Expiring download links

Every pass has a permanent share link. It's unguessable — the random part of the URL has more combinations than there are grains of sand on Earth, many times over — and for most passes it's exactly right: it survives being opened from an email a week later, re-tapped after a phone upgrade, and printed as a QR code.

Sometimes, though, you'd rather a link that dies. Tickets with resale value, membership passes with personal details, anything where a forwarded email shouldn't stay a working pass link forever. That's what expiring download links are for.

How they work

Your server asks the API for a link, hands it to your customer, and the link stops resolving when its time is up — one hour by default, configurable from a minute to seven days:

curl https://api.passmint.com/v1/passes/pass_xxx/download-links \
  -H "Authorization: Bearer pmk_live_xxx" \
  -d '{ "expires_in": 3600 }'

The response contains the url and its expires_at. Behind that URL is the same pass page as the permanent link — Apple Wallet download, Google Wallet save, QR handoff — so nothing about your customer's experience changes. After expiry they see a friendly "this link has expired" page naming you as the place to get a new one, and your server simply mints a fresh link on request.

If it reminds you of S3 presigned URLs, that's deliberate — mint per delivery, short lifetime, request a new one when it lapses.

Locking a template to expiring links

By default expiring links are an extra way in; the permanent link keeps working. If you want them to be the only way in, set require_download_link: true on the template. From that moment the permanent URLs for every pass on the template return 404 — indistinguishable from a pass that never existed — and only freshly minted links resolve.

What expiry does and doesn't protect

An honest note, because it matters for how you use this feature.

What it protects: the link itself. A link sitting in an email thread, a support ticket, a log file, or a forwarded message goes dead on schedule. Whoever finds it later gets an expired page, not a pass.

What it doesn't protect: the pass after download. Once someone has added the pass to their wallet — or downloaded the .pkpass file — they hold it, barcode and all, and no link expiry reaches it. If your concern is the same ticket being redeemed twice, that's a redemption problem, not a distribution one: use a single-use redemption policy and scan at the door.

Think of it as: expiring links control who can get the pass, redemption policies control what the pass is worth once they have it.