Attaching images to PRs

[iboutle]

When you attach an image to a PR, using the paperclip icon in the edit screen, it embeds the image in the PR page as follows:
<img width="768" height="669" alt="Screenshot from 2026-07-23 16-37-24" src="https://github.com/user-attachments/assets/cc9146a0-1ed9-4fd9-9738-367ba171214f" />

This shows a thumbnail of the image on the PR page. But if you try to click on the image to enlarge it, this appears to only work for the ticket author. The link that is followed by clicking is:

• https://private-user-images.githubusercontent.com/135141261/625803914-cc9146a0-1ed9-4fd9-9738-367ba171214f.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODY3MjA5NzksIm5iZiI6MTc4NjcyMDY3OSwicGF0aCI6Ii8xMzUxNDEyNjEvNjI1ODAzOTE0LWNjOTE0NmEwLTFlZDktNGZkOS05NzM4LTM2N2JhMTcxMjE0Zi5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwODE0JTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDgxNFQxNTE3NTlaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1hYjBkNjdiMzczNjg2NzJjODdkYmJiN2IyN2VmMjU0ZmNmNGUxNzY5NzFhMzc2MzQyYzU4YTBlY2VkNDQ2ZjY1JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ.6QF67nUx0G9ahzGilbLkGv5H1p9kiJzCHX6pKd5sqYo

which works fine for me, but not for my science reviewer. However, the link that is embedded in the PR above:

• https://github.com/user-attachments/assets/cc9146a0-1ed9-4fd9-9738-367ba171214f

works fine for anyone.

Does anyone understand what is going on, or know how to attach an image to a PR with a clickable link to enlarge it?

[James Frost (jfrost-mo)]

This is due to the way GitHub hosts images uploaded to PRs and issues. They are uploaded into an S3 bucket (a type of cloud storage) and then accessed by a time-limited URL that is generated when you load the page; therefore anyone, including yourself, won't be able to use the same link after it has expired.

The shorted user-attachments link is actually a redirect which checks your GitHub credentials and generates a fresh time-limited URL if you have the appropriate access (such as for issues on private repositories).

That long time-limited URL contains a JSON Web Token (JWT) which is used to control access. We can decode it to get the following claims:

{
    "iss": "github.com",
    "aud": "raw.githubusercontent.com",
    "key": "key5",
    "exp": 1786720979,
    "nbf": 1786720679,
    "path": "/135141261/625803914-cc9146a0-1ed9-4fd9-9738-367ba171214f.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20260814%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260814T151759Z&X-Amz-Expires=300&X-Amz-Signature=ab0d67b37368672c87dbbb7b27ef254fcf4e176971a376342c58a0eced446f65&X-Amz-SignedHeaders=host&response-content-type=image%2Fpng"
}

The important thing there is the exp key, which is the time when the URL expires as a UNIX style timestamp. This corresponds to five minutes after you loaded the page, after which the link won't work any more. You can test this yourself by opening a page, waiting 6 minutes, then trying to click on an image to open it separately; You'll get a 404 page as the link will have expired.

As for what you should do it depends on your exact needs. If you just want to link things in Issues and Pull Requests so others can see them you are probably better off linking to the comment containing the image in the pull request; you can click on the ... in the top corner and "Copy link" to get a link straight to that comment. If you have other needs (such as sharing in external reports and such) then you may be better served by hosting the images elsewhere, or copying them to be directly embedded.