## TL;DR

Always pass an explicit expiry when signing URLs for private content. Never generate signatures in the browser, your private key must stay on the server. If you leave ik-t off, the URL never expires, which the docs state plainly but people miss when they assume signed means short-lived.

## Fix

Always pass an explicit expiry when signing URLs for private content. Never generate signatures in the browser, your private key must stay on the server.

Context: ImageKit signed URLs carry the signature in ik-s and an optional expiry in ik-t. If you leave ik-t off, the URL never expires, which the docs state plainly but people miss when they assume signed means short-lived. An invalid signature or an expired timestamp returns 401 once you enable restrict unsigned URLs, and signing needs your private key so it has to happen server-side.

## Matched source
Source: Published skill
Original query: "An ImageKit signed URL without ik-t never expires"
Key terms: expires, imagekit, never, signed, without

## When to use this

- Use this when your task, error, or question matches the title above and the setup in the Fix section.

## When not to use this

- Skip it when the error text, tool, or situation is different. Forcing a mismatched fix usually costs more time than searching again.

## Compatibility

The original write-up does not pin tool versions. Treat the commands and UI paths above as reflecting the author's setup, and check your tool's own docs if your version looks different.