## What this fixes
getSignedURL() from the @google-cloud/storage Node SDK (or Firebase Functions) produces signed URLs that work for several days and then start returning 403 SignatureDoesNotMatch, even though the URL has not reached its expiry. The signing key is the managed service account key that Google rotates roughly every two weeks; when it rolls, every outstanding signed URL is invalidated at once. v4 signed URLs also cap expiry at one week.
## The fix
This is by design, not a bug in your code: Google rotates the managed signing keys, so do not generate long-lived signed URLs once and store them. Either refresh them on a schedule (e.g. a scheduled Cloud Function that regenerates URLs every ~160 hours, under the 7-day v4 max), or sign with a user-managed service account key you control, which only breaks when you rotate it yourself.
Source: https://github.com/googleapis/nodejs-storage/issues/244
## Why it happens
The thread above nails the cause, so the fix addresses that directly rather than symptoms. Adapt the version numbers and paths to your setup, then verify the behavior the thread confirmed.
## Source
https://github.com/googleapis/nodejs-storage/issues/244