Sometimes you just need “here is the file” without minting a full account. Share links cover that:
- Create a link from a drop with expiry and max downloads
- Public path is GET-only under
/hub/share/… - Create flow uses PRG so the token isn’t left sitting in a referrer-friendly query string
- Rate limits on the public endpoints, because the internet is not polite
Treat the link like a secret. Unlisted is not encrypted; anyone with a working URL can download until the cap or clock says otherwise.
Follow-up: share links without a memory for the secret — I no longer keep raw tokens in SQLite. The public shop window is Walks; 0x0 is being retired.