s3BEARDocs
GitHub← Back to site

LLM Integration Overview

Modern multimodal LLMs — Claude, GPT-4o, Gemini — accept images as HTTPS URLs. That's the fast path: the provider fetches the image directly instead of you shipping base64 bytes on every request. The problem is that your images almost certainly don't live at a public HTTPS URL. They live in a private S3 bucket, because that's where production data belongs.

The bad options

Teams facing this gap usually reach for one of three workarounds:

  • Make the bucket public. Simple, and permanently wrong — now anyone with the object key (or a lucky guess) can read your data forever, with no expiry and no audit trail.
  • Hand-roll presigned URLs. Every script, service, and notebook that needs to talk to an LLM ends up with its own AWS SDK call, its own credential handling, and its own bugs. Presigned URLs also can't be revoked early — once issued, they're valid until they expire, whatever happens next.
  • Proxy through app code. Someone writes a small Flask/Express endpoint that fetches from S3 and streams the bytes back. It works until three more services need the same thing and each reimplements auth, MIME checks, and caching slightly differently.

The s3BEAR answer

s3BEAR sits in front of your S3-compatible backend as the single governed door. For the LLM use case specifically, it lets you mint an expiring, revocable HTTPS share URL for one object and pass that URL straight to an LLM API's image input field:

  • The underlying bucket never changes ACLs and never becomes public.
  • The link works until it expires or you revoke it — after that, every request returns 410 Gone, whether the token was valid, expired, or never existed.
  • You can right-size the image on the fly with query params like ?w=1024&format=webp&q=80 — no separate resize pipeline, no second stored copy — which matters because a 4000×3000 product photo wastes tokens and latency that a 1024px WebP doesn't.

This is built from two pieces that combine for the LLM workflow:

  • Public Share Links (/docs/llm/share-links) — tokenized, expiring, revocable public URLs for individual objects. This is what you hand to the LLM API.
  • Image Serving & Transforms (/docs/llm/image-serving) — the authenticated proxy and on-the-fly resize/re-encode engine that also powers share-link transforms.

Next steps