Ideally it'd work where they generate a URL for you that works for 24 hours or something like that, or they give you a one time url, but you can generate as many as you'd like for 24 hours. If for instance they see someone generate 100 or 1000 or something they can then revoke their permissions.