Signed URLs

Time-limited, signature-bound URLs for protecting content that's served from a public-cacheable path.

Status: skeleton

Full content lands in a follow-up pass. Sample-code repo (Node + Python + Go) lands separately under issue #131.

Use case

You have a video, PDF, or asset that's expensive to serve uncached but should only be accessible to authorized users for a window of time.

Mechanism

The edge validates a signature against the URL's path, an expiry timestamp, and your site's signing key. Invalid or expired signatures get 403.

https://your-site.viaductcdn.com/video.mp4?expires=1735689600&sig=<hex>

Sample code

Node, Python, and Go reference implementations are in the viaduct-signed-url-samples repo (link active once #131 ships).