Transloadit

Third-party Credentials

Transloadit can import files from or export files to your cloud bucket or server. To authenticate, we'll need credentials. For exports, use write-only credentials when possible. You can set these directly in your import and export Robot parameters (often via key and secret), but we recommend that you use Template Credentials instead. With Template Credentials, you store the credentials separately, assign them a unique name, and then refer to them by that name via the credentials Robot Parameter. You can check the individual Robot docs for more information.

We have created Template Credentials, so you can:

  • Keep provider secrets out of the Template JSON you share.
  • Easily reuse your credentials across several Templates.
  • Be more liberal in sending Assembly Instructions directly (without using a Template). Even though Templates are recommended, this allows prototyping without transmitting secrets every time.
  • Revoke leaked credentials and replace them without modifying all your Templates or code.
  • Add tokens. Some cloud providers require an interactive OAuth flow to give Transloadit access. The web interface for Template Credentials supports this.

Here are Assembly Instructions using Template Credentials that were previously saved in your account as my_s3_credentials and my_youtube_credentials. It imports videos from an S3 bucket and uploads them to YouTube as private videos:

{
  "steps": {
    "imported": {
      "robot": "/s3/import",
      "credentials": "my_s3_credentials",
      "path": "/some/path"
    },
    "exported": {
      "robot": "/youtube/store",
      "use": "imported",
      "credentials": "my_youtube_credentials",
      "title": "My processed video",
      "description": "A video processed with Transloadit",
      "category": "science & technology",
      "keywords": "transloadit",
      "visibility": "private"
    }
  }
}

How to create Template Credentials

  1. Go to your Workspace's Credentials page. Select New Credential, or Add new Credential if you have not created any yet.
  2. Choose the provider under Service. Enter a recognizable Name and fill in the provider's fields.
  3. Select Create. When you enter a key or token directly, the Console saves the credential and returns to the Credentials list. When you connect through OAuth, it first sends you to the provider to approve access.

Use the saved name as the credentials value in the appropriate import or export Robot. For required values and provider permissions, see the Google Cloud Storage setup guide, the DigitalOcean Spaces setup guide, or the relevant Robot documentation.

Template Credentials authenticate Transloadit to the provider; they do not authorize your users' uploads. For Auth Key-based browser uploads, authorize requests on your backend and use Signature Authentication, keeping the Auth Secret on the server. Set "allow_steps_override": false in the saved Template when uploaders must not change its Steps.

Vimeo

Vimeo OAuth in the Console works with /vimeo/store for uploads. /vimeo/import requires a personal access token from your own Vimeo app. Vimeo only grants access to other members’ video files to partner OAuth apps, and Transloadit is not a Vimeo partner. Repeating OAuth will not add this permission.

  1. Sign in to developer.vimeo.com/apps with the Vimeo account that owns the videos, and create an app or select your own existing app.
  2. Under Authentication, open Generate Access Token and select Authenticated (you).
  3. Select Public, Private, and Video Files (public, private, and video_files). To also use the token with /vimeo/store, select Upload, Edit, and Interact (upload, edit, and interact) and ensure your app has Vimeo upload access.
  4. Generate and copy the token. In the Console, create a Template Credential, select Vimeo, choose Paste a personal access token, and paste it into Vimeo Access Token.
  5. Save it with a recognizable name, and use that name as your Robot’s credentials value.

Saving verifies your Vimeo account and the token’s scopes. The token is stored as access_token and is never displayed back in the Console. Video downloads still depend on your Vimeo plan and video permissions. Original (source) downloads also require Vimeo to have retained the original upload. See Vimeo’s token guide.

Reconnect Vimeo

Update does not start OAuth again or grant additional scopes. To reconnect, Remove the credential, then create it again using the same name so your Templates continue to reference it. Removing a Vimeo credential revokes its token at Vimeo, including any other use of the same token. Generate a new personal access token before pasting it again. If revocation fails, removal fails and you can retry. You can also replace a token through Update; leave the token field blank to keep the stored token.

Don't give us the keys to your everything

Taking a few security paradigms to heart, we'd like as few privileges as possible to do our work. If you export files to your Amazon S3 bucket, for instance, it's perfectly possible to create an IAM user that only has write access for that. Limiting permissions reduces the damage a leaked key can cause. When a provider combines write access with read or delete access, limit the credential to a dedicated bucket rather than your entire account.

» Learn more about Security