Security Token Service (STS)

The MinIO Security Token Service (STS) APIs allow applications to generate temporary credentials for accessing the MinIO deployment.

The STS API is required for MinIO deployments configured to use external identity managers, as the API allows conversion of the external IDP credentials into AWS Signature v4-compatible credentials.

STS API Endpoints

MinIO supports the following STS API endpoints:

EndpointSupported IDPDescription
AssumeRoleWithWebIdentityOpenID ConnectGenerates an access key and secret key using the JWT token returned by the OIDC provider
AssumeRoleWithLDAPIdentityActive Directory / LDAPGenerates an access key and secret key using the AD/LDAP credentials specified to the API endpoint.
AssumeRoleWithCustomTokenMinIO Identity PluginGenerates a token for use with an external identity provider and the MinIO Identity Plugin.
AssumeRoleWithCustomToken

AssumeRoleWithLDAPIdentity

AssumeRoleWithWebIdentity

Security Token Service (STS) for MinIO Operator

Last modified August 2, 2026: init commit (8338d5b)

Portions of this page are adapted from the MinIO Object Storage Documentation, © 2020–Present MinIO, Inc., licensed under CC BY 4.0, converted and maintained by the Silo project. Attribution