What is Signed URL?

A temporary link to a private file that stops working after a few minutes.

Where Signed URL goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

  • Who may see what · 4 minutes · Pro

    The bucket of ID photos

    Users upload a photo of their ID to get verified. Someone on a forum just posted a link to one of them.

    Are files in my storage bucket private?

    Only if the bucket is private and its policies restrict access. A public bucket serves every file to anyone with the address, however secure your database is. Store private files in a private bucket, have the server create short-lived signed links for the right user, and delete sensitive files once you no longer need them.

    Read the fix

  • Launch day · 4 minutes · Pro

    The upload that was too big

    Users can upload photos to their listings. Phone photos fail with '413 Payload Too Large'. Screenshots work fine.

    How do I fix 413 Payload Too Large on uploads?

    Serverless functions limit how large a request body can be, so large files fail when sent through your API. Have your server create a signed upload URL after checking the user, then let the browser upload directly to storage. Enforce file type and size limits on the storage bucket itself.

    Read the fix

Related terms

Server
A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Authorization
Checking what someone is allowed to do once you know who they are. Signed in does not mean allowed.
Storage bucket
A folder in the cloud for files like images and PDFs. It has its own permissions, separate from the database.
API
The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Endpoint
One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.
Request
A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

All 62 terms in the glossary