> For the complete documentation index, see [llms.txt](https://docs.whereby.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.whereby.com/whereby-product-features/secure-authentication-for-s3-storage/understanding-authentication-types.md). # Understanding Authentication Types ## Access Key authentication ### Overview Access Key authentication uses long-lived AWS credentials: an **access key ID** and a **secret access key**. These credentials belong to an IAM user or role in your AWS account and are used directly to authenticate requests to S3. ### How it works 1. You create an IAM user or role in AWS. 2. That identity is granted permissions to access the target S3 bucket (for example, `s3:PutObject`, `s3:GetObject`). 3. You generate an access key ID and secret access key. 4. These credentials are stored in your configuration and used whenever recordings or transcriptions are uploaded. ### When to use Access Key auth Access Key authentication is a good fit when: * You want a **simple and familiar setup** * You are working in environments where OIDC is not available * You already manage IAM users and access keys * You are integrating with existing infrastructure that relies on static credentials ### Considerations * Access keys are **long-lived secrets** and must be stored securely * Keys must be **rotated manually** to reduce security risk * If a key is compromised, it must be revoked and replaced ## OIDC (OpenID Connect) authentication ### Overview OIDC authentication allows the system to assume an AWS IAM role using **short-lived credentials**, without storing long-lived secrets. Authentication is based on trust between AWS and an OIDC identity provider. ### How it works 1. You configure an OIDC identity provider in AWS. 2. You create an IAM role that trusts that identity provider. 3. The role is granted permissions to access the S3 bucket. 4. When access to S3 is needed, the system exchanges its OIDC identity for **temporary AWS credentials** by assuming the role. 5. These short-lived credentials are used to upload recordings and transcriptions. ### When to use OIDC auth OIDC authentication is recommended when: * You want **improved security** with no long-lived secrets * You are running in cloud or containerized environments * You want **automatic credential rotation** * You follow modern, least-privilege security practices ### Considerations * Initial setup is more complex than access keys * Requires AWS IAM role and OIDC provider configuration * Not all environments support OIDC out of the box --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.whereby.com/whereby-product-features/secure-authentication-for-s3-storage/understanding-authentication-types.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.