Skip to content
SveltyCMS

Documentation

Sharing Assets Securely

A guide for content creators on generating and managing public share links for media files.

5/23/2026
3 min read Edit on GitHub
On this page

Sharing media assets (images, videos, documents) with external users is a critical feature for SveltyCMS. This guide covers how to generate secure, tokenized links and what the recipient experience entails.

🎯 Goal

To make specific private files accessible to designated third parties while maintaining security through unique tokens and optional password protection.

📄 Prerequisites (The Admin Workflow)

Before generating a share link, you must:

  1. Ensure the media asset is correctly uploaded into SveltyCMS.
  2. Navigate to the media’s detailed management view.
  3. Activate the “Sharing” toggle and configure the necessary parameters (e.g., token lifetime, password protection).

🛠️ The Sharing Process (Step-by-step)

  1. Select Asset: Go to Media Library and select the file you wish to share.
  2. Open Share Settings: Click the ‘Share’ button on the asset details pane.
  3. Configure Link Parameters:
    • Token Generation: The system automatically generates a unique, cryptographically secure token (e.g., aBc1XyZ9). Save this link securely. This token is your access key.
    • Expiration: Set the desired expiration date/time for the link. After this time, the link will automatically fail and become inaccessible.
    • Password Protection (Optional): If the content must be restricted, enable password protection. The system will store a salted hash of your provided password in the asset’s metadata.

👤 The Recipient Experience (What happens next)

When a recipient clicks the generated link (https://sveltycms.com/share/[token]?id=[mediaId]), they will land on our dedicated, optimized share page:

  • Success: If the token is valid and active, the user sees the file details and an immediate download button.
  • Password Required: If password protection was enabled, the user must enter the correct password before the download link becomes active.
  • Failure Cases (Security Checks):
    • Expired Token: The system returns a 410 Gone status, informing the user that the link has expired.
    • Invalid Token/Missing ID: The system returns a 404 Not Found.
Warning

Do not manually share raw media URLs. Always use the generated tokenized link provided by SveltyCMS to ensure the asset is properly tracked, time-limited, and secured.

⚙️ Technical Mechanics (For Deep Understanding)

The sharing mechanism relies on a multi-layered validation process:

sequenceDiagram participant Client participant ServerLoad[Server Load Function] participant DB[Media Metadata Database] Client->>ServerLoad: Access URL? (Token, Media ID) ServerLoad->>DB: 1. Check Token & Existence (token, mediaId) alt Link Not Found or Expired DB-->>ServerLoad: Error (404/410) else Link Exists ServerLoad->>ServerLoad: 2. Check Expiry Date alt Password Required Client->>ServerLoad: Submit Password ServerLoad->>DB: 3. Validate Hash (password, salt) DB-->>ServerLoad: Success/Fail Status opt Successful Validation ServerLoad->>Client: File Data & Download Link (200 OK) else Failure ServerLoad-->Client: Error (401 Unauthorized) end else No Password Required ServerLoad->>Client: File Data & Download Link (200 OK) end end

This single endpoint performs three checks sequentially, which must all pass for access: …


---

## Related

- [Getting Started](/docs/getting-started)
- [Architecture Overview](/docs/reference/architecture/index)
- [Security Overview](/docs/reference/security/index)
guidemediasharing
Was this page helpful?