- 30 Nov 2022
- 6 Minutes to read
Changes to Airtable attachments
- Updated on 30 Nov 2022
- 6 Minutes to read
On November 8, 2022, Airtable will improve the security of our attachment URLs by incorporating an expiring links functionality across our product surface areas. That means when you share attachments stored in Airtable via URL with external colleagues the link you provide them will expire after a couple of hours. Read on to learn more about how to prepare for the upcoming changes.
This change does not affect the following:
- Form URLs
- URL fields
- Google Drive, Box, or other 3rd party attachment storage services
- URLs in text-based fields
Currently, Airtable attachments include a static URL where the attachment can be publicly accessed via a web browser. These links never expire and could be accessed by anyone who obtains the attachment’s link. This presents a potential security risk for any files that contain sensitive information. For that reason, we are introducing expiring public-accessible attachment links. This improvement will result in the following changes:
- Any attachment URLs obtained via the Airtable Web API and the CSV export functionality will expire after a few hours.
- URLs obtained from copying an attachment cell value (CMD C) will open the file to the attachment viewer within the product, instead of directly opening the file.
- The links obtained by referring to an attachment field in Formulas will not change (for backward compatibility considerations), and will therefore become invalid roughly around February 8th, 2023. The filename obtained in the same way will continue to work as expected.
Most customers should only experience the benefits of the enhanced security related to this change. However, certain customer workflows in Airtable may be impacted:
- The use of Airtable to host files on the internet.
- We have and will continue to discourage the use of Airtable for this purpose.
- Any workflows where a file held within Airtable will need to be shared for a prolonged amount of time with an external colleague. We recommend that you share a view with the colleague and ask them to download the file themselves, should they need it for future reference.
- Airtable formulas - Formulas that reference attachment fields will not experience any changes in output. However, any attachment links that are output will become invalid and no longer work to access the attachment.
- CSV exports - You’ll need to download any attachment files from the links in the exported CSV file before those links expire.
- API - Similar to CSV downloads, attachment links obtained via Airtable’s API will expire after a given amount of time.
For workflows that are dependent on the format of the attachment URL or identifiers within it (eg: filename), after the changes to attachments go live in November, there will be nothing in the attachment URL that can be interpreted in a meaningful way. To reiterate, the attachment URL formatting is not part of our compatibility surface, so users should not attempt to parse or interpret attachment field URLs.
When sharing a file with colleagues who have access to the base where the attachment is being stored we recommend that you open the attachment preview window (click into the attachment field and press the spacebar) and copy the URL in your browser like so:
This URL is static and will not expire unless the attachment is removed or the record is deleted. A reminder that links will only be accessible to users who have been added as collaborators in the workspace or base where the attachment is located.
If you are sharing a file with a colleague who is not collaborating with you in Airtable, then you will need to consider alternative ways of sharing the file attachment in question. Typically, the best practice would be to navigate to the attachment in Airtable, download the file, and then share it with the colleague in an email, via Slack, or some other surface that your organization uses. Alternatively, you can share a view with the colleague and ask them to download the file themselves, should they need it for future reference.
Changes to the way Automations interact with the Attachment field
This update includes changes to the way Airtable Automations handles the URL property for attachment records in the following ways:
- The URL property will now change to attachment viewer URLs. This new property still allows users to view the attachment, but will require that they are signed into Airtable in order to view it.
- We are introducing a new expiring download URL property for use cases that want to offer downloadable public links that will expire after some time.
- We cover some deeper considerations related to image use in the Send email action in this article.
Temporary opt out instructions
In order to avoid surprising users who have missed our communications before launching this change, which could break certain workflows as described above, we provide the option to temporarily opt out so that you have the time to make changes in Airtable before that opt out period ends. Opting out will only be available until the end of the 3 month period following the initial November 2022 launch of this change. This means that the opt out period will end roughly around February 8th, 2023.
A few notes:
- Only workspace owners or enterprise admins will be able to opt out
- Self-serve and Enterprise plan workspace owners can opt out individual workspaces from the workspace settings page.
- Additionally, Enterprise admins will be able to opt out all workspaces connected to their Enterprise instance by toggling the option on from the admin panel. To opt out follow these steps:
- Navigate to the Admin Panel
- Click the Settings page on the left
- Scroll down to the Access section of the Sharing & Access tab
- Toggle the option to Temporarily opt out of expiring attachment URLs
What is an attachment URL?
Every file uploaded to Airtable in an attachment field has a set of properties, including a unique ID, a URL directly to the file, a file name, and other data related to the file itself (size, type, etc.). The URL to those files is what will expire every few hours.
What happens if this change breaks my workflow?
We will offer a temporary opt out period so that you or your organization has additional time to plan for the change. Details on this opt out process will be shared closer to the November rollout.
What happens if an expired link is accessed?
Expired links will result in an error code indicating that the URL is no longer valid or has expired.
What kind of links will be impacted? If I have a link to a Box or a Google Drive folder, will it be affected?
Only links to attachments stored in Airtable will be affected. Links added to single line, long text, and URL fields are unaffected by this change.
Is there a way to know if I or my company/organization may be impacted by this change?
Check the bullet points in the What's changing section above.
Can I opt into these changes sooner?
Unfortunately, we do not have the ability to make these changes sooner.
Is it possible to make this change optional for some or all attachment URLs?
No. This change is part of a holistic step toward a more secure attachment field experience.
How many hours will the URLs remain active before expiring?
URLs will not expire for at least 2 hours after they are received.
I use APIs to obtain an URL to an Airtable attachment, and this usage is integrated with other tools, e.g. Zapier. It seems the URLs will expire. What should I do?
If you or a third party integration are using API processes to obtain attachment URLs from Airtable, then it’s important to note that the URLs obtained will only be active for a short period of time (~2 hours). Using Airtable as a CDN has been and continues to be discouraged in line with this change.