Skip to main content

Pass a file to a connected tool with a signed download URL

Turn a thunk file link into a short-lived signed download URL before a connected tool runs, so that tool can fetch the file itself.

Pass a file to a connected tool with a signed download URL

Some connected tools — an MCP server, a REST API, or another application library — take a URL and download the file themselves. Many file links inside a thunk only work inside Thunk.AI: an uploaded file, or a file the thunk can open through its own connections. The connected tool cannot use that link.

Turn on Convert URLs to signed download URLs for that parameter. Before the tool runs, Thunk.AI replaces the file link with a short-lived, publicly reachable download URL. The tool can fetch the file without signing in to Thunk.AI. The signed URL expires after 1 hour, so the tool should download the file promptly when it runs.

Use this when the tool's job is "fetch this file from a URL." Do not use it for spreadsheet, document, or drive tools that open a file through Thunk.AI — those take a File value and bind to it in the product. In a custom code tool, open a File input with openFile and call getDownloadLink() when you need this same kind of signed URL from the script.

When to turn it on

Turn it on when all of these are true:

  • The tool is from a connection (MCP, REST API, or another application library), not a File-bound library such as Excel or Google Docs.

  • One of the tool's inputs is a text parameter that holds a file link — a File on the work item, an uploaded document, or another URL the thunk can already open.

  • The tool itself will download the file from that URL. Typical cases: an external document processor, a classifier, or an MCP tool whose argument is named something like file_url or document_url.

Leave it off when:

  • The file is already on a public URL the tool can reach without Thunk.AI.

  • The work stays inside the thunk — the agent reads the file with platform file tools, or a code tool calls openFile (and getBytes() / getDownloadLink() when it needs the file itself or a signed URL).

Connecting those external systems is covered in Connecting to external systems and tools.

How to turn it on

  1. In the thunk, open Connections and select the library that contains the tool.

  2. Enable the library and the tool if they are not already on. Settings are available only on an enabled tool.

  3. Open the tool and click Settings.

  4. Under Convert URLs to signed download URLs, turn on each text parameter that should become a signed download URL.

Settings for classify_document. Convert URLs to signed download URLs is on for file_url and off for callback_url.

The list shows only the tool's top-level text parameters. If the tool accepts several items in one call, the same parameters are converted on each item.

Settings can also include Needs approval for the same tool. That pause is separate from signed URLs.

What happens when the tool runs

The AI agent still passes the file's usual link — you do not change the instruction or invent a different URL.

Thunk.AI then fetches the file if needed — using the thunk's connections when the link requires them (for example a Drive or SharePoint file) — and replaces that parameter with a signed download URL the tool can fetch without signing in.

If the parameter is empty, it is left as-is.

After an hour the signed URL stops working. The tool must download the file during that run, not save the URL for later.

Limits

  • Only top-level text parameters can be converted.

  • The thunk must be able to download the original link. If it cannot, the run fails with Could not download URL for parameter and the parameter name. Check the link and that the needed connection is enabled — see Troubleshooting errors.

  • If Thunk.AI has to download the file first, it cannot be larger than 10 MiB.

  • The signed URL is for that one tool call. Do not treat it as a permanent share link.

Related Articles
Did this answer your question?