In an effort to increase attachment security, on November 8th, 2022 Airtable will be incorporating expiring links functionality. That means when you share attachments stored in Airtable via URL with external colleagues the link you provide them will expire after a couple of hours. Read on to learn more about how to prepare for the upcoming changes.
This change does not affect the following:
- Form URLs
- URL fields
- Google Drive, Box, or other 3rd party attachment storage services
- URLs in text-based fields
IN THIS ARTICLEWhat's changing
Changes to the way Automations interact with the Attachment field
Currently, Airtable attachments include a static URL where the attachment can be publicly accessed via a web browser. These links never expire and could be accessed by anyone who obtains the attachment’s link. This presents a potential security risk for any files that contain sensitive information. For that reason, we are introducing expiring public-accessible attachment links. This improvement will result in the following changes:
- Any attachment URLs obtained via the public API and the CSV export functionality will expire after a few hours.
- URLs obtained from copying an attachment cell value (CMD C) will open the file to the attachment viewer within the product, instead of directly opening the file.
- The links obtained by referring to an attachment field in Formulas will not change (for backward compatibility considerations), and will therefore become invalid. The filename obtained in the same way will continue to work as expected.
Most customers should only experience the benefits of the enhanced security related to this change. However, certain customer workflows in Airtable may be impacted:
- The use of Airtable to host files on the internet.
- We have and will continue to discourage the use of Airtable for this purpose.
- Any workflows where a file held within Airtable will need to be shared for a prolonged amount of time with an external colleague. We recommend that you share a view with the colleague and ask them to download the file themselves, should they need it for future reference.
- Airtable formulas - Formulas that reference attachment fields will not experience any changes in output. However, any attachment links that are output will become invalid and no longer work to access the attachment.
- CSV exports - You’ll need to download any attachment files from the links in the exported CSV file before those links expire.
- API - Similar to CSV downloads, attachment links obtained via Airtable’s API will expire after a given amount of time.
For workflows that are dependent on the format of the attachment URL or identifiers within it (eg: filename), after the changes to attachments go live in November, there will be nothing in the attachment URL that can be interpreted in a meaningful way. To reiterate, the attachment URL formatting is not part of our compatibility surface, so users should not attempt to parse or interpret attachment field URLs.
When sharing a file with colleagues who have access to the base where the attachment is being stored we recommend that you open the attachment preview window (click into the attachment field and press the spacebar) and copy the URL in your browser like so:
This URL is static and will not expire unless the attachment is removed or the record is deleted. A reminder that links will only be accessible to users who have been added as collaborators in the workspace or base where the attachment is located.
If you are sharing a file with a colleague who is not collaborating with you in Airtable, then you will need to consider alternative ways of sharing the file attachment in question. Typically, the best practice would be to navigate to the attachment in Airtable, download the file, and then share it with the colleague in an email, via Slack, or some other surface that your organization uses. Alternatively, you can share a view with the colleague and ask them to download the file themselves, should they need it for future reference.
What is an attachment URL?
Every file uploaded to Airtable in an attachment field has a set of properties, including a unique ID, a URL directly to the file, a file name, and other data related to the file itself (size, type, etc.). The URL to those files is what will expire every few hours.
What happens if this change breaks my workflow?
We will offer a temporary opt-out period so that you or your organization has additional time to plan for the change. Details on this opt-out process will be shared closer to the November rollout.
What happens if an expired link is accessed?
Expired links will result in an error code indicating that the URL is no longer valid or has expired.
What kind of links will be impacted? If I have a link to a Box or a Google Drive folder, will it be affected?
Only links to attachments stored in Airtable will be affected. Links added to single line, long text, and URL fields are unaffected by this change.
Is there a way to know if I or my company/organization may be impacted by this change?
Check the bullet points in the What's changing section above.
Can I opt into these changes sooner?
Unfortunately, we do not have the ability to make these changes sooner.
Is it possible to make this change optional for some or all attachment URLs?
No. This change is part of a holistic step toward a more secure attachment field experience.
How many hours will the URLs remain active before expiring?
URLs will not expire for at least 2 hours after they are received.
I use APIs to obtain an URL to an Airtable attachment, and this usage is integrated with other tools, e.g. Zapier. It seems the URLs will expire. What should I do?
If you or a third party integration are using API processes to obtain attachment URLs from Airtable, then it’s important to note that the URLs obtained will only be active for a short period of time (~2 hours). Using Airtable as a CDN has been and continues to be discouraged in line with this change.