# Treat Sharing Links as Bearer Capabilities > Design sharing URLs as revocable, scoped credentials with explicit expiry, audience, and leakage controls. Canonical URL: https://www.devobs.io/articles/sharing-links-as-capabilities/ By: Elias Brooks Published: 2025-04-27T02:16:48.722Z Updated: 2026-09-06T10:18:15.722Z Section: Authorization ## Model anonymous links as bearer capabilities An anonymous sharing link is a bearer capability: possession grants its authority. Store a hash of a random token with resource, action, expiry, creator, and status; do not treat unguessability as protection from forwarding. [RFC 6750 Bearer Token Usage](https://www.rfc-editor.org/rfc/rfc6750.html) supplies the primary specification or operating model for this decision. ## Separate preview and download authority A preview link may allow read-only rendering for seven days while a download grant is separate. Remove tokens from history after redemption and prevent analytics, logs, referrers, support tools, and third-party page resources from receiving them. [Google Drive sharing guide](https://developers.google.com/drive/api/guides/manage-sharing) provides the complementary protocol or operational detail. ## Minimize the capability Generate enough random token material, store only a hash, and bind the record to resource, allowed action, creator, expiry, and status. Separate preview from download if those actions have different risk. A token in the URL can leak through history, logs, referrers, analytics, screenshots, and forwarded messages, so keep third-party resources off the redemption page and remove the token from the address after exchange. Recipient-bound links should require the intended identity in addition to possession. Anonymous links should be presented honestly as transferable bearer authority. ## Make visits safe and revocation observable Email scanners and preview bots may follow GET links. A GET can render a non-sensitive confirmation, while a deliberate POST or subsequent authenticated action performs mutation. Use one-time consumption only when the user experience can tolerate scanner and retry behavior. Owners need a list of active links with scope, creation, expiry, and last use, plus immediate revocation and rotation. Test a forwarded link, expired link, concurrent redemption, revoked link behind a cache, and a page with an external analytics request. Start by tracing one current sharing URL through browser, CDN, logs, and support tooling; remove every location that records its raw token. ## Source references - -