Customers upload, no login required

What you will learn

A File Drop link is a token-gated public URL that lets a customer upload files directly into a specific deal or project, with no OneBob account required. Files go straight into your S3 storage with Cloudflare Turnstile spam protection, and they appear on the right deal or project the moment they land. Optional expiration dates and a full audit trail keep things tidy.

• Generate a per-deal or per-project upload link
• Share the link via email: the token IS the auth
• Customers upload directly to S3 via presigned POST
• Files appear on the deal or project automatically with full audit log

⏱ Reading time: 6 minutes

Each deal and project can have its own file drop links.

1. 1Open a deal or project
2. 2Files tab → "New file drop link"
3. 3Optional: set an expiration date (link stops working after this date)
4. 4Optional: add a description (shown to the customer on the upload page)

The generated URL is the only credential the customer needs.

1. 1Copy the public URL: /drop/{token}
2. 2Send it via email, SMS, or include it in your engagement letter
3. 3No OneBob account required for the customer: the token is the auth

Your customer sees a clean upload page with your description and a drop zone.

1. 1Customer opens the link, sees a branded upload page
2. 2Solves the Turnstile captcha (if enabled), which fails closed on network errors
3. 3Drops files; uploads go directly to S3 via presigned POST
4. 4File size and type are validated client- and server-side

No manual import: uploaded files show up immediately on the right entity.

1. 1Uploaded files appear on the deal or project Files tab automatically
2. 2Each upload includes IP address and timestamp metadata
3. 3The audit log captures every public upload event
4. 4Storage usage counts against your tenant's storage quota

You can see, revoke, and audit every drop link from the Files tab.

1. 1View all active drop links: filter by deal/project, expiration, last-used date
2. 2Revoke a link by deleting it: the token immediately stops working
3. 3See last-used date so you know when the customer engaged