You can now generate time-bound signed URLs for Vercel Blob . A signed URL is a scoped URL with an expiry that allows you to upload, download, inspect, or delete a specific object without giving access to your entire Blob store.

Each URL is scoped to a single operation ( put , get , head , or delete ), a single pathname, and an expiry you choose, up to 7 days. The signature covers the operation and constraints, so a URL signed for a GET can't be reused as a PUT .

import { issueSignedToken , presignUrl } from '@vercel/blob' ;

const token = await issueSignedToken ( {

operations : [ 'get' ] ,

} ) ;

const { presignedUrl } = await presignUrl ( token , {

pathname : 'invoices/2026-q1.pdf' ,

operation : 'get' ,

validUntil : Date .…