Can someone tell me whether attachments in Airtable/uploaded to an Airtable form are given a URL that allows anyone with the link to access the attachment without any sort of authentication please? I couldn’t find anything about this in the official documentation, but threads like this one say that this is how things work: Attachment URLs are public? I’m asking because I’ve been asked to upload an attachment containing tax information to an Airtable form and obviously I have concerns about this if Airtable will generate a URL that allows access to anyone who has the link. Thanks in advance for your help!
Attachments URL are not protected, the URLs can be accessed by anyone who has the link. You can test this by uploading a test attachment, opening it, copying the URL, and pasting that URL into a signed-out (or incognito) browser. If the URL loads the attachment it can be loaded by anyone.
I voiced concern to support, but Airtable maintains that this is secure because the odds of someone guessing your URL are near zero. Of course, I do not agree this is secure enough, so my business doesn’t use the attachment feature. We use the URL field type and drop in google-drive links, which are protected behind google account authentication as a work-around