S3 - Signed URLs

A signed URL Signed URL A temporary, scoped link to one file in private storage. It lets a client read or upload that single object without making the bucket public or sharing credentials. is a temporary, scoped link to a single object. It lets a client read or upload one file directly to storage, without making the bucket public and without sharing your credentials. It's a time-limited guest pass. It opens one specific door, and only until it expires.

How to use it

import { getSignedUrl } from "@aws-sdk/s3-request-presigner";

// A link the browser can use to download one private file for 5 minutes
const url = await getSignedUrl(
  s3,
  new GetObjectCommand({ Bucket: "my-app-uploads", Key: "invoices/123.pdf" }),
  { expiresIn: 60 * 5 }
);

The same trick works for uploads with a PutObjectCommand. The browser uploads straight to the bucket, so the file never has to pass through your server.

Why it matters

• Your bucket stays private; only holders of a valid link get in
• Large uploads and downloads skip your server, saving bandwidth and memory
• Access expires on its own. No cleanup, no lingering public links