Use PD MinIO S3 to create an expiring PUT URL for a specific destination object. This lets a recipient upload that object without receiving the service’s secret.

Choose the destination deliberately

Open the service’s Share links section, select its bucket and enter the exact destination object key. Choose upload and an expiry, then generate the URL. Use a new key unless replacing an existing object is intentional.

An upload URL signs PUT, not a generic browser form POST. The recipient must use the signed method and compatible request headers. An existing key can be overwritten; historical recovery depends on the selected bucket’s actual versioning state.

Verify the upload result

1. Provide the complete URL privately to the intended recipient.
2. Have the application use PUT for the intended object content.
3. Check its response and confirm the resulting object through the appropriate storage tool.
4. Verify the expected content before treating a completed HTTP request as a successful backup.

The endpoint must be reachable by the recipient. Do not replace its hostname or object path after signing. Anyone holding a valid URL can use it while its credential and expiry remain valid; it is not automatically single-use.

Separate browser policy from authentication

A browser may refuse cross-origin access even when the same request works outside a browser. This module does not offer per-bucket CORS controls for MinIO. Ask the storage administrator to review the deployment’s browser-origin policy for the intended origin and method, rather than weakening authentication or enabling every origin broadly.

Rotation and access restrictions can invalidate a link early. Retain the original time and redacted error while your hosting team checks the failed operation; never include the signed URL or service secret in diagnostics.

Check the upload result

Your hosting team should compare the selected bucket/object, intended PUT operation and compatible request headers with the recipient’s actual response and resulting object. Distinguish endpoint reachability, signature/access refusal and browser-origin policy; this module does not expose MinIO per-bucket CORS controls. Have your storage administrator review the intended origin and method rather than opening all origins or weakening authentication.

See the PD MinIO S3 Blesta guide for related tasks, or explore the module.