Signed URLs
Capability-bearing links with expiry for direct storage access.
Signed URLs
What it is
Mint after authz; storage verifies signature and expiry.
When to use
Uploads/downloads without byte-proxying APIs.
Failure mode
Long expiry; minting without authz; key leaks.