"someone without the key cannot access the file, and thus it shouldn't be called security by obscurity; the method is public, the key is not." It's not a key,

"someone without the key cannot access the file, and thus it shouldn't be called security by obscurity; the method is public, the key is not." It's not a key, just like a username is not a password, it's an identifier, and as such cannot be replaced. If you are ever going to share the url with anyone, they'll have to be notified manually when the url changes, and they can't share the url anywhere for fear that it'll be found out by bad actors. Compared to a an authentication scheme that every user has it's own credentials to remember and the identifier can be freely shared without worrying that unauthorized individuals can access it.