Sign (file) URLs with userId as payload

[marvin-wtt]

I'd like to be able to ensure that file URLs can only be accessed by a user with sufficient permissions.
Is it possible to sign the URL with the userId or similar as payload and verify that the IDs match before providing a file to a user?

Currently, the URL can be accessed by everyone within the validity time of the signature. This is a problem.

[thetutlage]

You can encode the userId within the URL and then during verification you can manually check that the payload userId matches the user id of the logged-in user.