# Delivering media without leaking your provider

> Result URLs served from your own domain through opaque, signed tokens — so your stack stays your business.

- **Published**: 2026-05-30
- **Tag**: Engineering
- **Read time**: 5 min

---

When a model returns a file, the naive approach is to hand the provider's CDN URL straight to your users. That leaks which vendor you use and ties you to their storage lifecycle.

# Proxied, signed delivery

Every result URL points at your own domain and carries an encrypted, time-limited token. The gateway validates the token, streams the bytes, and never reveals the upstream origin.

```
https://api.you.bot/api/file?t=<opaque-token>
```

Forged or expired tokens are rejected. Your users only ever see your brand.