diff --git a/src/storage/caas.js b/src/storage/caas.js
index f333df879..671942617 100644
--- a/src/storage/caas.js
+++ b/src/storage/caas.js
@@ -79,19 +79,28 @@ function getBackupUrl(apiConfig, filename, callback) {
     });
 }
 
-function getRestoreUrl(apiConfig, backupId, callback) {
+function getRestoreUrl(apiConfig, filename, callback) {
     assert.strictEqual(typeof apiConfig, 'object');
-    assert.strictEqual(typeof backupId, 'string');
+    assert.strictEqual(typeof filename, 'string');
     assert.strictEqual(typeof callback, 'function');
 
-    var url = config.apiServerOrigin() + '/api/v1/boxes/' + config.fqdn() + '/restoreurl';
+    if (!apiConfig.bucket || !apiConfig.prefix) return new Error('Invalid configuration'); // prevent error in s3
 
-    superagent.put(url).query({ token: config.token(), backupId: backupId }).end(function (error, result) {
-        if (error && !error.response) return callback(error);
-        if (result.statusCode !== 201) return callback(new Error(result.text));
-        if (!result.body || !result.body.url) return callback(new Error('Unexpected response'));
+    getBackupCredentials(apiConfig, function (error, credentials) {
+        if (error) return callback(error);
 
-        return callback(null, { url: result.body.url });
+        credentials.region = apiConfig.region; // use same region as where we uploaded
+        var s3 = new AWS.S3(credentials);
+
+        var params = {
+            Bucket: apiConfig.bucket,
+            Key: apiConfig.prefix + '/' + filename,
+            Expires: 60 * 30 /* 30 minutes */
+        };
+
+        var url = s3.getSignedUrl('getObject', params);
+
+        callback(null, { url: url });
     });
 }
 
diff --git a/src/storage/s3.js b/src/storage/s3.js
index 964efe143..5ac8829d1 100644
--- a/src/storage/s3.js
+++ b/src/storage/s3.js
@@ -90,8 +90,6 @@ function getRestoreUrl(apiConfig, filename, callback) {
     assert.strictEqual(typeof filename, 'string');
     assert.strictEqual(typeof callback, 'function');
 
-    if (!apiConfig.bucket || !apiConfig.prefix) return new Error('Invalid configuration'); // prevent error in s3
-
     getBackupCredentials(apiConfig, function (error, credentials) {
         if (error) return callback(error);