Presigned URL
Definition
A presigned URL is produced by signing a description of a request with a secret key that the holder of the link never sees. The signature covers the HTTP method, the object key, the expiry time and usually a set of headers, so changing any of those invalidates it. In the S3 signature scheme the query string carries X-Amz-Algorithm, X-Amz-Credential, X-Amz-Date, X-Amz-Expires and X-Amz-Signature, which is why these links are long and ugly. Expiry is chosen at signing time and is typically measured in minutes or hours, with a protocol maximum of seven days. Both directions work: a signed GET hands out a private file, and a signed PUT lets a browser write one object into object storage without any credentials of its own.
Why It Matters
The alternative to signing is unappealing in both directions. Make the bucket public and every object is readable by anyone who guesses a key; proxy every download through your own server and you pay for the same bytes twice, once on the way out of storage and once on the way out of your application. Signing removes both problems: the bytes move directly between the visitor and the store. The cost is that the link is a bearer token. Pasted into a group chat, it works for every person who reads that chat, and there is no practical way to revoke it short of deleting the object or rotating the signing key — which is why it behaves like an expiring link and should be given the shortest life that the task allows.
How It Works
The server builds a canonical string from the method, the path, the query parameters and the signed headers, then computes an HMAC over it using the account's secret key. No network call is involved, so signing thousands of links is cheap. The client then makes an ordinary request to that URL, and the storage bucket recomputes the same signature from what actually arrived. A mismatch returns 403 with SignatureDoesNotMatch, and a valid signature past its expiry returns 403 with an expired-request message instead. Because the date is signed, a client whose clock is badly wrong will fail even with a correct key. If the signature covered a Content-Type, the upload must send exactly that Content-Type or it is rejected.
Real-World Example
A founder uploads a 60 MB investor update video to 99helpers. The browser never receives a storage credential; it asks the API for a signed PUT valid for fifteen minutes and writes the file straight to the bucket. Later the same founder shares the video with two investors using a signed GET that lasts 48 hours. When one of them forwards the link a week later, it returns 403 rather than the video.
Common Mistakes
- ✕Signing for seven days out of convenience — the link then outlives the reason it was created and circulates unchecked
- ✕Writing the full URL into application logs or an error tracker, which stores a working credential in a system with far more readers than the file ever had
- ✕Expecting to revoke a link that has already been handed out — nothing short of deleting the object or rotating the key will do it
- ✕Signing a PUT with one Content-Type and having the browser send another, which fails with a 403 that looks like a permissions problem
Related Terms
Expiring Link
A shareable address that stops serving its file after a set moment — a date, a number of days, or a number of downloads. The file stays stored; only the route to it closes.
Object Storage
Object storage keeps each file as a self-contained object — its bytes, its metadata and a key that names it — inside a flat container reached over HTTP. There is no directory tree and no file handle to open, seek and write.
Storage Bucket
A storage bucket is the top-level container in an object storage system: a named, region-bound namespace that holds objects and carries the settings applied to all of them.
Direct Link
A direct link points at a file's bytes rather than at a page about the file. Request it and you get the file itself, with its own Content-Type header and nothing wrapped around it.
HTTPS
HTTP carried inside an encrypted TLS connection, shown in the browser as an https:// address. It is the same web protocol as before, with the traffic protected and the server's identity checked first.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →