Vercel Presigned URLs by elliotdauber · Pull Request #1057 · vercel/storage

elliotdauber · 2026-04-23T03:33:56Z

Implements presigned urls

Requests signing token from the server, then can use it to sign urls

import {
  issueSignedToken,
  presignUrl,
} from '@vercel/blob';

const signingToken = await issueSignedToken({
  pathname: '*',
  operations: ['get']
  ttlSeconds: 10 * 60
});

const blobUrl = 'https://<storeId>.public.blob.vercel-storage.com/media/photo.png';

const presigned = await presignUrl(blobUrl, signingToken, 'GET', { ttlSeconds: 5 * 60 });

const res = await fetch(presigned);

vercel · 2026-04-23T03:34:00Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vercel-storage-next-integration-test-suite	Ready	Preview	May 18, 2026 5:49pm

changeset-bot · 2026-04-23T03:34:01Z

⚠️ No Changeset found

Latest commit: 7f0ab50

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

elliotdauber · 2026-05-04T22:35:54Z

+      options.ifMatch !== undefined
+    ) {
+      throw new BlobError(
+        "client/`upload` doesn't allow `addRandomSuffix`, `cacheControlMaxAge`, `allowOverwrite` or `ifMatch`. Configure these options at the server side when generating client tokens.",


i need to update messaging here

elliotdauber · 2026-05-04T22:36:11Z

+    webhookPublicKey ?? process.env.BLOB_WEBHOOK_PUBLIC_KEY;
+
+  if (!resolvedWebhookPublicKey) {
+    throw new BlobError('Missing webhook public key');


should we error here? or only when doing webhook callback, if onUploadCompleted is provided

falcoagustin · 2026-05-06T14:35:26Z

+ * {@link HandleUploadPresignedIssuanceContext} to `getSignedToken` so you can include it in
+ * `issueSignedToken`.
+ */
+export async function handleUploadPresigned({


We shouldn't export this in the client

It's where handleUpload is exported so its gonna be where it's easiest for people to find when upgrading

elliotdauber · 2026-05-06T15:04:10Z

+ *   - onUploadProgress - (Optional) Callback to track upload progress: onUploadProgress(\{loaded: number, total: number, percentage: number\})
+ * @returns A promise that resolves to the blob information, including pathname, contentType, contentDisposition, url, and downloadUrl.
+ */
+export const uploadPresigned = createPutMethod<UploadOptions>({


Not sure what you mean

elliotdauber · 2026-05-06T15:04:10Z

+ *   - onUploadProgress - (Optional) Callback to track upload progress: onUploadProgress(\{loaded: number, total: number, percentage: number\})
+ * @returns A promise that resolves to the blob information, including pathname, contentType, contentDisposition, url, and downloadUrl.
+ */
+export const uploadPresigned = createPutMethod<UploadOptions>({


Not sure what you mean

* feat(blob): presigned DELETE URLs Wires the `'delete'` DelegationOperation (added in #1061, since rebased out of elliot/presigned-urls) through `presignUrl`. A token issued with `operations: ['delete']` can now mint a presigned `DELETE /?pathname=…` against the control-plane API. - `PresignDeleteUrlOptions` accepts `pathname`, optional `validUntil`, optional `ifMatch`. Upload-only fields are rejected at the type level. - `presign()` gates on the delegation scope including `'delete'`. - `buildPresignedDeleteUrl()` mirrors the PUT URL shape; the HTTP method is the discriminator (canonical signing string carries `operation=delete`). - `buildPresignCanonicalQueryEntries()` for `delete` emits only `validUntil` (when below the delegation ceiling) and `ifMatch`. - E2E test route + delete button on the presigned-upload demo page. Based on `elliot/presigned-urls`, not `main`. * feat(blob): presigned HEAD URLs (#1065) `HEAD` mirrors `GET` against the blob object host (`<storeId>.<access>.blob.vercel-storage.com/<pathname>`); the URL shape is identical and the HTTP method is the discriminator. `operation=head` goes into the canonical signing string so a GET-signed URL cannot be replayed as a HEAD (and vice versa). - `'head'` added to `DelegationOperation`. - `PresignHeadUrlOptions` — same shape as `PresignGetUrlOptions` (`pathname`, optional `validUntil`). - `presign()` gates on the delegation scope including `'head'`. - `presignUrl()` reuses `buildPresignedGetUrl()` for `operation: 'head'`. - `buildPresignCanonicalQueryEntries()` for `head` emits only `validUntil` (when below the delegation ceiling) — same as `get`. - E2E test route + HEAD button on the presigned-upload demo page. Stacked on `falcoagustin/presigned-delete-impl` (#1064).

* Add Vercel OIDC auth * up * header * up * prioritize token * normalize storeId in OIDC auth resolution BLOB_STORE_ID and the storeId option are accepted in either store_<id> or <id> form (Vercel env pull writes the prefixed form), and may be mixed-case. resolveBlobAuth was passing those through verbatim, so the storeId in API headers and CDN host subdomains could be malformed — e.g. blob.get against a private store with `store_WdsHBk1w9fDO4vPW` built `https://store_WdsHBk1w9fDO4vPW.private.blob.vercel-storage.com/...` and 404'd. The RW path was unaffected because parseStoreIdFromReadWriteToken yields a bare lowercase id from the token's structure. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * preserve case when normalizing storeId The first pass also lowercased — that breaks API requests, since the Vercel Blob API is case-sensitive on the storeId (header and bearer parsing). The CDN host accepts either case, so prefix-strip alone is sufficient and works for both consumers. Verified end-to-end against a private store: blob get and blob list both succeed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * add oidcToken option * minor version * Vercel Presigned URLs (#1057) * presigned urls * up * normalize * fix * update to new signing string * [wip] presigned url version of handleUpload (#1059) * [wip] presigned url version of handleUpload * up * up * up * add presigned urls for mpu * update options shape * webhook signature * update example * up * up * up * change to operation * up * up * verify webhook signature * up * callbackUrl * non-null * presigned url opts * new delegation token + url opts * dont lowercase store id * validUntil instead of ttlSeconds * up * up * Add 'delete' to DelegationOperation for presigned DELETE URLs (#1061) Mirrors the API-side change that adds `delete` to the issue_signed_token allowed operations. `presignUrl` now signs canonical `operation=delete\npathname=...` against the public blob object URL (same host shape as `get`/`head`, just used with HTTP DELETE). Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * change upload to put * delete * up * presigned url payload * update app * fix * docs * refactor presign url * up * up * up * add head * up * add params to url * add keys first * token payload * add buildPresignedGetUrl * up * presignUrl returns url, not accepted in sdk methods * up * up * feat(blob): presigned HEAD & DELETE URLs (#1064) * feat(blob): presigned DELETE URLs Wires the `'delete'` DelegationOperation (added in #1061, since rebased out of elliot/presigned-urls) through `presignUrl`. A token issued with `operations: ['delete']` can now mint a presigned `DELETE /?pathname=…` against the control-plane API. - `PresignDeleteUrlOptions` accepts `pathname`, optional `validUntil`, optional `ifMatch`. Upload-only fields are rejected at the type level. - `presign()` gates on the delegation scope including `'delete'`. - `buildPresignedDeleteUrl()` mirrors the PUT URL shape; the HTTP method is the discriminator (canonical signing string carries `operation=delete`). - `buildPresignCanonicalQueryEntries()` for `delete` emits only `validUntil` (when below the delegation ceiling) and `ifMatch`. - E2E test route + delete button on the presigned-upload demo page. Based on `elliot/presigned-urls`, not `main`. * feat(blob): presigned HEAD URLs (#1065) `HEAD` mirrors `GET` against the blob object host (`<storeId>.<access>.blob.vercel-storage.com/<pathname>`); the URL shape is identical and the HTTP method is the discriminator. `operation=head` goes into the canonical signing string so a GET-signed URL cannot be replayed as a HEAD (and vice versa). - `'head'` added to `DelegationOperation`. - `PresignHeadUrlOptions` — same shape as `PresignGetUrlOptions` (`pathname`, optional `validUntil`). - `presign()` gates on the delegation scope including `'head'`. - `presignUrl()` reuses `buildPresignedGetUrl()` for `operation: 'head'`. - `buildPresignCanonicalQueryEntries()` for `head` emits only `validUntil` (when below the delegation ceiling) — same as `get`. - E2E test route + HEAD button on the presigned-upload demo page. Stacked on `falcoagustin/presigned-delete-impl` (#1064). * environment error * up * cleanup --------- Co-authored-by: Agustin Falco <agusfalco_11@hotmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * up * rm dead code * throw on manual token * up * up --------- Co-authored-by: Agustin Falco <agusfalco_11@hotmail.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

elliotdauber changed the base branch from main to elliot/oidc-auth April 23, 2026 03:38

vercel Bot deployed to Preview April 23, 2026 03:39 View deployment

falcoagustin changed the title ~~Presigned URLs~~ Vercel Signed Links Apr 23, 2026

vercel Bot deployed to Preview April 23, 2026 16:16 View deployment

vercel Bot deployed to Preview April 23, 2026 21:49 View deployment

elliotdauber force-pushed the elliot/oidc-auth branch from f890e7c to 179061a Compare April 28, 2026 21:05

elliotdauber force-pushed the elliot/presigned-urls branch from 167f019 to 501d37d Compare April 28, 2026 21:56

vercel Bot deployed to Preview April 28, 2026 21:57 View deployment

falcoagustin changed the title ~~Vercel Signed Links~~ Vercel Secure Links May 2, 2026

elliotdauber force-pushed the elliot/presigned-urls branch from 501d37d to 4fed205 Compare May 4, 2026 18:22

vercel Bot deployed to Preview May 4, 2026 18:23 View deployment

vercel Bot deployed to Preview May 4, 2026 21:57 View deployment

elliotdauber commented May 4, 2026

View reviewed changes

vercel Bot deployed to Preview May 4, 2026 22:35 View deployment

elliotdauber commented May 4, 2026

View reviewed changes

Comment thread packages/blob/src/client.ts Outdated

elliotdauber commented May 4, 2026

View reviewed changes

Comment thread packages/blob/src/helpers.ts Outdated

vercel Bot deployed to Preview May 4, 2026 22:57 View deployment

vercel Bot deployed to Preview May 4, 2026 23:32 View deployment

vercel Bot had a problem deploying to Preview May 4, 2026 23:37 Failure

vercel Bot deployed to Preview May 5, 2026 17:37 View deployment

vercel Bot deployed to Preview May 5, 2026 20:16 View deployment

vercel Bot deployed to Preview May 5, 2026 20:24 View deployment

falcoagustin mentioned this pull request May 6, 2026

Add 'delete' to DelegationOperation for presigned DELETE URLs #1061

Merged

falcoagustin reviewed May 6, 2026

View reviewed changes

elliotdauber commented May 6, 2026

View reviewed changes

vercel Bot deployed to Preview May 6, 2026 16:31 View deployment

vercel Bot deployed to Preview May 6, 2026 18:31 View deployment

elliotdauber and others added 25 commits May 18, 2026 10:48

change upload to put

5e63fcf

delete

71fdc9b

up

b47b7ae

presigned url payload

532807f

update app

c1500d7

fix

a04a28b

docs

c328610

refactor presign url

e841e51

up

5c928de

up

8f3d362

up

7412c3f

add head

7538ab3

up

bd058fa

add params to url

a4142b3

add keys first

5037b53

token payload

6ae9d9e

add buildPresignedGetUrl

bf3efb2

up

d8660e5

presignUrl returns url, not accepted in sdk methods

1ac5694

up

6df58d2

up

9a022c3

environment error

a72bb72

up

b31490b

cleanup

7f0ab50

elliotdauber force-pushed the elliot/presigned-urls branch from 93eaf90 to 7f0ab50 Compare May 18, 2026 17:48

vercel Bot deployed to Preview May 18, 2026 17:49 View deployment

elliotdauber merged commit e527fad into elliot/oidc-auth May 18, 2026
3 checks passed

elliotdauber deleted the elliot/presigned-urls branch May 18, 2026 17:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Vercel Presigned URLs#1057

Vercel Presigned URLs#1057
elliotdauber merged 44 commits into
elliot/oidc-authfrom
elliot/presigned-urls

elliotdauber commented Apr 23, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Apr 23, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Apr 23, 2026 •

edited

Loading

Uh oh!

elliotdauber May 4, 2026

Uh oh!

Uh oh!

elliotdauber May 4, 2026

Uh oh!

Uh oh!

Uh oh!

falcoagustin May 6, 2026

Uh oh!

elliotdauber May 6, 2026

Uh oh!

elliotdauber May 6, 2026

Uh oh!

elliotdauber May 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

elliotdauber commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

elliotdauber May 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elliotdauber May 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

falcoagustin May 6, 2026

Choose a reason for hiding this comment

Uh oh!

elliotdauber May 6, 2026

Choose a reason for hiding this comment

Uh oh!

elliotdauber May 6, 2026

Choose a reason for hiding this comment

Uh oh!

elliotdauber May 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

elliotdauber commented Apr 23, 2026 •

edited

Loading

vercel Bot commented Apr 23, 2026 •

edited

Loading

changeset-bot Bot commented Apr 23, 2026 •

edited

Loading