large', async () => {
+    let called = false;
+    try {
+      await workspaceApis.uploadBlob(
+        'test',
+        new ArrayBuffer(1024 * 1024 * 1024 + 1),
+        'image/png'
+      );
+    } catch (e) {
+      called = true;
+      expect(e).toBeInstanceOf(RequestError);
+    }
+    expect(called, 'throw error').toBe(true);
+  });
+
   test('refresh token', async () => {
     const storage = getLoginStorage();
     assertExists(storage);
diff --git a/packages/workspace/src/affine/api/index.ts b/packages/workspace/src/affine/api/index.ts
index fdc4bda754..1680f9f647 100644
--- a/packages/workspace/src/affine/api/index.ts
+++ b/packages/workspace/src/affine/api/index.ts
@@ -302,6 +302,10 @@ export function createWorkspaceApis(prefixUrl = '/') {
     ): Promise<string> => {
       const auth = getLoginStorage();
       assertExists(auth);
+      const mb = arrayBuffer.byteLength / 1048576;
+      if (mb > 10) {
+        throw new RequestError(MessageCode.blobTooLarge);
+      }
       return fetch(prefixUrl + 'api/blob', {
         method: 'PUT',
         body: arrayBuffer,