Write the PDF into a private bucket, then let the Next. js API route hand back a signed download URL that expires in minutes. Use that route for exactly two jobs — authorization and minting the link — and let the object storage vendor move the bytes.
Source: [Dev.to](https://dev.to/ethanbrooks111/private-pdf-downloads-in-nextjs-the-api-route-the-signed-link-the-object-store-3edh)