where do I change egress s3 credentials?

Thanks for reaching out, taeun. I'm an AI assistant and I'm here to help. Give me a moment while I research this topic.

where can I update the s3 egress credentials from dashboard settings?

Thanks — you're asking where in the dashboard you can update S3 egress credentials. You cannot update S3 egress credentials directly from the LiveKit dashboard. S3 credentials for egress are provided in the egress request (for a single job) or managed via agent/project secrets or assume-role configuration: • To set credentials per egress job: include

AccessKey

,

Secret

,

Bucket

, and

Region

in the egress request (e.g.,

EncodedFileOutput_S3

/

S3Upload

). • To avoid long‑lived keys and use IAM roles: enable AWS Assume Role for the project (

s3_assume_role_enabled=true

, set

s3_assume_role_arn

and

s3_assume_role_external_id

). This is an enterprise-only feature that must be enabled per project. • If you run the LiveKit agent yourself and store credentials there, you can update them without redeploying using

lk agent update-secrets

. If you’d like, tell me which of these applies to you: • You want to change credentials for a single egress job (I can show the request fields). • You’re using a self-hosted agent and want the exact

lk agent update-secrets

steps. • You want to enable enterprise assume-role for your project (I can outline the info needed to request enabling it). Which path should I walk you through? , with interactive elements

can you show me example structure?

Thanks — you want an example structure for specifying S3 egress credentials. Below are two common patterns: (A) passing credentials directly in an egress request (per-job), and (B) using AWS Assume Role (enterprise) where you leave keys blank and the project is configured to assume an IAM role. A. Example: S3 credentials included in a RoomCompositeEgressRequest (per-job)

{
  "room": "my-room",
  "output": {
    "encoded_file": {
      "file_name": "meeting_recording.mp4",
      "s3": {
        "access_key": "AKIA....",
        "secret": "your-secret-key",
        "bucket": "my-egress-bucket",
        "region": "us-west-2",
        "path": "recordings/2026/03/meeting_recording.mp4"
      }
    }
  }
}

• Set

access_key

and

secret

to the AWS access key and secret for the target S3 bucket. • Set

bucket

,

region

, and optional `path`/`file_name` for destination control. B. Example: Use AWS Assume Role (enterprise) — omit keys in the request

{
  "room": "my-room",
  "output": {
    "encoded_file": {
      "file_name": "meeting_recording.mp4",
      "s3": {
        "bucket": "my-egress-bucket",
        "region": "us-west-2",
        "path": "recordings/2026/03/meeting_recording.mp4"
      }
    }
  }
}

• Do not include

access_key

or

secret

in the request. • The project must have these feature flags set:

s3_assume_role_enabled=true

,

s3_assume_role_arn=<role-arn>

, and

s3_assume_role_external_id=<external-id>

. • This is an enterprise-only feature that must be enabled per project. C. If you store credentials in the LiveKit agent (self-hosted) • Update stored secrets with:

lk agent update-secrets

(this applies new credentials and restarts the agent). • After updating, future egress requests that rely on the agent’s stored S3 config will use the new credentials. If you want, I can: • Show the exact request structure for the SDK or API you’re using (HTTP/REST, Go, or Node). • Provide the

lk agent update-secrets

command example and expected prompts if you’re self-hosted. Which would you like next? , with interactive elements

I am saving s3 credential in secrets manager aws

Thanks — helpful to know you’re storing S3 credentials in AWS Secrets Manager. I’ll show recommended patterns for using those secrets with LiveKit egress and give examples you can adapt. Quick question before I dive in: are you using LiveKit Cloud (agent managed by LiveKit) or a self-hosted LiveKit agent that you control? The exact steps differ slightly. Below are two recommended approaches depending on your setup. 1) Self-hosted LiveKit agent (you control the agent) • Store the S3 access key/secret (and optionally bucket/region) in AWS Secrets Manager. • On the machine running the LiveKit agent, retrieve those secrets (e.g., via the AWS SDK or aws-cli) and write them to the agent’s secret store. • Use the command to update agent secrets so the agent picks up new credentials without a full redeploy: ◦ Run:

lk agent update-secrets

(this applies new secret values and restarts the agent). • Future egress jobs that rely on the agent’s stored S3 config will use the updated credentials. Example flow (pseudo-steps): 1. Fetch secret with aws-cli:

aws secretsmanager get-secret-value --secret-id my/livekit/s3-creds --query SecretString --output text

1. Parse the JSON for

access_key

and

secret

. 2. Provide those values to the agent’s secret store (the

lk agent update-secrets

workflow will prompt or accept configured inputs depending on your deployment). 3. Confirm the agent restarted and test an egress job. 2) LiveKit Cloud or when including credentials per egress job • Instead of relying on the dashboard, embed the S3 credentials in each egress request by reading them from Secrets Manager at the moment you start the job. • Your application retrieves the secret, then constructs the egress request with

access_key

and

secret

in the `s3`/`S3Upload` object. Example JSON (per-job, after reading from Secrets Manager):

{
  "room": "my-room",
  "output": {
    "encoded_file": {
      "file_name": "meeting_recording.mp4",
      "s3": {
        "access_key": "AKIA....",
        "secret": "your-secret-key",
        "bucket": "my-egress-bucket",
        "region": "us-west-2",
        "path": "recordings/2026/03/meeting_recording.mp4"
      }
    }
  }
}

Best practices & security notes • Prefer short-lived credentials or assume-role patterns instead of long-lived access keys. • If possible use AWS Assume Role: ◦ Leave

access_key

and

secret

out of the egress request. ◦ Configure the project/agent with

s3_assume_role_enabled=true

,

s3_assume_role_arn

, and

s3_assume_role_external_id

so the agent can assume a role and obtain temporary credentials. ◦ Assume-role is an enterprise feature that must be enabled per project. • Rotate secrets in Secrets Manager and verify the agent or your code fetches the latest value when starting egress jobs. If you tell me which environment you’re on (self-hosted agent vs LiveKit Cloud) and which language/SDK you use (Node, Go, Python, or direct REST), I’ll give a concrete example showing: • exact aws-cli or SDK commands to fetch the secret, and • the egress request body or

lk agent update-secrets

usage adapted to your environment., with interactive elements