> Source: https://txtfetch.com/sources/amazon-s3
> Plain-text twin — every page on txtfetch.com has one. https://txtfetch.com/text

---

# Extract text from Amazon S3

Credentials that ride in the query string, not blocked by the SSRF guard. Here's how a document actually gets from Amazon S3 to a txtfetch response.

## The problem

S3 objects are private by default, so a plain object URL returns Access Denied. A presigned URL grants time-limited access instead, using the credentials of whoever generated it. No password ever appears in the URL itself.

?url=, and why

| Pre-authenticated URL? | Yes — a presigned GET URL |
| --- | --- |
| txtfetch path | ?url= |
| Link lifetime | Your choice, set when you sign it |
| The trap | Set the expiry longer than the async job can take, or a slow OCR pass outlives the link. |

A presigned GET URL carries its credentials as query parameters. txtfetch's SSRF guard blocks credentials in a URL's userinfo, not its query string, so ?url= reaches it.

## How it works

Generate a presigned GET URL for the object, with an expiry longer than the extraction can take. Pass that URL straight to txtfetch's ?url= parameter, the same as any other link. The S3-and-Lambda integration guide below wires the same call to an object-created event, so an upload triggers the extraction on its own.

the script

A plain HTTP call against Amazon S3's own REST API, then a plain call to txtfetch. No vendor SDK either side.

Python

```python
import os

import requests

# Generate this with your own AWS credentials — see /integrations/aws-s3-lambda
# for the event-driven version. Set the expiry longer than the job can take.
presigned_url = "https://my-bucket.s3.amazonaws.com/reports/q3.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=3600&X-Amz-Signature=REPLACE_ME"

r = requests.post(
    "https://api.txtfetch.com/v1/extract",
    headers={"Authorization": f"Bearer {os.environ['TXTFETCH_KEY']}"},
    params={"url": presigned_url},
)

print(r.json()["extracted_text"])
```

JavaScript

```javascript
// Generate this with your own AWS credentials — see /integrations/aws-s3-lambda
// for the event-driven version. Set the expiry longer than the job can take.
const presignedUrl =
  "https://my-bucket.s3.amazonaws.com/reports/q3.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=3600&X-Amz-Signature=REPLACE_ME";

const endpoint = new URL("https://api.txtfetch.com/v1/extract");
endpoint.searchParams.set("url", presignedUrl);

const res = await fetch(endpoint, {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.TXTFETCH_KEY}` },
});

const { extracted_text } = await res.json();
console.log(extracted_text);
```

txtfetch ships no connector, plugin, or client for Amazon S3. The script above is the whole integration. Fetch the document with Amazon S3's own API, then hand it to txtfetch, the same as any other source of text.

frequently asked questions

**Does txtfetch have an S3 connector?**: No. txtfetch ships no S3 connector or Lambda layer. A presigned URL is already a plain link, so ?url= reaches the object with no extra wiring.

**Isn't a credential in the URL a security risk?**: txtfetch's guard blocks credentials in a URL's userinfo, like https://user:pass@host. A presigned URL's signature lives in the query string instead, which the guard allows.

**What happens if the presigned URL expires mid-request?**: The fetch fails with fetch_failed, the same as any other broken link. Sign the URL for longer than the extraction, especially before an OCR-heavy scan.

sources

-   [AWS: Share objects with presigned URLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html) Accessed 2026-09

## Related

-   [Extract text from S3 uploads with Lambda](https://txtfetch.com/integrations/aws-s3-lambda), the same presigned-URL call, triggered by an object-created event.
-   [Integrations](https://txtfetch.com/integrations), for wiring this into a no-code automation platform instead of a script.
-   [Ingest into a vector store](https://txtfetch.com/ingest), for where the extracted text goes next.
-   [Async jobs & webhooks](https://txtfetch.com/docs/async), for a source that's large or slow to fetch.
-   [Error reference](https://txtfetch.com/docs/errors), for what a failed `?url=` fetch returns.

other sources

-   [Extract text from Google Drive →](https://txtfetch.com/sources/google-drive)
-   [Extract text from SharePoint & OneDrive →](https://txtfetch.com/sources/sharepoint-onedrive)
-   [Extract text from Dropbox →](https://txtfetch.com/sources/dropbox)
-   [Extract text from Confluence →](https://txtfetch.com/sources/confluence)
-   [Extract text from Email inbox →](https://txtfetch.com/sources/email-inbox)
-   [All sources →](https://txtfetch.com/sources)

## Point it at your Amazon S3 files.

Pass a signed URL and the text comes back. There is no connector to install.

[Get an API key →](https://app.txtfetch.com/signup)

[See the URL docs →](https://txtfetch.com/docs)