System Bridge shares a file link without sharing its API token

Home Assistant uses signed file links when sending System Bridge media to a player, keeping the computer’s full API token out of those URLs. Previously, a receiving player such as a Cast device got a URL containing that token, which could authorize other System Bridge requests.

The signed link is limited to the chosen file and expires after twenty-four hours. This requires System Bridge 5.25 or newer; older hosts keep the token-based links. Correctly encoding the file path also lets names containing spaces or ampersands work.