Deliver Large Agent Artifacts With Signed URLs, Not Giant JSON Responses

Short summary

Returning large agent artifacts inside task JSON creates slow APIs and expensive retries. The article proposes separating metadata from bytes: task endpoints return artifact metadata, a separate endpoint issues short-lived signed URL grants after authorization, and storage delivers the bytes directly. It covers grant lifecycle, SHA-256 integrity checks, client download state machines, and a security test plan.

• •Keep task API responses small by returning artifact metadata only, with a separate endpoint for signed download grants
• •Authorize through task and tenant ownership before signing server-owned object keys; never let clients submit arbitrary keys
• •Test cross-tenant denial, signature invalidation on path change, grant expiry, and digest verification

Generated with AI, which can make mistakes.