Set up S3 upload

You need an S3 bucket and an IAM user whose keys can write to it — and nothing else. About five minutes.

Storage costs roughly $0.023 per GB per month in most regions, so a few hundred recordings cost cents. Downloads are billed separately.

1. Create the bucket

   AWS console › S3 › Create bucket.

   • Name: something unique, e.g. klikat-recordings-yourname
   • Region: the one nearest you — ap-southeast-1 (Singapore), us-east-1 (Virginia)
   • Block all public access: leave it on. Klikat shares recordings with time-limited signed links, so the bucket never needs to be public

   Optional: bucket › Management › Create lifecycle rule with prefix recordings/ to delete recordings automatically after, say, 90 days.

2. Create the policy

   IAM › Policies › Create policy › JSON. Replace YOUR-BUCKET:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "KlikatUploads",
         "Effect": "Allow",
         "Action": ["s3:PutObject", "s3:GetObject"],
         "Resource": "arn:aws:s3:::YOUR-BUCKET/recordings/*"
       }
     ]
   }

   Name it KlikatUploader.

   Why those two actions: PutObject uploads the recording, and GetObject is what makes a signed share link valid — a link only works if the signing user could read the object. The policy covers just the recordings/ folder, with no delete and no list permission, so these keys can't touch anything else. Year/month subfolders are still covered, because the wildcard spans slashes.

3. Create the IAM user

   IAM › Users › Create user, named klikat-uploader. Do not give it console access — it's for the app only. Attach the KlikatUploader policy.

4. Create the access key

   Open the user › Security credentials › Create access key › Application running outside AWS. Copy the Access key ID and Secret access key.

   The secret is shown once. If you lose it, delete that key and create a new one — it takes seconds.

5. Put it into Klikat

   Settings › Upload:

   Field	Value
   Bucket	klikat-recordings-yourname
   Region	ap-southeast-1 (whatever you chose)
   Folder	recordings
   Access key ID	from step 4
   Secret access key	from step 4 — stored in your macOS Keychain
   Custom endpoint	leave empty for AWS

   Turn on "Upload recordings automatically", record something short, and the link lands on your clipboard when it finishes.

The same thing with the AWS CLI

BUCKET=klikat-recordings-yourname
REGION=ap-southeast-1

aws s3api create-bucket --bucket "$BUCKET" --region "$REGION" \
  --create-bucket-configuration LocationConstraint="$REGION"

cat > policy.json <<JSON
{"Version":"2012-10-17","Statement":[{"Effect":"Allow",
 "Action":["s3:PutObject","s3:GetObject"],
 "Resource":"arn:aws:s3:::$BUCKET/recordings/*"}]}
JSON

aws iam create-user --user-name klikat-uploader
aws iam put-user-policy --user-name klikat-uploader \
  --policy-name KlikatUploader --policy-document file://policy.json
aws iam create-access-key --user-name klikat-uploader

Good to know

• Signed links last 7 days at most. That's an AWS limit, not a Klikat choice. For permanent links, turn signed links off and serve the bucket publicly instead.
• Rotate keys occasionally: create a new one, paste it into Klikat, delete the old one. If a key ever leaks, delete it in IAM immediately.
• Not using AWS? Cloudflare R2, Wasabi and MinIO speak the same protocol. Put their host in "Custom endpoint" (e.g. <account-id>.r2.cloudflarestorage.com). R2 has no egress fees, which is worth knowing if people watch your recordings a lot.

Still stuck? Email [email protected].