S3-compatible storage providers

Configure the shared settings in S3-compatible storage, then use the section for your storage service to set its endpoint and authentication options.

The authentik project does not test releases against every service listed on this page. S3 implementations differ, so verify uploads, downloads, deletes, and generated file URLs with your selected service before using it in production.

Amazon S3

Use Amazon S3 as the storage backend for authentik files without configuring a custom endpoint.

Set the bucket's region and do not set AUTHENTIK_STORAGE__S3__ENDPOINT:

AUTHENTIK_STORAGE__S3__REGION=<region>

If authentik runs on AWS with an instance role, task role, web identity, or AWS profile, you can omit AUTHENTIK_STORAGE__S3__ACCESS_KEY and AUTHENTIK_STORAGE__S3__SECRET_KEY.

For details about creating a bucket and credentials, see the Amazon S3 documentation.

Cloudflare R2

Use Cloudflare R2 as an S3 storage backend for authentik by connecting to R2's S3-compatible API.

Set the endpoint for your Cloudflare account and use the auto region:

AUTHENTIK_STORAGE__S3__ENDPOINT=https://<account_id>.r2.cloudflarestorage.com
AUTHENTIK_STORAGE__S3__REGION=auto

For details about API credentials and jurisdiction-specific endpoints, see the Cloudflare R2 S3 API documentation.

Backblaze B2

Use Backblaze B2 as an S3 storage backend for authentik by connecting to the Backblaze S3-compatible API.

Set the endpoint and region that Backblaze displays for your bucket:

AUTHENTIK_STORAGE__S3__ENDPOINT=https://s3.<region>.backblazeb2.com
AUTHENTIK_STORAGE__S3__REGION=<region>

Use the application key ID as AUTHENTIK_STORAGE__S3__ACCESS_KEY and the application key as AUTHENTIK_STORAGE__S3__SECRET_KEY. Backblaze supports signature version 4, which is the authentik default.

For details about supported operations and credentials, see the Backblaze B2 S3-compatible API documentation.

Wasabi

Use Wasabi as an S3 storage backend for authentik by connecting to Wasabi's S3-compatible API.

Set the endpoint and region that match the bucket's location:

AUTHENTIK_STORAGE__S3__ENDPOINT=https://s3.<region>.wasabisys.com
AUTHENTIK_STORAGE__S3__REGION=<region>

For the current list of service URLs, see Wasabi storage region endpoints.

Google Cloud Storage

Use Google Cloud Storage as an S3 storage backend for authentik by connecting to its XML API interoperability layer.

Create a hash-based message authentication code (HMAC) key for a service account, then configure the XML API endpoint:

AUTHENTIK_STORAGE__S3__ENDPOINT=https://storage.googleapis.com

Use the HMAC access ID as AUTHENTIK_STORAGE__S3__ACCESS_KEY and the HMAC secret as AUTHENTIK_STORAGE__S3__SECRET_KEY.

For details about creating and managing keys, see the Google Cloud Storage HMAC key documentation.

Garage

Use Garage as a self-hosted S3 storage backend for authentik by connecting to its S3-compatible API.

Set the endpoint and region from the Garage s3_api configuration:

AUTHENTIK_STORAGE__S3__ENDPOINT=https://<garage_s3_endpoint>
AUTHENTIK_STORAGE__S3__REGION=<garage_s3_region>

For details about creating a bucket and key, see the Garage documentation.

SeaweedFS

Use SeaweedFS as a self-hosted S3 storage backend for authentik by connecting to the SeaweedFS S3 API.

Set the public endpoint for your SeaweedFS S3 service:

AUTHENTIK_STORAGE__S3__ENDPOINT=https://<seaweedfs_s3_endpoint>

For details about configuring the S3 service and credentials, see the SeaweedFS S3 API documentation.