Create a signed URL
Mint a time-limited signed URL for one object.
Mint a signed URL that lets the holder read path for expires_in seconds, without an Authorization header. Use for private buckets, paywalled assets, or temporary share links.
Signature
supabase.storage.from(bucket_id).create_signed_url(path,expires_in:,download: nil,transform: nil)Parameters
| Name | Type | Required | Description |
|---|---|---|---|
path | String | Required | Object path inside the bucket. |
expires_in | Integer | Required | Lifetime of the signed URL, in seconds. Stringified into the wire payload as "expiresIn". |
download | Boolean, String | Optional | true to force a Content-Disposition: attachment with the original filename. Pass a String to override the suggested filename. Omit/nil to leave the response inline. |
transform | Hash | Optional | Image-render options (height, width, resize, format, quality). Sent to storage-api in the JSON body — same vocabulary as download(). |
Returns
{ "signedURL" => "...", "signedUrl" => "..." } — both keys carry the same fully-qualified URL (already joined with @base_url, including any ?download= / ?transform= query). The duplicate key is intentional: see the callout below.
Example — minimal share link
result = supabase.storage.from("private-uploads").create_signed_url(
"contracts/2026/agreement.pdf",
expires_in: 60
)
result["signedURL"]
# => "https://project.supabase.co/storage/v1/object/sign/private-uploads/contracts/2026/agreement.pdf?token=..."Example — force download with custom filename
supabase.storage.from("invoices").create_signed_url(
"2026/Q2/INV-0001.pdf",
expires_in: 300,
download: "ACME-Invoice-2026-Q2-0001.pdf"
)Example — signed URL for an image transform
supabase.storage.from("avatars").create_signed_url(
"people/ada.png",
expires_in: 3600,
transform: { width: 64, height: 64, resize: "cover" }
)Both `signedURL` and `signedUrl` keys are populated
The Hash returned by create_signed_url carries the URL under both "signedURL" (all-caps URL) and "signedUrl" (camelCase, matches supabase-js). Pick whichever spelling your call site uses — the values are identical strings. The pattern repeats on create_signed_urls (per-item Hashes carry both keys) and on Types::SignedUploadURL (Struct exposes signed_url, signedUrl, and signedURL reader aliases).