Client approval
A draft design or proposal may only need to stay open during the review period. Add the access and expiry controls that fit the client, then disable the link when the review no longer needs to continue.
Choose how each link can be used
Security and access controls for hosted files
Not every uploaded file should behave the same way. A public website image may need an open URL, while a client document might need a password, an expiry time or a link that can be disabled after the review ends.
Media2URL keeps these choices with the hosted file. You can control who should be able to reach it, how long the link should work, what the recipient can do and, where supported, how direct delivery itself is authorised.
The workflow
Decide what should happen when someone opens the link
Start with the person receiving the file. Do they simply need the URL, should they enter a password, or should the link stop working after a particular time or number of uses?
Once that is clear, the access settings become much easier to choose.
1. Choose who should get access
Choose Public, Unlisted, Private, or access protected by a password where those modes are available. An unlisted link still depends on possession of the URL, while private access uses the workspace access rules.
2. Decide when access should stop
Add an expiry time, a setting that allows one view, maximum view count or download limit when the file should not remain usable without a boundary. Available controls depend on the current asset and plan.
3. Decide what the recipient can do
Choose the available preview and delivery behaviour for the file. A share page can hide the filename or file details, remove the download button or use preview without download behaviour where supported.
4. Control delivery after the link is issued
Where signed delivery is enabled, direct file requests can use signed URLs available for a limited time instead of relying only on a permanent raw address. You can also disable the file link or rotate its signing key when previously issued signed URLs should stop working.
Access architecture
File access has four separate layers
| Layer | What it controls | Media2URL examples |
|---|---|---|
| Delivery | Whether a direct delivery request is authorised | Signed URLs, TTL, signing key rotation, transformation controls |
| Access | Who should be able to open the file | Public, Unlisted, Private, protected by a password |
| Lifecycle | How long or how many times access should continue | Expiry, access for one view, maximum views, maximum downloads, disable link |
| Interface | What someone sees or can do on the share page | Preview without download, hide filename/details, download button control, delivery mode |
These controls can work together, but they are not interchangeable. A password answers a different question from an expiry time, and disabling downloads is different from restricting access to the file itself.
The useful setup is normally the smallest combination that fits the real sharing situation.
Delivery security
Signed delivery puts a time limit on the direct request
A normal URL can continue to work for as long as the underlying route remains valid. Signed delivery adds another check before Media2URL serves the supported file.
When signed delivery is enabled, Media2URL can issue a delivery URL containing a cryptographic signature and an expiry boundary. The server can use that signature to verify that the URL was issued with the expected signing key and has not simply been changed to create another valid request.
A signed URL is not an encrypted URL
Signing and encryption solve different problems. A signature helps Media2URL check whether the delivery request was created using the expected signing secret and whether its allowed time window is still valid. The protection comes from signature validation and expiry rather than hiding the address.
Signed delivery TTL controls
The signed delivery TTL controls how long an issued signed URL remains valid under the configured limit. A shorter window reduces how long an old signed URL remains usable if copied elsewhere, though the shortest time is not automatically the best experience.
Signing key rotation with a single action
Media2URL lets you rotate the signed delivery key version for the file. Previously issued URLs signed against the earlier version can be invalidated immediately while the stored media asset itself remains securely in place.
Do not let an image URL become an unlimited transformation endpoint
Dynamic image resizing is useful because one source image can serve different layouts. The problem is that unrestricted transformation parameters can also create a large number of unnecessary variants.
Media2URL provides controls for whether image transformations are allowed and how large a requested transformed image can become. Width and height limits give the asset a boundary instead of accepting arbitrary dimensions without restriction.
Transformation limits protect output dimensions
A stored image may be large because the original needs to be preserved. That does not mean every public transformation request needs permission to generate another image at any requested size.
Maximum transformation width and height give delivery another boundary. A website that only needs normal web sized derivatives can keep those limits much lower than the dimensions of the source file.
Link visibility
Public, Unlisted, Private, and access protected by a password mean different things
| Access mode | What it means |
|---|---|
| Public | The configured link can be opened normally by someone who has the URL |
| Unlisted | The URL is meant to be shared directly and is not the same as workspace authorised private access |
| Private | Access follows the private or workspace authorisation rules available for the file |
| Protected by a password | The recipient must pass the configured password check where that access mode applies |
Unlisted should never be described as private. Someone who receives an unlisted URL may still be able to pass that URL to another person.
Choose Private or access protected by a password when the recipient should face an actual access check rather than relying only on the obscurity of the address. Workspace roles and permissions can be managed inside your Team Workspaces.
Access for one view and maximum views are not the same setting
A setting that allows one view is useful when the intended workflow is based around a single successful viewing opportunity. A maximum view limit gives you more room because the link can remain available until the configured count is reached.
Expiry solves a different problem again by limiting the link by time. None of these controls can make a recipient forget or delete content that they already saw or saved while access was allowed.
Disable the link without deleting the library file
A shared URL can become unnecessary before its expiry date. The asset may have been sent to the wrong group, a client review may have finished or another version may have replaced it.
Disabling the link lets you stop its normal public delivery without first deleting the stored library asset. This keeps link state and file storage as two separate decisions.
Decision framework
Which control fits the situation?
| Situation | Controls worth considering |
|---|---|
| Client draft for one week | Password or Private access + expiry |
| Single use handoff | A setting that allows one view or a small max view threshold |
| Download with a fixed allowance | Maximum downloads + appropriate access mode |
| Application delivered private media | Signed delivery + suitable TTL |
| Signed URL copied somewhere unexpected | Rotate the signing key or disable the link |
| Public image with dynamic resizing | Transformation limits and maximum output dimensions |
| Preview without normal download UI | Preview without download plus download button control |
These are examples rather than mandatory combinations. Use only the controls that solve the problem you actually have.
Practical use
Where these controls become useful
Internal files
A document meant for workspace members should not automatically use the same access as a public brochure. Private access can keep the dashboard workflow separate from normal public sharing.
Application delivery
A website or application may need a direct media response without giving one permanent delivery URL unlimited lifetime. Signed delivery can add a signature and time boundary to that request where the feature is enabled.
Public image transformations
A public image can still need delivery limits even when the original itself is meant to be visible. Restricting transformation dimensions helps keep dynamic resizing within the range the website actually needs.
Use the least access that still lets the recipient finish the job
A public link makes sense when the file is meant for public use. Adding passwords and expiry settings to every file would only create unnecessary friction. The opposite is also true. A confidential client file should not be left public simply because sending the URL is convenient. Start from what the recipient needs to do, then choose the access, lifecycle and delivery controls that support that task without opening more access than necessary.
Access boundaries
What these controls cannot guarantee
- A permitted recipient can still share what they received. Access controls restrict the Media2URL route. They cannot guarantee that someone will not copy, photograph or redistribute content after legitimate access.
- Unlisted does not mean private. Anyone who receives the working URL may be able to use it while its other access conditions remain valid.
- Disabling a link is not the same as deleting the file. Link state and the stored library asset are managed separately.
- Security controls depend on the current route and plan. Check the active asset settings instead of assuming every control applies equally to every file type.
Questions about this workflow
Frequently asked questions
No. Unlisted means access depends on having the URL, but that is not the same as private workspace authorisation. If someone forwards a working unlisted link, another person may also be able to use it while its other access conditions remain valid.
Where the file and plan support it, you can hide or disable the normal download action or use preview without download behaviour. A maximum download control can also limit the allowed number of downloads where available. Hiding a button should not be treated as a guarantee that a permitted viewer cannot otherwise capture the content they can see.
Yes. The link can be disabled from the asset access controls where that option is available. This stops the link without requiring the stored library file itself to be deleted.
Password behaviour depends on the access and delivery route used for the asset. Check the current file controls rather than assuming that a password shown on a share page automatically describes every possible direct delivery URL. Signed delivery is a separate control for authorising supported direct requests.
A signed URL includes information that Media2URL can validate before serving the supported file. The signature is created using the configured signing mechanism and can be paired with an expiry period. Media2URL's current signed delivery implementation uses HMAC based signing. HMAC is a keyed message authentication mechanism rather than URL encryption.
Media2URL increments the signing version used for the asset. Previously issued signed URLs tied to the older version can then be invalidated, while new URLs can be created using the current signing version. This lets you revoke old delivery URLs without replacing the underlying file.
Expiry stops access based on time. A maximum view limit stops the link after its configured view threshold is reached. A setting that allows one view is the stricter version of the workflow based on viewing when only one viewing opportunity is intended.
Dynamic transformations can create different versions of the same source image. Without useful boundaries, unnecessary parameter variations can create extra processing and derived outputs. Media2URL can restrict whether transformations are enabled and set maximum requested dimensions to prevent uncontrolled derived resource creation.
Next steps