Vercel CLI Now Supports Blob URL Signing

You can now directly generate signed URLs for Vercel Blob through the Vercel CLI. A signed URL is a security feature that allows only a single action (get, head, put, delete) on a specific object, with a validity period that can be set for up to 7 days.

Using the new vercel blob presign command, you can control the following:

• Single action restriction: Grant read-only or upload-only permissions for a specific file
• Setting constraints: Restrict a file's content-type and maximum size (maximum-size-in-bytes)
• Validity period control: Set a relative time (e.g., 15m, 1h) via --valid-for or an absolute timestamp via --valid-until

Additionally, the vercel blob signed-token command allows you to separate signed token generation from URL generation. This enables even more granular security management, such as granting an agent write-only permission to a specific path. To use this feature, you need to update the Vercel CLI to version 5.14.5 or higher.