Using Signed URLs for Private Supabase Files
Some files should never be publicly accessible. Think about invoices, identity documents, private reports, customer attachments, or internal company files. For these files, a public URL is usually the wrong approach.
Use Private Storage
Create a private storage bucket for sensitive files. The application can then check whether the current user is allowed to access a particular object.
Generate a Signed URL
After authorization, your backend can generate a temporary signed URL. The URL provides access for a limited period instead of exposing the file permanently.
Why Temporary Access Helps
Suppose a customer needs to download an invoice. You can verify their account and then generate a link that works for a short period. After it expires, the old URL no longer provides access.
Keep Authorization on the Server
The frontend should not decide whether a user owns a private document. The backend and database policies should enforce access.
Good Use Cases
Signed URLs are useful for: Customer documents Private images Downloadable reports Paid content Internal files Temporary exports
Hostwares' current self-hosted Supabase stack supports S3-compatible storage and signed URLs. Private storage combined with proper authorization provides a much safer file-delivery model than simply making every bucket public.