A presigned URL is a time-limited link that grants access to one object without making the bucket public. It is the standard way to let a customer download a file safely. This guide explains how they work, how long they last, and the mistakes to avoid.
How a presigned URL works
The link contains a signature created with the bucket owner's credentials. Anyone holding it can download that object until the signature expires — no AWS account needed. That is exactly why links to private data are shared like passwords.
In S3zipper
Every completed zip job returns one. When you call /v1/zipresult, the result is a presigned URL for the archive in your bucket:
{"message":"Results","results":["https://my-bucket.s3.us-east-1.amazonaws.com/results/exports.zip?X-Amz-Algorithm=..."]}The link is valid for seven days by default. Shorten or lengthen it per job with expireLink — for example "expireLink": 24 for a link that dies after a day. Stream jobs (/v1/streamzip) instead return a signed /stream?u= URL, which behaves the same way from the recipient's point of view.
Choosing an expiry
- One-off downloads — a few hours is usually right.
- Emailed links — a few days, so people can open it at the office tomorrow.
- Avoid weeks for anything sensitive: every minute the link is alive is a chance to leak.
Three mistakes to avoid
- Logging the URL. Web servers, proxies and analytics all log query strings — a presigned URL in a log file is an access token. Redact the query string for
/resultand/streamresponses. - Making the bucket public instead. Presigned URLs let you keep objects private; there is no reason to open the bucket "so downloads work".
- Reusing one link forever. Re-request the result when you need a new one; the API signs a fresh link for you.
Revoking access
A signed link cannot be "deleted", but you can stop it working by removing the object. After expiry the signature is simply rejected, and the bucket stays private throughout.