What are Template Credentials?
Template Credentials are access credentials for storage providers, such as Amazon S3 or Google Cloud Storage, stored securely in a Transloadit Workspace. Multiple Templates can reference the same credential record.
How Template Credentials work
Template Credentials are reusable Workspace-side secret records that Robots can reference when they need to read from or write to an external storage service. References work in inline Assembly Instructions as well as saved Templates. The workflow stores an indirection to the credential instead of embedding provider keys in Assembly Instructions or browser code. Access still depends on the external provider’s permissions, expiration rules, and resource policies. They connect Transloadit’s execution environment to storage operations and therefore require dependency tracking, least-privilege scoping, and planned rotation.
Key facts
- One credential record may be shared by several Templates, which simplifies rotation but turns its deletion, expiration, or permission loss into a multi-workflow failure domain.
- A successful credential lookup does not guarantee an operation will succeed: bucket policy, object path, region, provider-side role, and allowed actions can independently deny access.
- Credential references avoid embedding provider secrets in submitted Instructions. Provisioning, credential retrieval, and diagnostics still need redaction to keep secrets out of logs and error reports, and Collaborators with Workspace access need appropriately limited privileges.
When Template Credentials matter
Reuse Template Credentials when several workflows need the same storage access, reducing duplicated secret configuration. References work in saved Templates and inline Instructions. Rotate or replace them carefully because one change may disrupt every dependent workflow.