Card attachments *now* inherit board privacy settings?
Asked by Bryan Buchanan:

It used to be that attachments on private boards were publicly-accessible, as mentioned in previous threads like this one: <https://community.atlassian.com/t5/Trello-questions/Attachments-in-Trello-are-public-or-private/qaq-p/990831>

Our business built an app on top of the API that relies on these attachments (images, specifically) being publicly-accessible.

But now, it looks like these attachments now require the same permissions the boards themselves require. And, I've so far been unable to find anything in the API that would allow me to at least make these images accessibly via a proxy or any other means.

Does anyone know if this was intentional, if they plan on adding API access to attachments, or if there's any other way we can make attachments on private boards publicly-accessible?


Answers:
author: Bryan Buchanan
body: After doing some digging on the developer community board, I see that requiring auth for private board attachments has been a planned change: [https://trello.com/c/tnX5dhiI/87-updated-authenticated-access-to-s3?menu=filter\&filter=s3](https://trello.com/c/tnX5dhiI/87-updated-authenticated-access-to-s3?menu=filter&filter=s3)

The solution is to add auth headers to your get request, like:

```
Authorization: OAuth oauth_consumer_key="<KEY>", oauth_token="<TOKEN>"
```

Because I don't want to expose my API credentials, I had to create an intermediate proxy service that attaches the auth headers and streams the results back.

comments: author: milynnus
body: [@Bryan Buchanan](/t5/user/viewprofilepage/user-id/4521625)

I worked on the same yesterday. I create a file and make it accessible as a download which is the recommendation. You mention "stream" in your post, can you share how you did it? How would you handle the different media types and file types? Is the a generic binary object type I should use?


author: Bryan Buchanan
body: [@milynnus](/t5/user/viewprofilepage/user-id/3947182) By no means do I claim this is good or correct, but [this](https://gist.github.com/bryanbuchanan/a14cf11853322a5d4219e98b044ea853) is the method I'm using for now. It's not actually streaming, but that isn't a huge deal for my particular application.


author: milynnus
body: [@Bryan Buchanan](/t5/user/viewprofilepage/user-id/4521625)

Thanks for sharing. I found out that there is type=stream for large files. Got it to work and I am able to get files downloaded. Will try with a pdf to see it will work.

I think the goal is to provide a url and and a zipfile of all the contents is made available. That seems to be the ease of sharing that is need. Best it can be provided as a service from Trello board.


author: Alejandro Chung
body: Hello,

I am trying to access a card's attachment v?a API, but the following error shows "unauthorized permission requested".

I did all the instruction that is showed in this announcement: [https://trello.com/c/tnX5dhiI/87-updated-authenticated-access-to-s3?menu=filter\&filter=s3](https://trello.com/c/tnX5dhiI/87-updated-authenticated-access-to-s3?menu=filter&filter=s3)

The following URL is of the attachment I want to preview and where I put queries with API Key and Token access code.

[https://api.trello.com/1/cards/611feb7fe7b0075ce99ec8f5/attachments/6123ddf2808b24542cac8154/download/imagen.jpeg?key=\*\*\*\*\*\*\*\&token=\*\*\*\*\*\*\*](https://api.trello.com/1/cards/611feb7fe7b0075ce99ec8f5/attachments/6123ddf2808b24542cac8154/download/imagen.jpeg?key=*******&token=*******)

I do not think the query parameters are wrong because I used it with the following HTTPS call to get card's attachments links and it worked:

[https://api.trello.com/1/cards/611feb7fe7b0075ce99ec8f5/attachments?key=\*\*\*\*\*\*\*\&token=\*\*\*\*\*\*\*](https://api.trello.com/1/cards/611feb7fe7b0075ce99ec8f5/attachments?key=*******&token=*******)

?What can be the problem?

Best regards

comments: author: Bryan Buchanan
body: I believe the key and token need to be added to the request's headers, not just appended as a query string, as they are in your example. It does indeed behave a bit different than the existing API calls.


author: Alejandro Chung
body: I tried with OAuth too, but maybe I am doing something wrong. ?Can you check please?  

Consumer Key={Here I put API KEY}  
Consumer Secret={Here I put OAuth Secret provided in <https://trello.com/app-key>}  
Access Token={Here I put API Token}  
Token Secret={Nothing}


author: Bryan Buchanan
body: What are you using to make the request? The link I posted earlier in another reply has an example for adding the headers to a request made from Node.


author: Alejandro Chung
body: I fixed it.   

I was using an Zapper-like webapp where I had to put that data. I needed to append Key and Token as Oauth and not just as query string.  

Thanks!


author: Martin Purmensky
body: I am also desperately looking for a way to regain this feature. This new sharing seriously affects our workflow making Trello less convenient.

comments: author: Bryan Buchanan
body: Check out my [previous answer](https://community.atlassian.com/t5/Trello-questions/Card-attachments-now-inherit-board-privacy-settings/qaq-p/1781596#M50572)

It's not too difficult, I was just having a tough time finding info about the change.

Add the appropriate auth headers to the GET request, and you have your file.

If you need to hide your key/token, make the request server-side, then serve/stream the file back as the response.

*** ** * ** ***

**Update** : Here's a quick example written for NodeJS. I'm sure there are better ways of serving or streaming the file back to the viewer, but this at least illustrates the process: <https://gist.github.com/bryanbuchanan/a14cf11853322a5d4219e98b044ea853>


author: Martin Purmensky
body: Sorry, this is beyond my skills. I have no idea what to do with the code or where to upload it. I am a user that needs to share attachments from a private board, and preview files as it was 2 months ago.


author: milynnus
body: [@Martin Purmensky](/t5/user/viewprofilepage/user-id/4519529)

I am also trying to figure out how to deploy something like this.

Currently the best I can do is to send an url via email to the user (it a fake url so it will not work)
> [https://user2:jXd5s\^2z%6qA@63105.wayscript.io/attach_zip/?card_id=51146f45df741c3bd7ef635e](https://user2:jXd4s%5E2z%6qA@63105.wayscript.io/attach_zip/?card_id=61146f45df741c3bd7ef635e)

It works welcome with Chrome but Safari does not support the basic authentication.

Hidden behind the endpoint will be a server program that will gather all the attachments from a card and the user will be able to download them. Because it tricks a download it cannot be activated from Butler.