Create expiring R2 download or upload links in WHMCS
PD Cloudflare R2’s Share links section creates a URL for one object and operation. It lets a recipient use that link without receiving the service’s S3 secret.
Generate the link
- Open the intended service’s Share links section.
- Select the service bucket and enter the exact object key, including any folder-like prefix.
- Choose the offered download or upload operation and an expiry.
- Generate the URL and copy it privately.
- Verify it with the intended client and operation before distributing it.
A download uses GET for an existing object. An upload uses PUT for its specified object key; it is not a browser HTML-form POST upload. Uploading to a key that already exists can overwrite it, and R2 does not provide S3 object versioning to recover that overwrite through this module.
Treat the complete URL as access
Anyone holding a valid link can perform its signed operation until it expires or its credential becomes invalid. It is not automatically single-use. Use a short useful lifetime and avoid putting the URL in analytics, public pages or support tickets.
Do not rewrite the signed S3 hostname to a custom domain. Signing covers the request details. Changing the method, object key or relevant headers can invalidate the signature; follow the recipient application’s required request format.
Diagnose browser failures separately
A browser upload may need an appropriate bucket CORS rule even when the same signed URL works outside a browser. Use the CORS guide and Cloudflare’s presigned URL reference to separate browser-origin policy from authentication.
Rotation, suspension or termination can invalidate access before the link’s displayed expiry. Inspect current service state rather than repeatedly extending a refused link.
See the PD Cloudflare R2 WHMCS guide for related tasks, or explore the module.
