Generate token-gated public upload links so customers can drop files into a deal or project without an account.
6 min read
What you will learn
A File Drop link is a token-gated public URL that lets a customer upload files directly into a specific deal or project, with no OneBob account required. Files go straight into your S3 storage with Cloudflare Turnstile spam protection, and they appear on the right deal or project the moment they land. Optional expiration dates and a full audit trail keep things tidy.
Generate a per-deal or per-project upload link
Share the link via email: the token IS the auth
Customers upload directly to S3 via presigned POST
Files appear on the deal or project automatically with full audit log
⏱ Reading time: 6 minutes
Before you begin
File storage configured (S3 or compatible)
A deal or project to receive files
Recommended: Cloudflare Turnstile keys configured for spam protection
1
Generate a file drop link
Each deal and project can have its own file drop links.
1Open a deal or project
2Files tab → "New file drop link"
3Optional: set an expiration date (link stops working after this date)
4Optional: add a description (shown to the customer on the upload page)
2
Share the link
The generated URL is the only credential the customer needs.
1Copy the public URL: /drop/{token}
2Send it via email, SMS, or include it in your engagement letter
3No OneBob account required for the customer: the token is the auth
3
Customer uploads
Your customer sees a clean upload page with your description and a drop zone.
1Customer opens the link, sees a branded upload page
2Solves the Turnstile captcha (if enabled), which fails closed on network errors
3Drops files; uploads go directly to S3 via presigned POST
4File size and type are validated client- and server-side
4
Files appear in OneBob
No manual import: uploaded files show up immediately on the right entity.
1Uploaded files appear on the deal or project Files tab automatically
2Each upload includes IP address and timestamp metadata
3The audit log captures every public upload event
4Storage usage counts against your tenant's storage quota
5
Manage links
You can see, revoke, and audit every drop link from the Files tab.
1View all active drop links: filter by deal/project, expiration, last-used date
2Revoke a link by deleting it: the token immediately stops working
3See last-used date so you know when the customer engaged
Tips & best practices
Set short expirations (3-7 days) on links sent for one-off uploads
Use the description field to tell customers exactly what to upload and avoid back-and-forth
Keep Turnstile enabled: captcha-free public upload endpoints get abused
Storage limits apply: each upload counts against your tenant's storage quota
For recurring file collection, generate fresh links rather than reusing old ones
Need help?
If uploads fail with a captcha error, check that your Turnstile site key and secret key are configured under Settings → Security. Failed uploads do not consume storage.
Essential cookies and privacy-friendly traffic analytics (Cloudflare) run by default. With your consent, we additionally use Microsoft Clarity to record anonymised sessions on this page so we can improve it. Clarity is never used inside the signed-in CRM app.
Learn more in our Privacy Policy.
