# Signed URLs are now available for Vercel Blob By Steven Van · 2026-06-02 Vercel Blob adds scoped, time-limited URLs for uploads, downloads and deletes, requiring @vercel/blob 2.4.0. [Vercel]() Blob now supports [signed URLs](): time-bound, scoped links that let a client upload, download, inspect, or delete a single object without holding a read-write token for the whole store. Each URL is scoped to one operation (put, get, head, or delete), one pathname, and an expiry of up to 7 days, and the signature covers the operation itself, so a URL signed for a GET can't be reused as a PUT. - Upload URLs support multipart, so browsers can stream large files straight to Blob storage without routing through a server. - Delete URLs accept an ifMatch option, so a delete only goes through if the object hasn't been overwritten since the URL was signed. - Signed URLs work alongside OIDC: a server authenticates to Blob via OIDC, generates a signed token, and issues narrowly scoped, time-bound URLs to the browser, so the long-lived BLOB\_READ\_WRITE\_TOKEN never leaves the server. The feature requires **@vercel/blob 2.4.0** or later. [![]()]() ![Vercel]() Vercel The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config. [View Vercel →]() Sources [Original source]() [Read Signed URLs are now available for Vercel Blob on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/vercel-signed-urls-are-now-available-for-vercel-blob