Is a presigned URL limited to the browser that requested it?

Not inherently. Possession of the URL grants the signed operation during its validity.

Who should choose the storage key for a signed upload?

The trusted backend should derive or validate it after checking the user’s permissions.

Does successful URL creation prove an upload completed?

No. Verify the actual stored object before finalizing the application record.

How do presigned URLs enable private R2 uploads and downloads?

A presigned URL authorizes a particular storage operation for a limited time. It avoids distributing long-lived storage credentials to the browser.

Authorize before signing

The backend should verify the user’s permission and choose the bucket, key, operation, and expiry. Do not let the client request signatures for arbitrary private objects. Treat the resulting URL as a temporary credential: anyone who obtains it may use its permitted operation until it expires.

Keep access and artifact identity separate

Store the stable object reference in the database and issue a fresh URL when the owner needs access. Do not assume an expired link means the object was deleted. For uploads, verify the stored object before marking the artifact ready. Test an unauthorized signing request, an expired URL, and a valid authorized operation. Keep signed URLs out of unnecessary logs and analytics.

How do presigned URLs enable private R2 uploads and downloads?