Do not treat the attachment URL currently returned by the Busabase API as a permanent public image URL. The Asset ID is the durable reference; the download URL is resolved from the current storage backend and may be a time-limited signed URL or change when storage configuration changes. Hard-coding one returned URL into an external site's img src can leave broken images later.
For images restricted to authorized visitors, keep the assetId in your site data. Have the server request a current Asset download URL or proxy the bytes after checking the visitor's access; never put a Busabase API key in browser code. Possessing an Asset ID alone does not grant access to a private workspace image. For product images intended to be public to everyone, publish a copy to a deliberately public media/CDN location and use that URL on the site, while deciding how updates and cache invalidation work. Public forum attachment URLs are a different sharing surface from private workspace Assets.
Are these images public to all website visitors, or only to signed-in customers? We have recorded a managed, stable public Asset link as a separate product request. The Chinese discussion covers the same distinction.