There are four ways to give someone (or an <img>) access to a file. Pick by who the reader is and for how long.

​
Public URL

Turn Public bucket on in the bucket’s settings (Bucket settings). Then:
In TypeScript the address carries your publishable key, which is designed to be public. A secret key is refused, so you can’t leak one into a page by accident. The Python address is a gateway address that needs no key. A private bucket answers “not found” to a public address; use one of the other kinds. You can copy a file’s exact address in Studio: file → Overview → Address → Gateway URL. A signed link lets anyone who holds it read one file for a short time, with no sign-in. Turn on Signed downloads in the bucket’s settings, then:
You must be able to read the file yourself to sign it. The default lifetime is 300 seconds. Make a new link each time the page opens rather than storing one. Typical uses: a “Download” button for a private file, a link in an email. For people with no account who need a file for longer, a share link can be revoked and shows how often it was opened. Create it in Studio: open the file, Sharing tab. See Share links. Share links aren’t created from the client library.

​
Which to choose

​
Security notes

  • Anyone who has a signed or share URL can use it until it expires. Treat it like a password: don’t log it, don’t put it in a page others see.
  • A public bucket’s file addresses are guessable if keys are (1.png, 2.png). Use random keys for anything not meant to be browsed.
  • Replacing a file keeps its URL; deleting or moving it ends its share links.

Share links

Studio steps.

Images

Resize through any of these.