Sometimes you just need “here is the file” without minting a full account. Share links cover that case:
- Create a link from a drop with expiry and max downloads
- Public path is GET-only under
/hub/share/…and boring on purpose - Create flow uses PRG so the token is not left sitting in a referrer-friendly query string
- Rate limits on the public endpoints because the internet is not polite
Treat the link like a secret. Unlisted is not encrypted; anyone with a working URL can download until the cap or clock says otherwise.
Follow-up: share links without a memory for the secret — raw tokens are no longer kept in SQLite. The public shop window is Walks (/files redirects there); 0x0 is being retired, not a forever twin host.