Audio storage

Some cloud services, Fireflies.ai for one, can't take an audio file from your Mac. They only download it from a web address. Audio storage is a place you own where MacParsley leaves a recording for a few minutes so the service can fetch it.

The recording goes up, MacParsley gives the service a signed link that expires, and the file is deleted again once the service has it. A private bucket is all you need: the link itself carries the permission.

The services

Any storage that speaks the S3 protocol works. MacParsley has a setup for each of:

Service	Notes
Cloudflare R2	A free allowance, and no charge for downloads. Simplest to start with.
Amazon S3	Needs an IAM user limited to one bucket (see below).
Backblaze B2	A private bucket and an application key limited to it.
Wasabi	A bucket and an access key.
Other S3-compatible	Any service with an S3 address.

You can set up all of them and choose which to use where it's needed (for Fireflies, in its form).

Set one up

Open Settings → Recording → Third Party Integrations → Audio Storage → Set Up… (or Configure…), choose the service in the list, and fill in:

Field	What to enter
Endpoint	The service's S3 address, without `https://` or the bucket name. For R2 it's `ACCOUNT-ID.r2.cloudflarestorage.com`; for Amazon `s3.REGION.amazonaws.com`.
Region	R2: `auto`. Amazon: the bucket's region, such as `us-east-2`.
Bucket	The bucket's name.
Access Key ID and Secret Access Key	From the service. The secret is kept in your Keychain.
Remove audio after processing	On (the default): the temporary copy is deleted from the bucket as soon as the service has it. Off: it stays until you delete it (it may add to your storage bill). A copy that wasn't used because a job failed or was stopped is always deleted.

Click Test Connection. MacParsley puts a small test file in the bucket, downloads it through a signed link the way a service would, and deletes it. A green Works means it's ready. Click Save.

Audio storage settings

Cloudflare R2

In Cloudflare open R2 Object Storage and Create bucket (leave it private).
Open Manage API Tokens → Create Account API Token, choose Object Read & Write, and limit it to that bucket.
Cloudflare shows the Access Key ID and Secret Access Key once: copy both. The endpoint is your account's R2 address.

Amazon S3

Create a private bucket (leave Block all public access on).
In IAM create a user with an access key. Give it an inline policy for just that bucket, with your bucket name in the place shown:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/*"
    }
  ]
}

If the test fails

Message	What it means
didn't accept the keys (SignatureDoesNotMatch)	The secret key, region or bucket name is wrong, or has a stray space or slash. Create a new access key and paste it again.
The keys are valid, but they aren't allowed to write to this bucket (AccessDenied)	The user needs permission on the bucket (the policy above), or another rule denies it.
couldn't find the bucket	Check the bucket's name and the endpoint.

Privacy

Audio is only ever placed here when you've chosen a service that needs it, and MacParsley asks before it first does. Anyone holding the signed link can download that one file until it expires (an hour), so use a private bucket and keep Remove audio after processing on unless you have a reason.