Presigned URL
A short-lived signed link that lets someone upload or download one object directly without getting your storage credentials.
See it
What it is
A presigned URL is a normal-looking URL carrying a cryptographic signature that authorizes one storage operation for a limited time. Your server signs a specific upload or download, hands the URL to the client, and the client talks directly to Amazon S3 or another object store without receiving cloud credentials.
Reach for one when large files should bypass your application server. The usual upload flow is two calls: ask your API for a presigned PUT URL, then PUT the bytes straight to storage. This saves application bandwidth and avoids tying up a server process while a slow connection uploads hundreds of megabytes.
Treat the URL like a short-lived bearer credential: anyone who gets it can use it until it expires. Authorize the object key before signing, keep expiry short, restrict method and content constraints, and never log the full query string. Signed headers must match the upload request, and the bucket still needs CORS rules if a browser calls it from another origin.
Ask AI for it
Add a POST /api/uploads/presign route using getSignedUrl from @aws-sdk/s3-request-presigner with an S3 PutObjectCommand from @aws-sdk/client-s3 and expiresIn: 300. Authenticate the caller, generate the object key server-side under that user's prefix, allow only JPEG and PNG content types, and return the URL plus key and expiry. In the browser, PUT the File directly to S3 with the same Content-Type used when signing, show upload progress, and configure the S3 bucket CORS policy for the app's exact origin.