Generating Signed URLs with gsutil

This page describes how to use gsutil to easily generate signed URLs. Signed URLs give time-limited read or write access to a specific Cloud Storage resource. Anyone in possession of the signed URL can use it while it's active, regardless of whether they have a Google account. To learn more about signed URLs, see the Overview of Signed URLs. To learn how to create signed URLs on your own, see Generating Signed URLs with Your Own Program.

To create a signed URL:

gsutil

Note: Creating signed URLs with gsutil requires the pyopenssl library. Use pip install pyopenssl or easy_install pyopenssl to get the library.

1. Generate a new private key, or use an existing private key for a service account. The key can be in either JSON or PKCS12 format.

   For more information on private keys and service accounts, see Service Accounts.

2. Use the gsutil signurl command, passing in the path to the private key from the previous step and the name of the bucket or object you want to generate a signed URL for.

   For example, using a key stored in the folder Desktop, the following command generates a signed URL for users to view the object cat.jpeg for 10 minutes.

   gsutil signurl -d 10m Desktop/private-key.json gs://example-bucket/cat.jpeg

If successful, your response should look like:

URL    HTTP Method    Expiration    Signed URL
gs://example-bucket/cat.jpeg GET 2018-10-26 15:19:52 https://storage.googleapis.
com/example-bucket/cat.jpeg?x-goog-signature=2d2a6f5055eb004b8690b9479883292ae74
50cdc15f17d7f99bc49b916f9e7429106ed7e5858ae6b4ab0bbbdb1a8ccc364dad3a0da2caebd308
87a70c5b2569d089ceb8afbde3eed4dff5086f0db5483998c175980991fe899fbd2cd8cb813b0016
5e8d56e0a8aa7b3d7a12ee1baa8400611040f05b50a1a8eab5ba223fe1375747748de950ec7a4dc5
0f8382a6ffd4994ac42498d7daa703d9a414d4475154d0e7edaa92d4f2507d92c1f7e8efa7cab64d
f68b5df48575b9259d8d0bdb5dc752bdf07bd162d98ff2924f2e4a26fa6b3cede73ad5333c47d146
a21c2ab2d97115986a12c68ff37346d6c2ca83e56b8ec8ad95632710b489b75c35697d781c38e&
x-goog-algorithm=GOOG4-RSA-SHA256&x-goog-credential=example%40example-project.
iam.gserviceaccount.com%2F20181026%2Fus%2Fstorage%2Fgoog4_request&x-goog-date=
20181026T211942Z&x-goog-expires=3600&x-goog-signedheaders=host

The signed URL is the string beginning with https://storage.googleapis.com and will likely extend for several lines. This URL can be used by any person to access the associated resource (in this case cat.jpeg) for the designated time frame (in this case, 10 minutes).