How preview, download, and share links stay secure
The signed tokens behind previews, downloads, share links, and signing links.
3 min read · Updated July 13, 2026
Stoatify uses links in a few places, to show a preview, to download a file, to share a document, to send someone a document to sign, and each is designed so a URL can't become a backdoor.
Preview and download links
- These carry a signed, short-lived token scoped to one document and one purpose (view or download).
- Every request is re-checked live against your access and the document's status, so the moment a document is trashed or removed, its links stop resolving.
Share links
- A share link uses a long, random, unguessable address, and you can add a password (checked securely, never carried in the URL) and an expiry.
- Repeated password guesses are rate-limited, so a link can't be brute-forced, and every open is recorded in its access log.
Signing links
- Each signer's link is a single-purpose token that stops working once they finish, once you resend their link, or if you withdraw the send.
Good to know
None of these links expose storage directly: they authorize a specific action through the API, which enforces your access on every request.
Was this article helpful?
Stoatify sends only this article's route and your Yes or No choice.