> For the complete documentation index, see [llms.txt](https://docs.lassomoderation.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lassomoderation.com/developers/url-signing/laravel-url-signing.md).

# Laravel URL Signing

Our Laravel URL signing integration allows Lasso to securely access media that your Laravel application serves behind signed URLs. Lasso signs URLs the same way Laravel's `URL::temporarySignedRoute` does, so your application can validate them with `$request->hasValidSignature()`. No credentials are exchanged at request time, your application stays in control of every download.

{% hint style="info" %}
URL signing is available as an add-on. Contact us to enable it for your workspace.
{% endhint %}

#### **Step 1: Prepare Your Laravel Application**

1. Serve your media through a route that validates signed URLs, for example:

   ```php
   Route::get('/media/{path}', [MediaController::class, 'show'])
       ->where('path', '.*')
       ->middleware(ValidateSignature::class);
   ```

   The route must allow both **GET** and **HEAD** requests. Lasso uses HEAD requests to check content before downloading it.
2. Choose the signing key you will share with Lasso. This can be your `APP_KEY`, but we recommend a dedicated key so you do not have to share your application key. On Laravel 11 and newer, register a key resolver that returns both keys, so your own signed routes (password resets, unsubscribe links) keep working:

   ```php
   // app/Providers/AppServiceProvider.php
   public function boot(): void
   {
       URL::setKeyResolver(fn () => [
           config('app.key'),
           config('services.lasso.signing_key'),
       ]);
   }
   ```

   On Laravel 10 and older the key resolver returns a single key, so either share your `APP_KEY` or validate the Lasso key in middleware scoped to the media route.

{% hint style="warning" %}
The signing key is used exactly as written. If your key starts with `base64:`, that prefix is part of the key, Laravel never decodes it. Copy the key verbatim when adding it to Lasso.
{% endhint %}

#### **Step 2: Add Signing Information in Lasso**

1. Navigate to **Settings → Integrations** in Lasso.
2. Select **Laravel Signatures**, click **New signature** and fill in the following fields:
   * **Domain**: The domain where your content resides (e.g. `https://media.your-platform.com`). Every URL on this domain will be signed.
   * **Signing key**: The key your application validates signed URLs with. It is stored encrypted and never shown again, only a masked hint appears in the dashboard.
   * **TTL**: The time-to-live for the signed URL (minimum 15 minutes). This is the amount of time a URL will be valid for.
   * **Example URL**: Provide an example URL on your domain. Lasso signs it and requests it with GET and HEAD to verify your application accepts the signature. The signature is only saved when both requests succeed.

<figure><img src="/files/EAAgWhk0ZjngK1pydHx4" alt=""><figcaption></figcaption></figure>

#### **Step 3: Automatic Signing for Your Content**

Once the integration is set up:

* Any content from the specified **Domain** will automatically be signed by Lasso when required.
* Lasso appends two query parameters to the URL: `expires` (a Unix timestamp) and `signature` (a lowercase hex HMAC-SHA256 over the URL, computed the same way Laravel computes it). Existing query parameters are preserved.
* The signed URL is used for analyzing the content or displaying it securely in the dashboard. You do not need to update or manage URLs manually.
* If the signed URL expires, Lasso regenerates it automatically when the content is accessed again.