Pre-signed URLs

Instructions for importing your cloud-hosted data to Labelbox via pre-signed URLs.

If you do not wish to add your datasets via our IAM Delegated Access integration, you may import public or private URLs directly.

Signed URLs

Signed URLs contain authentication information in their query strings and are used to limit the permission and timeframe for each request. Importing your data via signed URLs is one method for protecting your data from unauthorized access. When you import your data this way, Labelbox has no access to your data files.

A signed URL has a unique key and should look like this:

Use the following resources to learn how to create signed URLs for your cloud-hosted data.

IP whitelisting


Labelbox server address

Another way to protect your data from unauthorized access is to whitelist an IP range. For example, you can put your source data behind a local network or VPN. Then, whitelist the IP range of your VPN so you can access and review data from anywhere and better manage access to your network. Or you can whitelist the IP range of your outsourced labeling team's wifi network. This way external team members can label and review the data without VPN access.


Not compatible with delegated access integrations

This configuration is only recommended when using a non-delegated access configuration.

IP whitelisting for AWS S3

You can set up IP whitelisting for AWS S3 with an IP address bucket policy. Once set up, you will only be able to access assets while connected to your VPN or wifi network. Once you disconnect from your VPN or wifi network, the assets will no longer load.

  "Version": "2012-10-17",
  "Id": "S3PolicyId1",
  "Statement": [
      "Sid": "IPAllow",
      "Effect": "Allow",
      "Principal": "*",
      "Action": [ "s3:GetObject" ],
      "Resource": "arn:aws:s3:::examplebucket/*",
      "Condition": {
         "IpAddress": {"aws:SourceIp": ""},

Find your IP range

Typically a router will be configured for 255 IP addresses. Visit to see your computer’s IP address. For example, if it was then your IP range would be - If you’re under a company VPN you should contact an administrator to get a static IP range.