How to generate a public download link for AAB files using scripts

You can create a temporary public download link for an Android App Bundle and use it with services such as Telegram or an internal API.

Prerequisites

Before running the script:

• Make sure the .aab file is included in the build artifacts.

• Create a Codemagic API token from Account settings > API token.

• Add the token as a secure environment variable named CODEMAGIC_API_TOKEN.

• Add the script to the post-publish script section of the Workflow Editor.

Generate the public AAB URL

Add the following post-publish script:

ARTIFACT_URL=$(echo "$CM_ARTIFACT_LINKS" |
  jq -r '.[] | select(.name | endswith(".aab")) | .url' |
  head -1)

if [[ -z "$ARTIFACT_URL" || "$ARTIFACT_URL" == "null" ]]; then
  echo "No AAB artifact was found."
  exit 1
fi

if [[ "$(uname)" == "Darwin" ]]; then
  expiration_timestamp=$(date -v+3d +%s)
else
  expiration_timestamp=$(date -d "+3 days" +%s)
fi

response=$(curl -s \
  -H "Content-Type: application/json" \
  -H "x-auth-token: $CODEMAGIC_API_TOKEN" \
  -d "{\"expiresAt\": $expiration_timestamp}" \
  -X POST "$ARTIFACT_URL/public-url")

public_url=$(echo "$response" | jq -r '.url')

if [[ -z "$public_url" || "$public_url" == "null" ]]; then
  echo "Failed to generate the public URL."
  echo "$response"
  exit 1
fi

echo "Public AAB URL: $public_url"

The generated link in public_url will remain valid for three days.

Platform-specific date syntax

The command used to calculate the expiration timestamp differs depending on the build machine.

For macOS:

date -v+3d +%s

For Linux:

date -d "+3 days" +%s

An error such as:

date: invalid option -- 'v'

means that the macOS syntax is being used on a Linux build machine.

Troubleshooting

If no public URL is generated:

• confirm that the build produced an .aab file;

• confirm that the AAB is included in the build artifacts;

• print CM_ARTIFACT_LINKS to verify that it contains the AAB:

echo "$CM_ARTIFACT_LINKS" | jq .

• verify that CODEMAGIC_API_TOKEN is available to the script;

• inspect the API response:

echo "$response"

Security

The generated link is public. Anyone with the URL can download the AAB until the expiration time is reached. Avoid publishing it in publicly accessible logs or channels.