Signed URLs are now available for Vercel Blob
By Steven Van ·
Vercel Blob adds scoped, time-limited URLs for uploads, downloads and deletes, requiring @vercel/blob 2.4.0.
Vercel Blob now supports signed URLs: time-bound, scoped links that let a client upload, download, inspect, or delete a single object without holding a read-write token for the whole store. Each URL is scoped to one operation (put, get, head, or delete), one pathname, and an expiry of up to 7 days, and the signature covers the operation itself, so a URL signed for a GET can't be reused as a PUT.
- Upload URLs support multipart, so browsers can stream large files straight to Blob storage without routing through a server.
- Delete URLs accept an ifMatch option, so a delete only goes through if the object hasn't been overwritten since the URL was signed.
- Signed URLs work alongside OIDC: a server authenticates to Blob via OIDC, generates a signed token, and issues narrowly scoped, time-bound URLs to the browser, so the long-lived BLOB_READ_WRITE_TOKEN never leaves the server.
The feature requires @vercel/blob 2.4.0 or later.
Vercel
The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.
View Vercel →