Share S3 files with presigned URLs
Use Blob0 on your Mac to create a temporary, read-only presigned link for one S3-compatible object. Learn the Share… steps, expiry choices, and access limits for AWS S3 and Cloudflare R2.
A GET presigned download URL lets someone read one object without making its bucket public. Blob0 creates the link from a connected storage profile in its macOS app; this guide explains that workflow and its limits.
Install Blob0 for macOSCreate a presigned link in Blob0
Connect to the bucket and choose one object
Open the connected bucket in Blob0 and find the file you want to share. This example uses the object key deliverables/design-review.pdf. A key is the object name in the bucket; it is not a path on your Mac.
Open Share… and choose Presigned
Open the selected file’s actions menu and choose Share…. When the profile has a Public / custom domain configured, the dialog initially selects Public URL. Switch to Presigned to create a temporary signed link; profiles without a Public / custom domain already use Presigned.
Pick an expiry, copy the link, and send it safely
Choose one of the available durations, then select Copy. Send the URL only to the intended recipient. Anyone who has the link can read this object while the signature and the signer’s permissions remain valid. Generate a new link after it expires.
Expiry choices and access limits
The Share… dialog offers 15 min, 1 hour, 24 hours, and 7 days. 7 days is the longest option in the interface, but that expiry is not guaranteed: signing credentials can expire earlier, and a policy change, revoked permission, or removed object can stop access sooner.
- 15 min
- 1 hour
- 24 hours
- 7 days
Public URL and Presigned are different
A Public URL is a direct link on a domain configured for the profile. It is not a temporary signature and may be publicly readable according to that domain’s setup. A Presigned URL grants the signed operation for a limited time; creating one does not make the bucket public.
Quick copy actions do not open the duration picker
The file menu’s Copy link command and the Preview toolbar’s Share icon are shortcuts. They copy the configured Public URL first; if none is available, they copy a 24-hour presigned link. Use Share… when you need to select Presigned explicitly or choose another expiry.
This share link reads; it does not upload
Blob0 creates a GET link so the recipient can read or download the selected object. It is not a PUT upload link. The web page does not generate or sign a URL and never asks for an access key, secret key, or storage credentials.
Troubleshooting and safety
- The link expired or stopped working
- Create and copy a fresh link in Blob0. A selected expiry is an upper limit: the signer’s credentials, object permissions, bucket policy, or the object itself may become unavailable earlier.
- The recipient gets AccessDenied
- Confirm that the object still exists and the connected profile can read it. A presigned link does not grant more permission than the signer has, and it does not change bucket visibility.
- Using a Cloudflare R2 custom domain
- R2 presigned URLs use the S3 API endpoint. A signed URL cannot be changed to an r2.dev address or a custom domain; use the endpoint included in the generated URL.