A share URL bundles everything needed to find and decrypt a file — except payment. Here's the breakdown:
sia://sia.storage/objects/4d2f65ee…f7fdf4491/shared?sv=4102444799&sc=-z24Qpm9OL6p8TYDZvXBS6_3FZ3hx2Q2wD6hyWRny74=&ss=XWeYi6Zd8g8Udtz4A6qTqXyo-M_N7B7EzGTIddswpeGhwBVsRgn98X5scSVxca8Pv3I--iY6sbI4INGEqMygDQ==#encryption_key=_uPsqCD2ceAYqAp8X-83SCsiVA38eFlpCrrfl32NCiw=
- sia://
- Scheme — like
https:// but for the Sia network. The SDK converts it to https:// before fetching.
- sia.storage
- Indexer host — the server that knows which hosts hold your file's shards.
- /objects/<id>/shared
- Path — the object ID (hash of its slabs) + the
/shared endpoint that returns slab metadata.
- ?sv=…
- validUntil — Unix timestamp. The URL stops working after this time. No max enforced — can be set far future.
- &sc=…
- credential — the uploader's public key (base64url). Identifies who signed the URL.
- &ss=…
- signature — ed25519 signature over
method ‖ host ‖ path ‖ validUntil. The indexer verifies this before serving metadata.
- #encryption_key=…
- Fragment — the 32-byte data encryption key (base64url). Lives in the URL fragment, so it's never sent to the indexer — only the browser sees it. Without it, the downloaded data is unreadable.
What's missing? Payment. The URL grants access to metadata + the encryption key, but host reads require an app key (OAuth) to mint payment tokens. That's why the downloader needs to register a sharing identity.