Share links and signed URLs

T4 has two link models. Dashboard share links use a T4 token and do not need an API key. S3 presigned URLs use SigV4 and are intended for API clients.

From the dashboard (token link)

Open a bucket → share icon on an object row → choose a lifetime → Create link. The result appears in the modal with a copy button and expiry time.

The URL has the form https://t4.dalang.io/s/<token>. T4 stores only a SHA-256 hash of the token, never the token itself. The link is independent of your API keys: revoking or rotating a key does not affect it. It expires after 1 hour, 24 hours, or 7 days, and returns 404 if the object is deleted or renamed.

S3 presigned URLs

A presigned URL grants temporary access to one object using a SigV4 query. It is valid until X-Amz-Expires elapses and is bound to an API key.

From the CLI

aws --endpoint-url https://t4.dalang.io \
  s3 presign s3://assets/branding/logo.png --expires-in 3600

From boto3

url = s3.generate_presigned_url(
    "get_object",
    Params={"Bucket": "assets", "Key": "branding/logo.png"},
    ExpiresIn=3600,
)

Upload with a presigned PUT

url = s3.generate_presigned_url(
    "put_object",
    Params={"Bucket": "assets", "Key": "uploads/photo.jpg", "ContentType": "image/jpeg"},
    ExpiresIn=600,
)
# PUT the body to url with header Content-Type: image/jpeg

Limits and safety

• X-Amz-Expires from 1 second to 7 days (604,800 seconds).
• The link carries its own signature; anyone holding it can read the object

until it expires. Do not post it publicly.

• Dashboard token links are independent of API keys; S3 presigned URLs are

signed with a key and stop working immediately when that key is revoked or rotated. Resolve keys on each S3 request and use short lifetimes for sensitive data.

• A URL is bound to its signed method and path; changing the query or path

invalidates the signature.