I was here before looking for answers and just wanted to share what I found, now that I am working.
You can do it now, and it only hurts a little. Image crawl or blobstore API is not supported and does not seem to work anymore.
Cm:
If you sign your URLs, you can specify automatically expiring links to your content for anonymous or paid use. You would not want to serve your entire site in this way, but for PDF or something else, this is a valid and semi-secure option.
Missing documentation, you may have to discard a new line for canonical extended headers. The storage endpoint will tell you what it expects when the signature is bad.
In addition, your host must be: https://storage-download.googleapis.com/
If you use App Engine, then GoogleAccessId : <projectname> @ appspot.gserviceaccount.com
See: app_identity.get_service_account_name()
An example of how to generate a signature:
from google.appengine.api import app_identity def signFile(path, verb='GET', md5='', contentType='', expiration=''): signatureRequest = '{}\n{}\n{}\n{}\n{}'.format( verb, md5, contentType, expiration, path) return app_identity.sign_blob(signatureRequest)
Returns a tuple (privateKey, binarySignature) .
Now you need to create the url. The signature must be encoded in base64 and then encoded. The following describes how to complete the construction of the URL. You should probably use the download node mentioned above.
Example URL from documents:
https: //storage.googleapis.
com/example-bucket/cat.jpeg?GoogleAccessId=example@example-project.iam.gservicea
ccount.com & Expires = 1458238630 & Signature = VVUgfqviDCov% 2B% 2BKnmVOkwBR2olSbId51kSib
uQeiH8ucGFyOfAVbH5J% 2B5V0gDYIioO2dDGH9Fsj6YdwxWv65HE71VEOEsVPuS8CVb% 2BVeeIzmEe8z
7X7o1d% 2BcWbPEo4exILQbj3ROM3T2OrkNBU9sbHq0mLbDMhiiQZ3xCaiCQdsrMEdYVvAFggPuPq% 2FE
QyQZmyJK3ty% 2Bmr7kAFW16I9pD11jfBSD1XXjKTJzgd% 2FMGSde4Va4J1RtHoX7r5i7YR7Mvf% 2Fb17
zlAuGlzVUf% 2FzmhLPqtfKinVrcqdlmamMcmLoW8eLG% 2B1yYW% 2F7tlS2hvqSfCW8eMUUjiHiSWgZLE
VIG4Lw% 3D% 3D
Hope this helps someone!
Oh yes, you only need to make all the signatures if your bucket is not publicly available (readable).