LiveKit Cloud Egress — Keyless GCS Authentication Support

Getting Started
1

Hello LiveKit Team,

We are integrating LiveKit Cloud Egress into Lumivo to record live broadcasts and store the recordings in a private Google Cloud Storage (GCS) bucket.

Our backend uses Firebase Cloud Functions (Node.js 24) and livekit-server-sdk 2.18.0.

We have configured a dedicated Google Cloud service account with bucket-scoped Storage Object Creator permissions.

We would like to clarify the following:

  1. Does LiveKit Cloud Egress support keyless GCS authentication using Google Cloud Workload Identity Federation or another supported mechanism?

  2. If keyless authentication is not supported, is a service-account JSON key required for the GCPUpload credentials field?

  3. What is the recommended production approach for securely storing, supplying, and rotating these credentials?

We want to avoid long-lived service-account keys wherever possible while maintaining secure, private recording storage.

Thank you,

2

Hi, did you see this?

So, the service account JSON file would be the recommended approach (your point 2)

If you are starting the egress from your server via StartEgress these credentials would be stored on your side. Pass the credentials into the storage parameter of StartEgress. The structure to pass is defined here: