Return the proof image bytes inline.This avoids handing the browser a presigned URL whose host the browser may not be able to reach (MinIO behind a path-rewriting proxy) and whose signature can't survive URI rewriting. The merchant is already authenticated via httpOnly cookie; we re-validate the proof belongs to this store and stream the bytes.A short private cache lets the merchant scroll back to a proof they just viewed without a fresh fetch, while keeping the bytes out of any shared cache.
Request
Authorization
Bearer Token
Provide your bearer token in the
Authorization
header when making requests to protected resources.