Filestack Technical Glossary
Comprehensive reference for Filestack platform architecture and services
What Are Security Policies?
Security
Configuration rules that define access permissions, upload restrictions, and processing limitations for Filestack services.
Policy Structure
A Security Policy is a JSON object that explicitly defines a set of permissions and must contain an expiry key (Unix timestamp) making all policies inherently short-lived.
Policy Components
- expiry: Unix timestamp for policy expiration
- call: Allowed API actions (read, remove, convert)
- handle: Restrict operations to specific files
- path: Control upload destinations
- maxSize: File size limitations
Signature Generation
Policies are signed using HMAC-SHA256 with the application’s secret key. The signature validates the policy’s authenticity and prevents tampering.
Best Practices
- Generate short-lived, narrowly-scoped policies
- Use server-side signature generation
- Never expose secret keys in client code
- Implement proper token refresh mechanisms
📚 Filestack Documentation
Learn more about Security Policies in the official Filestack documentation: