Presigned

Presigned URLs are time-limited links that grant temporary access to a private object stored in cloud storage without requiring the recipient to authenticate. They are typically used to share private files or to enable controlled uploads while keeping the storage container private.

Generation and operation are carried out by a service with access to the storage credentials. The server or application constructs a URL that encodes the object path, the allowed operation (such as GET for download or PUT for upload), an expiration time, and a cryptographic signature. When the URL is used, the storage service verifies the signature and the timestamp; if valid and not expired, the requested operation proceeds.

Common use cases include securely sharing private files with clients or partners, providing time-limited upload capabilities to a service, and distributing large media files without exposing the underlying storage bucket. Presigned URLs enable direct client or user access to storage resources while keeping authentication strictly scoped and short-lived.

Security and limitations are important considerations. Presigned URLs should be transmitted over HTTPS and kept confidential; leaking a URL can grant access until expiry. They are not a replacement for user authentication but a controlled delegation of access for a defined window and operation. Expiry times should be as short as practicable, and additional protections such as IP restrictions or per-object scope may be used where supported. Providers that offer presigned URLs include AWS S3, Google Cloud Storage, and Azure Blob Storage, typically under their signed URL or SAS token mechanisms.