### Answer
Retell AI's recording URLs are not currently protected by API key authentication [(1) ](
) . While you can enable secure URLs that expire after 24 hours [(2) ](
) , these URLs still don't require authentication to access before expiration [(1) ](
) .
To maintain access to recordings and transcripts while adding proper authentication, you'll need to implement your own secure storage solution:
1. **Download and store recordings yourself**: Use webhook events (call_ended or call_analyzed) to receive the recording URL [(3) ](
) , then immediately download and store recordings in your own secure infrastructure where you control access [(1) ](
) .
2. **Remove recordings from Retell**: After downloading, you can use the update-call API to remove the recording URL from Retell's system . This makes the original URL inaccessible.
3. **Alternative: Use Data Storage Settings**: Configure your agent's Data Storage Settings to "Basic Attributes Only" [(4) ](
) . This prevents Retell from storing transcripts, recordings, and logs entirely . However, you can still access this data through webhook events where the call recording link expires after 10 minutes .
The webhook approach allows you to capture recordings before they're deleted while implementing your own authentication layer. Note that even with "Basic Attributes Only" selected, recordings are still temporarily created for up to 10 minutes before deletion [(5) ](