Secret URLs ("anyone with the link can access") are a weak form of capabilities. They are problematic since they can't be traced nor revoked. A good capability system allows you to audit where the capability has gone and revoke it from specific parties without revoking it from everybody. A good capability system also makes capabilities harder to "leak" accidentally, while still allowing them to be transferred intentionally.

For an example of capabilities that can't leak, look at Unix file descriptors. A process can transfer a file descriptor to another process via an SCM_RIGHTS message over a unix domain socket. The receiving process is able to perform exactly the same set of operations on the file descriptor as the sending process could, even if the receiving process belongs to a different user who doesn't have permission to open() the underlying file. Thus the FD is like a capability.

File descriptors are not secret tokens -- they are easily-guessable small integers. But they cannot accidentally "leak" between processes because the OS explicitly involved in all transfers.

(Of course, file descriptors still lack traceability and revocability, which a good capability system should support.)