Create a presigned GET link for one intended object key through PD AWS S3. The recipient does not need your storage key, but possession of the link grants its intended download operation while the signature and underlying permissions remain valid.

Generate the intended link

1. Open the active service’s Share links page.
2. Select the exact bucket and object path.
3. Choose GET for the intended download operation.
4. Choose the shortest offered expiry that serves the task.
5. Generate the link and test the exact operation with non-sensitive data first.

The object must exist at that exact key. A download link does not list the whole bucket or create a missing file.

Keep the link private

A presigned link is not necessarily a one-use link. Share it only with intended recipients and keep it out of public pages, analytics notes and support screenshots. Do not publish the full signed URL in a ticket.

The link is signed using the service’s customer credential, not the host’s provisioning key. Rotation, revocation or changed permissions can stop it before its displayed expiry. AWS explains these limits in its presigned URL guide.

Diagnose an access refusal

Compare the method, exact object key, current service access mode and expiry. For browser requests, check CORS separately. An upload pause or revoked credential cannot be corrected by making the link last longer.

If unresolved, retain the action time and redacted error without the credential-bearing URL.

See the PD AWS S3 WHMCS guide for related tasks, or explore the module.