---
title: "Give every share link a random token and · Agent Wranglers"
url: https://agentwranglers.se/playbook/files-and-media/serving-files/share-links
id: MED-38
level: Required
risk: data
updated: 2026-10-22
build: a2a6bdfed830
tokens: 981
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Give every share link a random token and an expiry

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Serving files](https://agentwranglers.se/playbook/files-and-media/serving-files.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: MED-38
- Level: Required
- Chapter: [Serving files](https://agentwranglers.se/playbook/files-and-media/serving-files.md)
- Rule: A link that opens a file without signing in holds a random token of at least 128 bits, an expiry and an owner. The owner can see and revoke each link, and a revoked or expired link answers 410.
- Check: Create a link and open it signed out. It works, and the response carries both headers. Revoke it, and the next request answers 410. A link past its expiry answers 410. The stored row holds a hash, not the token.
- Risk: Data leaked or lost
- How: People forward share links, paste them into chats and leave them in old emails. So treat each link as a password for one file. Make the token with the system's secure random source, and store only its hash, as [Store API keys as hashes](https://agentwranglers.se/playbook/api-design/api-security/api-keys.md) does for keys. Give each recipient a separate link, so one can be revoked alone. Show the file's live links on its page, with the last time each was opened. Send `Referrer-Policy: no-referrer` and `X-Robots-Tag: noindex` on the share page. Each download still goes through [short-lived links](https://agentwranglers.se/playbook/files-and-media/serving-files/signed-downloads.md). Deleting the file ends its links and purges its copies, as [Purge cached copies when a file is deleted or removed](https://agentwranglers.se/playbook/files-and-media/serving-files/cdn-purge-on-delete.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
import { createHash, randomBytes } from 'node:crypto'

const TOKEN_BYTES = 16
const token = randomBytes(TOKEN_BYTES).toString('base64url')
const tokenHash = createHash('sha256').update(token).digest('hex')
```

### Python example

```python
import hashlib
import secrets

TOKEN_BYTES = 16
token = secrets.token_urlsafe(TOKEN_BYTES)
token_hash = hashlib.sha256(token.encode()).hexdigest()
```

## Sources

- [W3C Good Practices for Capability URLs](https://www.w3.org/TR/capability-urls/)
- [Google robots meta tag and X-Robots-Tag](https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag)

## Related rules

- API-42 [Store API keys as hashes](https://agentwranglers.se/playbook/api-design/api-security/api-keys.md) in API design
- MED-46 [Serve private files through short-lived links](https://agentwranglers.se/playbook/files-and-media/serving-files/signed-downloads.md) in Files and media
- MED-21 [Purge cached copies when a file is deleted or removed](https://agentwranglers.se/playbook/files-and-media/serving-files/cdn-purge-on-delete.md) in Files and media

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/files-and-media/serving-files/share-links">Agent Wranglers files and media playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Let large downloads resume with range requests](https://agentwranglers.se/playbook/files-and-media/serving-files/range-downloads.md)
- Next: [Stop other sites from serving your files](https://agentwranglers.se/playbook/files-and-media/serving-files/hotlink-protection.md)
- [Serving files](https://agentwranglers.se/playbook/files-and-media/serving-files.md)