# Platform API Send message api require\_auth parameter is not working **URL:** \ **Category:** API\ **Created:** [November 24, 2023, 6:37am UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638 "2023-11-24T06:37:08Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Co\_jobs](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/co_jobs/32/4553_2.png) [@Co\_jobs](https://community.sendbird.com/u/Co_jobs)\ **Post date:** [November 24, 2023, 6:37am UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638/1 "2023-11-24T06:37:08Z")
**[Problem/Question]** The value require\_auth=true is not applied when sending a file message via the Send message API in the Platform API. Q1. Do I need to enable something like security settings in the dashboard to use the require\_auth property? Q2. I tested it on a group channel, is it possible for the require\_auth property to work on a group channel? Q3. I can’t set require\_auth=true when sending a file message with Android SDK? * * * **[Reproduction Steps]** 1. API : https://api-{application\_id}.sendbird.com/v3/group\_channels/sendbird\_group\_channel\_{numbers}/messages 2. Header : “Api-Token” : “{api\_token}” 3. Form data : “file” : {file}, “user\_id” : “{user\_id}”, “require\_auth” : “true”, “message\_type” : “FILE”, … 4. Method : Post 5. I sent a file message via the Send message API of the Platform API. I set require\_auth to true. 6. However, in the JSON object I received as a response, the value of require\_auth was false. 7. The value in the file.url was also a URL that did not contain the auth={key} parameter. **[Frequency]** Always repreduce. ---
**Author:** ![Tyler](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/tyler/32/810_2.png) [@Tyler](https://community.sendbird.com/u/Tyler)\ **Post date:** [November 29, 2023, 8:47am UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638/2 "2023-11-29T08:47:27Z")
Hello @Co_jobs, Setting `require_auth` is only applicable to messages not hosted by Sendbird. If you’re uploading a file to us, we’ll utilize an internal attribute for your application. Additionally, if a file message did have `require_auth` as `true`, the Platform API would NOT return an authenticated URL. It would only return the base URL. ---
**Author:** ![Co\_jobs](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/co_jobs/32/4553_2.png) [@Co\_jobs](https://community.sendbird.com/u/Co_jobs)\ **Post date:** [November 30, 2023, 5:34am UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638/3 "2023-11-30T05:34:38Z")
> [@Tyler](#): > > we’ll utilize an internal attribute for your application Thank you for your answer. But it still doesn’t answer my question, so I’m asking again. Q. Is there any way to encrypt a file when sending a file message through the Android SDK? It seems that only the following page explains encryption: [Share an encrypted file | Chat Android SDK | Sendbird Docs](https://sendbird.com/docs/chat/sdk/v4/android/message/sending-a-message/share-an-encrypted-file) Q. The Platform API message sending guide seems to indicate that setting require\_auth to true will allow you to encrypt files. Is this not true? [Send a message | Chat Platform API | Sendbird Docs](https://sendbird.com/docs/chat/platform-api/v3/message/messaging-basics/send-a-message) Q. When you say “we’ll utilize an internal attribute for your application” in your answer, does this mean that encryption is possible through the Android SDK settings? ---
**Author:** ![Tyler](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/tyler/32/810_2.png) [@Tyler](https://community.sendbird.com/u/Tyler)\ **Post date:** [November 30, 2023, 11:01pm UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638/4 "2023-11-30T23:01:31Z")
There is an all or nothing approach to file authentication. If you’d like to have all files require auth, let me know and I’ll get your Application ID and enable it. Then all file messages, regardless of whether they’re sent via Platform API or SDK will require auth. As mentioned in my original response, the `require_auth` parameter is only used when you’re sending a pre-uploaded file, aka via a URL. It is not something you can toggle on and off per file on files Sendbird hosts. ---
**Author:** ![Co\_jobs](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/co_jobs/32/4553_2.png) [@Co\_jobs](https://community.sendbird.com/u/Co_jobs)\ **Post date:** [December 1, 2023, 12:15am UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638/5 "2023-12-01T00:15:31Z")
Thank you very much for your kind response. Thanks to you, I realized that I can’t apply the file encryption feature to individual file messages. And that if we want to apply the encryption feature to all file messages, we have to request it directly from Sendbird. Our current situation is that even after the file encryption feature is enabled, we still need to be able to access all files from our service admin page, because we need to determine if the images in the reported messages are worthy of a report. Q. Is there any way to make all files accessible even after the file encryption feature is enabled? ---
**Author:** ![Tyler](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/tyler/32/810_2.png) [@Tyler](https://community.sendbird.com/u/Tyler)\ **Post date:** [December 1, 2023, 3:11am UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638/6 "2023-12-01T03:11:59Z")
If you’re looking to access the file from a backend application, you can pass the un-authenticated URL with the same `Api-Token` header you’d pass for a Platform API call and it will redirect you to the authenticated URL. ---
**Author:** ![Co\_jobs](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/co_jobs/32/4553_2.png) [@Co\_jobs](https://community.sendbird.com/u/Co_jobs)\ **Post date:** [December 5, 2023, 11:23am UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638/7 "2023-12-05T11:23:26Z")
Hi, Tyler. I’m reaching out to you again because something you answered isn’t quite what I expected. I used the Platform api to send a file message. I put a URL hosted elsewhere in the “files” parameter. The message was sent and the “url” in the message contained “{url hosted elsewhere}&auth={auth\_code}”. Since it contained a “url” hosted elsewhere, the auth parameter seemed meaningless. Q. When I put a URL hosted elsewhere in a file message, isn’t the file corresponding to that URL uploaded to the Sendbird server, and the URL of the file uploaded to Sendbird is included in the message? Q. We need to make the file URL of a specific file message inaccessible after a certain amount of time, even if it is exposed. Is there any way to enforce this requirement? ---
**Author:** ![Tyler](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/tyler/32/810_2.png) [@Tyler](https://community.sendbird.com/u/Tyler)\ **Post date:** [December 6, 2023, 7:42am UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638/8 "2023-12-06T07:42:49Z")
A: No, we do not copy the file that is hosted elsewhere to our servers. We explicitly do this so that customers who wish to host file data exclusively on their own side, can do so without issue. Additionally, re-hosting could cause extra data charges to you. A: The signed URL that includes the `auth` parameter, is only valid for 5 minutes. So if you were to save a signed URL, it would be invalidated after 5 minutes. ---
**Author:** ![Co\_jobs](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/co_jobs/32/4553_2.png) [@Co\_jobs](https://community.sendbird.com/u/Co_jobs)\ **Post date:** [December 6, 2023, 8:12am UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638/9 "2023-12-06T08:12:15Z")
I always appreciate your answers. However, it didn’t completely clear things up, so I’m asking again. > A: No, we do not copy the file that is hosted elsewhere to our servers. We explicitly do this so that customers who wish to host file data exclusively on their own side, can do so without issue. Additionally, re-hosting could cause extra data charges to you. → Q. Does this mean that when sending a file message using the Platform API, there is no point in putting a URL hosted elsewhere in the files parameter and setting require\_auth=true? If I remove the auth parameter from the url in the message, it will end up being a url that is always accessible. Am I understanding this correctly? * * * > A: The signed URL that includes the `auth` parameter, is only valid for 5 minutes. So if you were to save a signed URL, it would be invalidated after 5 minutes. → Q. After the encryption feature is enabled on the Sendbird side, all file messages are encrypted and the file message contains a signed URL with the `auth` parameter. If this is correct, does this mean that the signed URL without the `auth` parameter will become inaccessible after 5 minutes? * * * Q. We want to encrypt only some of the file messages, not all of them, to prevent access to the file URLs. Is this possible? ---
**Author:** ![Tyler](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/tyler/32/810_2.png) [@Tyler](https://community.sendbird.com/u/Tyler)\ **Post date:** [December 6, 2023, 8:50am UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638/10 "2023-12-06T08:50:22Z")
> Q. Does this mean that when sending a file message using the Platform API, there is no point in putting a URL hosted elsewhere in the files parameter and setting require\_auth=true? If I remove the auth parameter from the url in the message, it will end up being a url that is always accessible. Am I understanding this correctly? I think this ultimately depends on your implementations file storage strategy. If you pass in a URL to the File Message, that does mean that you can access it by removing the `?auth` parameter, assuming the files current hosting solution does not require authentication. If you wanted to rely on Sendbird to host the files and control access, you shouldn’t be passing us URLs but the actual file. Sendbird is not responsible for authentication on files that are not hosted by us. In terms of you seeing non-Sendbird related URLs having the `?auth` parameter, I believe this is the SDK assuming the file is hosted by Sendbird. The SDK will look at the `require_auth` value of the file and create the signed url. We can probably do better here long term. That being said, the Platform API will never pass the auth url back when fetching messages. > Q: After the encryption feature is enabled on the Sendbird side, all file messages are encrypted and the file message contains a signed URL with the `auth` parameter. If this is correct, does this mean that the signed URL without the `auth` parameter will become inaccessible after 5 minutes? File authentication is not retroactive. Meaning that any messages sent prior to the authentication being enabled will still not require authentication. Again, these are only for messages where Sendbird is hosting the actual file. The `?auth` parameter is not what expires. Essentially what happens is when you access the url like `https://file-us-3.sendbird.com/XXXXXX?auth=1234` is you’re making an API call to Sendbird to determine if you should be able to access the requested file. If you are able to, we create a pre-signed URL and redirect you an authenticated S3 URL like such: ```auto https://sendbird-ap-2.s3.amazonaws.com/{path}/{to}/{file}/plane.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVWIILT34XWCM6OG2%2F20231206%2Fap-northeast-2%2Fs3%2Faws4_request&X-Amz-Date=20231206T084440Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=fakeSignature ``` This URL is what has the 5 minute life span. > Q: We want to encrypt only some of the file messages, not all of them, to prevent access to the file URLs. Is this possible? As mentioned previously we do not provide the ability to selectively apply authentication only certain messages. I think it makes sense to apply authentication to them all and then just fetch them as needed. Otherwise, the files may be better stored in your own database/storage solution where you have more finite control over the authentication applied to them. ---
**Author:** ![Co\_jobs](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/co_jobs/32/4553_2.png) [@Co\_jobs](https://community.sendbird.com/u/Co_jobs)\ **Post date:** [December 7, 2023, 1:29am UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638/11 "2023-12-07T01:29:10Z")
Thank you so much for your detailed explanation. It’s really helping me a lot. I’m embarrassed to say that you answered my question in such detail, but I’d like to ask more questions. Q. Is it true that the URL of an encrypted file message, i.e. the URL containing the `auth` parameter, is always valid for 3 days? It is my understanding that the value of the `auth` parameter changes each time a session is logged in. For example, assuming the signed URL of the file message was `https://file-us-3.sendbird.com/XXXXXX?auth=1234`, I was wondering if the signed URL would change to something like `https://file-us-3.sendbird.com/XXXXXX?auth=6789` when the session is newly logged in, and the old `https://file-us-3.sendbird.com/XXXXXX?auth=1234` would become invalid. Q. Before requesting a file encryption feature from the Sendbird side, is there any way to test how it will behave when applied and if it will work for our app? ---
**Author:** ![Tyler](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/tyler/32/810_2.png) [@Tyler](https://community.sendbird.com/u/Tyler)\ **Post date:** [December 14, 2023, 2:36am UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638/12 "2023-12-14T02:36:59Z")
Apologies, I appear to have missed your last response. > Q. Is it true that the URL of an encrypted file message, i.e. the URL containing the `auth` parameter, is always valid for 3 days? It is my understanding that the value of the `auth` parameter changes each time a session is logged in. For example, assuming the signed URL of the file message was `https://file-us-3.sendbird.com/XXXXXX?auth=1234` , I was wondering if the signed URL would change to something like `https://file-us-3.sendbird.com/XXXXXX?auth=6789` when the session is newly logged in, and the old `https://file-us-3.sendbird.com/XXXXXX?auth=1234` would become invalid. A. I’m unsure where the three days came from. The `auth` token is specific to an individual user and so it shouldn’t be stored. The SDK will regenerate it every time it’s fetched by that user. > Q. Before requesting a file encryption feature from the Sendbird side, is there any way to test how it will behave when applied and if it will work for our app? A. You can request we enable it on a staging or development application within your organization. ---
**Author:** ![Co\_jobs](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/co_jobs/32/4553_2.png) [@Co\_jobs](https://community.sendbird.com/u/Co_jobs)\ **Post date:** [December 19, 2023, 5:59am UTC](https://community.sendbird.com/t/platform-api-send-message-api-require-auth-parameter-is-not-working/8638/13 "2023-12-19T05:59:01Z")
Thank you for answering all of my many questions. It’s been very helpful, and have a great holiday season.