Tigris Authentication

generated: '2026-07-21'
method: searched
source: https://www.tigrisdata.com/docs/iam/ + https://www.tigrisdata.com/docs/sdks/tigris/ + https://console.storage.dev
docs: https://www.tigrisdata.com/docs/iam/
summary:
  types: [apiKey, awsSignatureV4]
  api_key_in: [header]
  model: S3 access key / secret access key signed with AWS Signature Version 4
schemes:
- name: AWSAccessKey
  type: apiKey
  description: >-
    S3-style access key ID and secret access key. Credentials are generated in
    the Tigris console (https://console.storage.dev) and passed via the standard
    AWS environment variables (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY) or SDK
    credential providers. Requests are signed with AWS Signature Version 4
    against the endpoint https://t3.storage.dev (region "auto").
  in: header
  scheme: aws-sigv4
  sources: [https://www.tigrisdata.com/docs/sdks/tigris/, https://www.tigrisdata.com/llms.txt]
access_control:
  model: IAM
  docs: https://www.tigrisdata.com/docs/iam/
  description: >-
    Tigris provides IAM with users, roles, and bucket policies. Access keys can
    be scoped to roles (e.g. Editor, ReadOnly) and to specific buckets, including
    per-fork scoped credentials created by the agent-kit.
  roles_observed: [Editor]
notes:
- For MCP clients, Tigris publishes mcp-oidc-provider, a vendor-neutral OIDC layer between MCP clients and an upstream IdP (Auth0/Clerk/Okta).
- No OAuth2 authorization-code flow is used for the core storage (S3) API; it is access-key based, so no scopes/ artifact applies.