We have a sequence of IDs, 1, 2, 3, 4... that are references to data. We wish to use these IDs in a URL, however we do not want them to be iterable - that is, given 3, it should not be possible to derive the URL for 2 or 4.
Our proposed solution is to generate the URL as follows:
/<hmac>-<id>/
Where hmac consists of a SHA256 HMAC of the ID using a secret key. We then verify the hmac when the URL is used.