The best practice is to have pre-signed URLs when u have multiple clients and you want to identify them. That means you can have separate services( say API, lambda, we etc) which based on client authentication and authorization will return a single temporary URL for the clients.
Keep Learning :)