You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Even when a resource is restricted, you might still want to share it with someone outside your team — for example, to send a PDF report to a client, or include a screenshot in an automated email or Slack message. In these cases, **storage resources** (like key-value stores, datasets, and request queues) support generating **pre-signed URLs**. These are secure, time-limited links that let others access individual files without needing an Apify account or authentication.
129
129
130
130
#### How pre-signed URLs work
131
+
131
132
A pre-signed URL is a regular HTTPS link that includes a cryptographic signature verifying that access has been explicitly granted by someone with valid permissions.
132
133
When the signed URL is used, Apify validates the signature and grants temporary access only to the file or record it refers to - no API token required.
133
134
134
135
**Key properties**:
136
+
135
137
-**Works with restricted resources** – Even if “General resource access” is set to **Restricted**, the signed URL will work without asking for API token.
136
138
**Time-limited (optional)** – Links can be either **temporary** (expiring after a specified duration) or **permanent**, depending on how they’re generated.
137
139
**Lightweight** - Ideal for embedding in emails, webhooks, reports, or notifications where authentication isn’t possible.
@@ -162,11 +164,13 @@ the API response includes automatically generated fields:
162
164
These automatically generated URLs are **valid for 14 days**.
163
165
164
166
The response also contains:
167
+
165
168
-`consoleUrl` - provides a stable link to the resource's page in the Apify Console. Unlike a direct API link, Console link will prompt unauthenticated users to sign in, ensuring they have required permissions to view the resource.
166
169
167
170
:::
168
171
169
172
#### How to generate pre-signed URLs
173
+
170
174
You can create pre-signed URLs either through the Apify Console or programmatically via the API or SDK.
171
175
172
176
**In console:**
@@ -181,7 +185,7 @@ The link will include a signature **only if the general resource access is set t
181
185
182
186
:::
183
187
184
-
-**Dataset items:**
188
+
-**Dataset items:**
185
189
1. Click the **Export** button.
186
190
2. In the modal that appears, click **Copy shareable link**.
187
191
@@ -199,6 +203,7 @@ The link will include a signature **only if the general resource access is set t
199
203
You can generate pre-signed URLs programmatically for datasets and key-value stores:
@@ -263,6 +270,7 @@ To test your public Actor, run it using an account with **General resource acces
263
270
:::
264
271
265
272
In practice, this means that:
273
+
266
274
- All API requests made by your Actor must include a valid API token.
267
275
- When using the Apify SDK or Apify Client, this is handled automatically.
268
276
- Avoid relying on URLs that require unrestricted access or authentication by default.
@@ -275,6 +283,7 @@ Keep in mind that when users run your public Actor, the Actor makes API calls un
275
283
:::
276
284
277
285
### How to migrate Actors to support **Restricted** general resource access
286
+
278
287
This section provides a practical guide and best practices to help you update your public Actors so they fully support **Restricted general resource access**.
279
288
280
289
---
@@ -285,13 +294,15 @@ All API requests from your Actor should use authenticated methods.
285
294
When using the [Apify SDK](https://docs.apify.com/sdk/js/) or [Apify Client](https://docs.apify.com/api/client/js/), this is done automatically.
286
295
287
296
If your Actor makes direct API calls, include the API token manually:
#### 2. Generate pre-signed URLs for external sharing
305
+
295
306
If your Actor outputs or shares links to storages (such as datasets or key-value store records), make sure to generate pre-signed URLs instead of hardcoding API URLs.
296
307
297
308
Pre-signed URLs allow secure, tokenless access for external users.
@@ -324,6 +335,7 @@ Unauthenticated users will be prompted to sign in, ensuring they have required p
324
335
:::
325
336
326
337
#### Test your Actor under restricted access
338
+
327
339
Before publishing or updating your Actor, it’s important to verify that it works correctly for users with **restricted general resource access**.
328
340
329
341
You can easily test this by switching your own account’s setting to **Restricted**, or by creating an organization under your account and enabling restricted access there. This approach ensures your tests accurately reflect how your public Actor will behave for end users.
0 commit comments