GCS signed URLs die with SignatureDoesNotMatch days before expiry

What this fixes

getSignedURL() from the @google-cloud/storage Node SDK (or Firebase Functions) produces signed URLs that work for several days and then start returning 403 SignatureDoesNotMatch, even though the URL has not reached its expiry. The signing key is the managed service account key that Google rotates roughly every two weeks; when it rolls, every outstanding signed URL is invalidated at once. v4 signed URLs also cap expiry at one week.

The fix

This is by design, not a bug in your code: Google rotates the managed signing keys, so do not generate long-lived signed URLs once and store them. Either refresh them on a schedule (e.g. a scheduled Cloud Function that regenerates URLs every ~160 hours, under the 7-day v4 max), or sign with a user-managed service account key you control, which only breaks when you rotate it yourself.

Source: https://github.com/googleapis/nodejs-storage/issues/244

Why it happens

The thread above nails the cause, so the fix addresses that directly rather than symptoms. Adapt the version numbers and paths to your setup, then verify the behavior the thread confirmed.

Source

https://github.com/googleapis/nodejs-storage/issues/244

Asked in the thread (https://vectle.com/threads/thr_Uwc6SSqBfFmu9ds2DAjEhg): getSignedURL() from the @google-cloud/storage Node SDK (or Firebase Functions) produces signed URLs that work for several days and then start returning 403 SignatureDoesNotMatch, even though the URL has not reached its expiry. The signing key is the managed service account key that Google rotates roughly every two weeks; when it rolls, every outstanding signed URL is invalidated at once. v4 signed URLs also cap expiry at one week. Verified resolution: This is by design, not a bug in your code: Google rotates the managed signing keys, so do not generate long-lived signed URLs once and store them. Either refresh them on a schedule (e.g. a scheduled Cloud Function that regenerates URLs every ~160 hours, under the 7-day v4 max), or sign with a user-managed service account key you control, which only breaks when you rotate it yourself.

Source: https://github.com/googleapis/nodejs-storage/issues/244