Generate a signed URL
GET
/v1/storage/{project_id}/{bucket}/signed-urlHMAC signed URL to share a private object with a validity period. It's a GET to query parameters, not a POST to JSON body.
This English text was generated automatically from the French original and has not been reviewed yet.
#
Request
Query params
| Parameter | Type | Required | Description |
|---|---|---|---|
key | string | yes | Path of the object in the bucket. A redundant {bucket}/ prefix is removed automatically. |
ttl_secs | integer | no | Validity period in seconds. Default 3600. Accepted alias: expires_in. No cap is imposed on the server side. |
method | string | no | HTTP method that the URL will allow. Default GET. A write method requires a write-enabled caller — the anon key cannot sign a write URL, even on a public bucket. |
#
Notes
Security
Astuce
The signature concerns the method + bucket + key + expiration quadruplet: a URL for /a.pdf cannot be used for /b.pdf, nor can a signed GET be used as a PUT. Authorization is checked at the time of signing, not in use. A signature secret per project allows all emitted URLs to be invalidated in bulk: POST /v1/storage/{project_id}/rotate-secret.
#
Notes
Upload signed
Info
For a direct upload, GET /v1/storage/{project_id}/{bucket}/upload-url emits a URL PUT (TTL by default 300 s on the backend side; the JS SDK transmits 3600 s by default). This route is reserved for service_role. Both routes share a per IP limit of one token every 3 s, burst 5.
v1.0 · revised Apr 15, 2026