Generate a signed URL for a private Supabase Storage object (and a signed upload URL for resumable uploads), understanding how access differs between public and private buckets.

Documented steps

1. Public bucket objects need no signing: GET https://{project_ref}.supabase.co/storage/v1/object/public/{bucket}/{asset-name}, or use the SDK's supabase.storage.from('bucket').getPublicUrl('filePath.jpg').
2. For a private bucket object, sign one path with POST https://{project_ref}.supabase.co/storage/v1/object/sign/{bucket_name}/{path} sending headers apikey + 'Authorization: Bearer {jwt}' and JSON body {"expiresIn": 3600} (expiresIn is a required integer, in seconds).
3. The response is {"signedURL": "/object/sign/{bucket}/{path}?token=..."} — a relative path; prepend https://{project_ref}.supabase.co/storage/v1 to build the shareable URL, or use the SDK: await supabase.storage.from('bucket').createSignedUrl('private-document.pdf', 3600).
4. To sign many objects at once, POST https://{project_ref}.supabase.co/storage/v1/object/sign/{bucket_name} with body {"expiresIn": 3600, "paths": ["a.png", "b.png"]}; the response is an array of {path, signedURL, error}.
5. Private objects can also be fetched directly (no pre-signing) via GET https://{project_ref}.supabase.co/storage/v1/object/authenticated/{bucket}/{asset-name} if the caller sends a valid user Authorization header.
6. For resumable/TUS uploads by untrusted clients, create a time-limited upload token: const { data } = await supabase.storage.from('bucket').createSignedUploadUrl('file_path', { upsert: true }); then pass data.token in the TUS request's 'x-signature' header.
7. Append '?download' (optionally '?download=customname.ext') to any object URL to force a browser download instead of inline serving.
8. Docs: https://supabase.com/docs/guides/storage/serving/downloads https://supabase.com/docs/guides/storage/uploads/resumable-uploads https://supabase.com/docs/reference/storage