# Private file - external API access - driving me crazy! **URL:** \ **Category:** Need help\ **Created:** [November 1, 2024, 12:49pm UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557 "2024-11-01T12:49:12Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![c.bakermans](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@c.bakermans](https://forum.bubble.io/u/c.bakermans)\ **Post date:** [November 1, 2024, 12:49pm UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/1 "2024-11-01T12:49:12Z")
Hi all, How do I secure files (through the privacy settings) while providing user actions based access to third party services? I have spent countless hours on figuring this out (trying various AWS upload tools and Wasabi) but it simply seems not fixable…? **What do I need to accomplish** My app uses files. The access to these files should be limited to specific users (which can be managed by uploading ‘private files’ (i.e. setting privacy rules) binding the file to a specific data type and establishing privacy rules to this data type that allow users matching the relevant criteria to view the files). So far so good. The problem however is that these files have to interact with trusted external services as well (e.g. openAI vector stores, DeepL). Bubble does not seem to offer a solution for this, or at least I have no been able to figure it out. **Plugins** There are several plugins I have used so far that either interact wit AWS S3 or Wasabi S3. The settings like Access Control Lists (ACL) and CORS (cross origin access) combined with the API are great for shielding the files from users with unauthorized access. The Pre-signed URLs are a great way of getting these files out again [I cannot mention too often that adding this simple feature to bubble’s core functionality would already solve a lot!]. The issues that is not resolved with this, is that users with access to the application could technically access all files, as the access cannot be restricted to a specific user (no privacy rules associated with any of the plugin uploaders) creating major vulnerabilities. Not sure what to do anymore… ---
**Author:** ![tylerboodman](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/tylerboodman/32/242142_2.png) [@tylerboodman](https://forum.bubble.io/u/tylerboodman)\ **Post date:** [November 1, 2024, 12:57pm UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/2 "2024-11-01T12:57:18Z")
There used to be a plugin published for this… [How to Generate Presigned URLs - #5 by DjackLowCode](https://forum.bubble.io/t/how-to-generate-presigned-urls/321661/5) @DjackLowCode were you aware it got delisted? ---
**Author:** ![Jici](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/jici/32/30722_2.png) [@Jici](https://forum.bubble.io/u/Jici)\ **Post date:** [November 1, 2024, 1:32pm UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/3 "2024-11-01T13:32:10Z")
So if you don’t want to use the api\_key in the url and instead got the presigned url, i should be possible with a plugin (that can be used in backend WF) that will call the file url with the api\_key but avoid to follow redirect and use the location header to get the presigned url. ---
**Author:** ![c.bakermans](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@c.bakermans](https://forum.bubble.io/u/c.bakermans)\ **Post date:** [November 1, 2024, 1:41pm UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/4 "2024-11-01T13:41:08Z")
sorry responded to quickly. I noticed the api key solution, which indeed is not sufficiently secure. What type of plugin generates pre-signed urls on the existing private files? ---
**Author:** ![Jici](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/jici/32/30722_2.png) [@Jici](https://forum.bubble.io/u/Jici)\ **Post date:** [November 1, 2024, 2:12pm UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/5 "2024-11-01T14:12:08Z")
I don’t know if there’s one that exist and I don’t know if the suggested one by @tylerboodman was doing this. Seem is not available on the marketplace anymore so I cannot inspect code (if this was free) ---
**Author:** ![tylerboodman](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/tylerboodman/32/242142_2.png) [@tylerboodman](https://forum.bubble.io/u/tylerboodman)\ **Post date:** [November 1, 2024, 2:23pm UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/6 "2024-11-01T14:23:24Z")
> **[Bubble - Plugin Editor](https://bubble.io/plugin_editor?id=1700959315598x627729431336058900&tab=tabs-5)** > > Start building plugins for Bubble! You can now extend the platform with API, actions and elements ---
**Author:** ![Jici](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/jici/32/30722_2.png) [@Jici](https://forum.bubble.io/u/Jici)\ **Post date:** [November 1, 2024, 2:30pm UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/7 "2024-11-01T14:30:11Z")
Yes, it look like it was made for that ---
**Author:** ![DjackLowCode](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/djacklowcode/32/222536_2.png) [@DjackLowCode](https://forum.bubble.io/u/DjackLowCode)\ **Post date:** [November 2, 2024, 2:10am UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/8 "2024-11-02T02:10:54Z")
Thanks @tylerboodman! I’ll try to get this one back up! ---
**Author:** ![DjackLowCode](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/djacklowcode/32/222536_2.png) [@DjackLowCode](https://forum.bubble.io/u/DjackLowCode)\ **Post date:** [November 4, 2024, 5:27am UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/9 "2024-11-04T05:27:12Z")
Hey @c.bakermans, this plugin is back up [here](https://bubble.io/plugin/file-sharer-1700959315598x627729431336058900) Agree it would be a useful thing for Bubble to implement themselves (and probably low hanging fruit). Let me know if you have any questions! Thanks @tylerboodman for the reminder. ---
**Author:** ![georgecollier](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/georgecollier/32/182327_2.png) [@georgecollier](https://forum.bubble.io/u/georgecollier)\ **Post date:** [November 4, 2024, 9:08am UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/10 "2024-11-04T09:08:53Z")
You can also do it natively by appending an admin API token to the file URL. Whether you want to do that depends on what service you’re calling (and if you trust them) ---
**Author:** ![c.bakermans](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@c.bakermans](https://forum.bubble.io/u/c.bakermans)\ **Post date:** [November 4, 2024, 11:06am UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/11 "2024-11-04T11:06:49Z")
Thanks a million! 1. When testing this it seems that the function is sending a random .txt file into the service (openAI) and not the file I uploaded as a private file. 2. what is the API key for that I have to add in the plugin section? ---
**Author:** ![c.bakermans](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@c.bakermans](https://forum.bubble.io/u/c.bakermans)\ **Post date:** [November 4, 2024, 11:19am UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/12 "2024-11-04T11:19:31Z")
sorry i read the documentation. It works. Awesome!! Only thing that gets lost is the filename (which seems to be inherent to the way services records filenames based on pre-signed urls) Is it also possible to manage (1.) the time of the pre-signed url or (2.) the number of times the link can be accessed? ---
**Author:** ![DjackLowCode](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/djacklowcode/32/222536_2.png) [@DjackLowCode](https://forum.bubble.io/u/DjackLowCode)\ **Post date:** [November 4, 2024, 5:22pm UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/13 "2024-11-04T17:22:13Z")
Hey @c.bakermans - glad that it’s working for you 🙂 For your questions: 1. No the time cannot be changed unfortunately. I think the default is 5 mins but could also be longer when it’s on the CDN. This is arbitrary given the length of the URL ( I.e it won’t be randomly scraped) 2. unfortunately it’s just a presigned url so we can’t set access if it’s been clicked. Good luck! ---
**Author:** ![system](https://us1.discourse-cdn.com/bubble/original/3X/2/8/2847faa74692c2ffa5d939d3dc3724cdd060d247.png) [@system](https://forum.bubble.io/u/system)\ **Post date:** [January 10, 2025, 12:50pm UTC](https://forum.bubble.io/t/private-file-external-api-access-driving-me-crazy/346557/14 "2025-01-10T12:50:00Z")
This topic was automatically closed after 70 days. New replies are no longer allowed.