Skip to main content
Signed URLs let you upload or download files from a sandbox without exposing your API key. This is useful for:
  • Letting browsers download files directly from a sandbox
  • Sharing temporary download links with users
  • Uploading files from untrusted clients (e.g. a frontend app)

How It Works

  1. Your backend generates a signed URL using your API key
  2. The URL contains an HMAC signature and expiry timestamp
  3. Anyone with the URL can upload/download — no API key needed
  4. The URL expires automatically (default: 1 hour, max: 24 hours)

Generating URLs

Downloading Files

Use the signed download URL with a plain GET request — no headers required:

Uploading Files

Use the signed upload URL with a PUT request:

Large Files

Signed URLs support files of any size — the entire pipeline streams data in 256KB chunks without buffering. Files up to 200MB+ have been tested at ~20 MB/s throughput.

Security

  • Tamper-proof: URLs are signed with HMAC-SHA256. Changing the path, sandbox ID, or expiry invalidates the signature.
  • Time-limited: URLs expire after the specified duration (default 1 hour, max 24 hours). Expired URLs return 403.
  • Operation-scoped: Download URLs cannot be used for uploads and vice versa.
  • Path-scoped: Each URL is bound to a specific file path. Changing the path in the URL returns 403.
Full reference: TypeScript SDK · Python SDK · HTTP API.