Presigned URLs

Information on presigned URLs in Telnyx Cloud Storage: Current restrictions and guidance on safe object sharing practices.

This is currently supported for buckets located in the US, APAC, and CA (ap-southeast-1, ca-central-1).

Do not generate presigned URLs with AWS SDKs, the AWS CLI, or other S3 presigning tools. Telnyx currently authenticates S3 requests using your Telnyx API key as the AWS Access Key ID. Standard AWS presigning can place that value in the URL (in X-Amz-Credential), exposing your Telnyx API key to anyone who receives or logs the link.

Use the Telnyx Create Presigned Object URL API instead. Never share an AWS-generated presigned URL for Telnyx Storage. If you have already shared one containing your key, rotate the exposed API key.

Please use the JSON companion API to generate ephemeral presigned URLs to allow anonymous downloads and uploads of objects to your bucket(s).

In addition, creating long-lived presigned URL is a privileged action. Non-verified accounts are limited to presigned URLs with TTL no greater than 5 minutes.

To verify your account, request and obtain Level 2 verification status.

Examples

Considering 8f0nh1jk8qvf as an example of a presigned URL token, you can perform the following actions:

Downloading an object using a presigned URL

curl -o my-object.bin https://us-central-1.telnyxcloudstorage.com/my-bucket/my-object.bin\?X-AMZ-Security-Token\=8f0nh1jk8qvf

Uploading an object using a presigned URL

curl -X PUT -T a-new-object.bin https://us-central-1.telnyxcloudstorage.com/my-bucket/a-new-object.bin\?X-AMZ-Security-Token\=8f0nh1jk8qvf

where a-new-object.bin is the file you want to upload in my-bucket. If the object already exists, it will be overwritten.