> ## Documentation Index
> Fetch the complete documentation index at: https://docs.periskope.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Media Privacy

> Serve WhatsApp media through secure Periskope URLs with organization-level access control and expiring links.

### **Overview**

Media files on Periskope (images, videos, audio, and documents) are now served through Periskope URLs (`https://api.periskope.app/app/media/...`) instead of direct Google Cloud Storage bucket links.

Previously, anyone with a media link could open it forever. With Media Privacy, you control who can access your organization's media and for how long — links can require authentication and expire automatically.

<Note>
  Media Privacy is **off by default**. Until you enable it, media URLs simply moved to the new Periskope domain and remain publicly accessible — nothing else changes for you.
</Note>

***

### **How Media Access Works**

When a media URL is opened, Periskope checks your organization's privacy setting and then redirects to a short-lived storage URL that serves the actual file:

1. **In the Periskope app** — access is granted automatically through a secure session cookie. Your team never has to do anything.
2. **Outside the app** (APIs, webhooks, integrations, shared links) — if Media Privacy is enabled, URLs carry a signed access token that expires after your configured duration. Without a valid token, the request is rejected.

If Media Privacy is disabled, media URLs are served without any authentication.

***

### **Enabling Media Privacy**

* Go to **Settings → Config** and scroll to the **Media Privacy** setting.
* Turn on the **Media Privacy** toggle.
* Once enabled, all media links sent via API responses, webhooks, and integrations include an expiring access token.

***

### **Configuring Link Expiry**

With Media Privacy enabled, choose how long external media links stay valid under **Link Expiry**:

* Options range from **10 minutes** to **7 days** (default: **24 hours**).
* The expiry applies to links delivered via APIs, webhooks, integrations, and the copy-link option in chats.
* After a link expires, fetch a fresh one with the [Migrate Media URL API](/api-reference/media/migrate-url) or by re-fetching the message.

***

### **What Changes for APIs, Webhooks & Integrations**

* **API responses** and **webhook payloads** now return `api.periskope.app/app/media/...` URLs instead of `storage.googleapis.com` URLs.
* **Integrations** (HubSpot, Zoho, Freshdesk, Google Sheets, Zapier, and others) receive the same new URLs automatically — no reconfiguration needed.
* If Media Privacy is enabled, download media within your configured expiry window instead of storing links long-term. Store the message ID and generate a fresh link when needed.

***

### **Migrating Old Media URLs**

If you have stored old `storage.googleapis.com` URLs in your systems, convert them to the new format using the Media APIs:

* [Migrate Media URL](/api-reference/media/migrate-url) — convert a single URL.
* [Migrate Media URLs (Batch)](/api-reference/media/migrate-url-batch) — convert up to 1,000 URLs in one request.

Both endpoints also refresh expired Periskope media links with a new access token.

<Warning>
  Direct Google Cloud Storage URLs are deprecated and will stop working in a future phase of the rollout. Migrate any stored URLs to the new format now to avoid broken links.
</Warning>

***

### **FAQs**

<AccordionGroup>
  <Accordion title="Do I need to change anything if I don't use the API?">
    No. The app handles authentication automatically for your team, and Media Privacy stays off unless you enable it.
  </Accordion>

  <Accordion title="Will my old stored media links break?">
    Old bucket URLs continue to work during the rollout, but they are deprecated. Use the migration API to convert stored URLs to the new format.
  </Accordion>

  <Accordion title="Why does a media link return 401 or 403?">
    A **401** means the link's access token is missing or expired — generate a fresh link via the migration API. A **403** means the media belongs to a different organization than the API key used.
  </Accordion>

  <Accordion title="Does enabling Media Privacy affect messages my customers see on WhatsApp?">
    No. This only affects media links served by Periskope (app, APIs, webhooks, integrations). Media delivery on WhatsApp itself is unchanged.
  </Accordion>
</AccordionGroup>