Import from a link

Instead of uploading a file, you can paste a link and let Hushscript fetch the recording for you. This page explains what our fetcher does, so that anyone seeing it in their server logs knows exactly who is asking and why.

Our fetcher identifies itself

Every request we make on your behalf carries this User-Agent:

HushscriptFetcher/1.0 (+https://hushscript.com/url-import)

We never disguise the fetcher as a browser and we never work around a site that turns us away.

Every request is signed

Each request also carries an Ed25519 signature over its own target, using the Web Bot Auth scheme built on RFC 9421 HTTP Message Signatures. That lets you confirm a request really came from us rather than from someone borrowing our name in a User-Agent string. The signature points at our key directory:

Signature-Agent: "https://hushscript.com"

The public keys are published, and signed with the same key, at /.well-known/http-message-signatures-directory. That document also states, in machine-readable form, everything this page says in prose: who we are, how to reach us, and which robots.txt directives we honour.

What we request

• HTTPS only. We do not follow plain http:// links.
• A ranged GET where possible. For a preview we ask for the first few megabytes and stop. If your server does not support range requests, we make an ordinary request and stop reading once we have enough.
• Audio only. Recordings up to 10 hours long. Video links are declined – download the video and upload it in the app, where the audio is extracted on your own device.
• A few requests per import. We send a small probe request to check the file, then fetch it. We do not crawl your site, we do not index it, and we never revisit a URL on our own schedule. One exception: a Google Drive share link sometimes serves a confirmation page instead of the file, and we follow that page’s own download link.
• A modest rate. We aim to stay under one request a second to any single site, and never above ten.

Which links work

• Direct links to an audio file.
• Dropbox, Google Drive and OneDrive share links, as long as sharing is set to anyone with the link. We rewrite them to their direct-download form for you.
• Links behind a sign-in, a paywall, or a bot challenge cannot work: the server sends us a web page instead of a recording, and we report the link as unreachable rather than pretending to be someone else.

What we honour in robots.txt

Our RFC 9309 product token is HushscriptFetcher.

• Rules addressed to us are obeyed in full. A group naming HushscriptFetcher — or just Hushscript — applies exactly as written: Disallow stops us, Allow re-opens a path.
• Crawl-delay is obeyed from any group, including User-agent: *. A delay costs a visitor a slower import and costs you nothing, so we take the wildcard’s word for it. If the wait is longer than a single import can sit through, we stop and tell the visitor why.
• Wildcard Disallow rules are not applied. The fetcher is not a crawler: it reads one file, once, because someone signed in asked it to. The blanket crawler rules on the large file-sharing hosts exist to keep search indexes out of share links, and honouring them would break the very links people paste. If you want us gone, name us — it takes one line, below.
• If your robots.txt cannot be reached at all, we proceed. We would rather not fail someone’s import because a server had a bad minute.

If you host files and see our fetcher

The fetcher only ever arrives because one of your visitors pasted a link to your file into Hushscript. It reads that one file and nothing else.

To stop it, name us in robots.txt:

User-agent: HushscriptFetcher
Disallow: /

Blocking the User-Agent at your edge works too. Either way your visitor gets a clear message asking them to download the file and upload it themselves, rather than a broken link.

Questions or a report of misbehaviour: support@hushscript.com.