Short-lived signed public URLs for marketing assets

Shipped: July 8, 2026 at 1:09 AM UTC
Author: Kamo
Commit: 34f2809

Lets social providers (Meta) and email fetch a specific material for a bounded window without exposing the private imaging-materials bucket. - MaterialUrlSigner: HMAC-SHA256 (platform.enc-key) token = imgId:orgId:exp, 1h TTL - MaterialsController: POST /api/media/materials/link (auth → mint URL for an org-owned MATERIALS image) + GET **************** (unauth → serve bytes for a valid token; org + assoc checked). Rides the existing sessionless /api/media/** forward — no APIService change needed.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free Forever View Pricing