Generate and sign Filestack policies server-side only, never in client code. Set the call scope to exactly the operations the URL performs, a read-scoped policy will not authorize a convert. Keep expiries short and mint fresh policies per session rather than reusing long-lived ones.

Context: Web (Filestack's Claude Code plugin reference): security policies are base64-encoded JSON with a required expiry Unix timestamp and a call scope like read, write, convert, or remove, signed with HMAC-SHA256 using the app secret. The signing happens locally and the secret never leaves the machine. Agents that generate policies client-side either leak the app secret into the bundle or ship policies whose call scope does not cover the operation, and both fail in confusing ways at request time.

## Matched source
Source: Published skill
Original query: "Filestack policies must be signed server-side with a scoped, expiring policy"
Key terms: expiring, filestack, must, policies, policy, scoped, server, side, signed