# LiveKit Cloud Egress — Keyless GCS Authentication Support

**URL:** <https://community.livekit.io/t/livekit-cloud-egress-keyless-gcs-authentication-support/2183>\
**Category:** Getting Started\
**Tags:** livekit-cloud\
**Created:** [October 3, 2026, 9:39am UTC](https://community.livekit.io/t/livekit-cloud-egress-keyless-gcs-authentication-support/2183 "2026-10-03T09:39:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sachin\_Sigamani](https://sea1.discourse-cdn.com/flex001/user_avatar/community.livekit.io/sachin_sigamani/32/2229_2.png) [@Sachin\_Sigamani](https://community.livekit.io/u/Sachin_Sigamani)\
**Post date:** [October 3, 2026, 9:39am UTC](https://community.livekit.io/t/livekit-cloud-egress-keyless-gcs-authentication-support/2183/1 "2026-10-03T09:39:36Z")

</div>

Hello LiveKit Team,

We are integrating LiveKit Cloud Egress into Lumivo to record live broadcasts and store the recordings in a private Google Cloud Storage (GCS) bucket.

Our backend uses Firebase Cloud Functions (Node.js 24) and livekit-server-sdk 2.18.0.

We have configured a dedicated Google Cloud service account with bucket-scoped Storage Object Creator permissions.

We would like to clarify the following:

1. Does LiveKit Cloud Egress support keyless GCS authentication using Google Cloud Workload Identity Federation or another supported mechanism?

2. If keyless authentication is not supported, is a service-account JSON key required for the GCPUpload credentials field?

3. What is the recommended production approach for securely storing, supplying, and rotating these credentials?

We want to avoid long-lived service-account keys wherever possible while maintaining secure, private recording storage.

Thank you,

---

<div class="post-metadata">

**Author:** ![darryncampbell](https://sea1.discourse-cdn.com/flex001/user_avatar/community.livekit.io/darryncampbell/32/20_2.png) [@darryncampbell](https://community.livekit.io/u/darryncampbell)\
**Post date:** [October 5, 2026, 8:36am UTC](https://community.livekit.io/t/livekit-cloud-egress-keyless-gcs-authentication-support/2183/2 "2026-10-05T08:36:47Z")

</div>

Hi, did you see this?

> **[Google Cloud Storage - Output and streaming options | LiveKit Documentation](https://docs.livekit.io/transport/media/ingress-egress/egress/outputs/#google-cloud-storage)**
>
> The following table shows the supported output types for each egress source. | Export content anywhere, in any format.

So, the service account JSON file would be the recommended approach (your point 2)

> [@Sachin\_Sigamani](#):
>
> 1. What is the recommended production approach for securely storing, supplying, and rotating these credentials?

If you are starting the egress from your server via `StartEgress` these credentials would be stored on your side. Pass the credentials into the `storage` parameter of `StartEgress`. The structure to pass is defined here:

> **[GCPUpload - Egress API | LiveKit Documentation](https://docs.livekit.io/reference/other/egress/api/#gcpupload)**
>
> The Egress API is available within our server SDKs and CLI: | Use LiveKit's egress service to record or livestream a Room.

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex001/user_avatar/community.livekit.io/system/32/26_2.png) [@system](https://community.livekit.io/u/system)\
**Post date:** [October 20, 2026, 8:37am UTC](https://community.livekit.io/t/livekit-cloud-egress-keyless-gcs-authentication-support/2183/3 "2026-10-20T08:37:07Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.