Presigned URL

A presigned URL is a temporary, signed link that grants time-limited permission to upload or download a specific object in cloud storage without exposing account credentials. The signature encodes the allowed operation, object key, and an expiry, so whoever holds the URL can perform exactly that action until it expires.

Presigned URLs solve a common problem: you want a client (a browser, a mobile app, a CI job) to read or write storage directly, but you can't ship long-lived credentials to that client. Instead, your backend — which does hold credentials — generates a URL with a cryptographic signature baked into the query string. The storage layer validates that signature on each request.

A presigned URL is bound to a single HTTP method and object key. A URL minted for a PUT can only upload to that exact key; it can't be replayed to download, delete, or write somewhere else. The expiry is part of the signed payload, so it can't be extended by editing the link — any tampering invalidates the signature and the request is rejected.

The most common pattern is upload offloading: the client asks your API for a URL, then streams bytes straight to storage without proxying through your server. This keeps large files off your application servers entirely, which saves memory, bandwidth, and request time.

# Upload directly to a presigned URL
curl -X PUT --upload-file ./avatar.png \
  "https://files.example/upload/abc123?signature=...&expires=..."

Related terms

Signed URL

A signed URL is a web address with a cryptographic signature and expiry appended as query parameters, granting temporary access to a private resource. Servers and CDNs validate the signature before serving the file, so the link works only until it expires and cannot be altered without breaking the signature.

Direct upload

A direct upload sends a file straight from the browser or client to storage, bypassing your application server. The backend issues a presigned URL, then the client PUTs the bytes to it. This avoids proxying large files through your server, cutting load, memory use, and latency.

Multipart upload

Multipart upload splits a large file into smaller parts that are uploaded independently — often in parallel — then reassembled into one object on the server. It improves throughput, survives flaky networks by retrying only failed parts, and is the standard way to move large files into object storage reliably.

CORS

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls whether a web page on one origin may request resources from another. The server returns Access-Control-Allow-Origin and related headers; if they don't permit the requesting origin, the browser blocks the response. It governs cross-domain fetch, XHR, and direct uploads.

How files.link fits in

files.link uses presigned uploads under the hood — your code requests an upload URL, PUTs the bytes to it, then confirms. No credentials ship to the client. image upload API.

Get started

← Back to the glossary