diff --git a/.speakeasy/in.openapi.yaml b/.speakeasy/in.openapi.yaml
index 78b9926d..05f17e65 100644
--- a/.speakeasy/in.openapi.yaml
+++ b/.speakeasy/in.openapi.yaml
@@ -20691,6 +20691,25 @@ components:
             accessKeyId:
               minLength: 1
               type: 'string'
+              visibleWhen:
+                - field: 'authMode'
+                  in:
+                    - 'access_keys'
+                    - ''
+            authMode:
+              default: 'access_keys'
+              description: 'IAM role: OpenRouter assumes a role in your AWS account with short-lived STS credentials, so you don''t share long-lived keys.'
+              enum:
+                - 'access_keys'
+                - 'iam_role'
+              optionLabels:
+                access_keys: 'Access keys'
+                iam_role: 'IAM role'
+              type: 'string'
+              visibleWhen:
+                - field: 'provider'
+                  in:
+                    - 'aws'
             bucketName:
               minLength: 1
               type: 'string'
@@ -20698,6 +20717,24 @@ components:
               description: 'Only for S3-compatible services like Cloudflare R2 (https://account-id.r2.cloudflarestorage.com) or MinIO. Leave blank for standard AWS S3.'
               format: 'uri'
               type: 'string'
+              visibleWhen:
+                - field: 'provider'
+                  in:
+                    - 'cloudflare_r2'
+                    - 'gcs'
+                    - 'other'
+                    - ''
+            externalId:
+              description: 'Generated by OpenRouter when you save. Require it as sts:ExternalId in your role''s trust policy.'
+              readOnly: true
+              type: 'string'
+              visibleWhen:
+                - field: 'provider'
+                  in:
+                    - 'aws'
+                - field: 'authMode'
+                  in:
+                    - 'iam_role'
             headers:
               additionalProperties:
                 type: 'string'
@@ -20710,17 +20747,50 @@ components:
             prefix:
               default: 'openrouter-traces'
               type: 'string'
+            provider:
+              description: 'The object storage service that hosts the bucket. AWS S3 supports IAM role authentication; the other providers use access keys.'
+              enum:
+                - 'aws'
+                - 'cloudflare_r2'
+                - 'gcs'
+                - 'other'
+              optionLabels:
+                aws: 'AWS S3'
+                cloudflare_r2: 'Cloudflare R2'
+                gcs: 'Google Cloud Storage'
+                other: 'Other S3-compatible'
+              type: 'string'
             region:
+              description: 'Required for IAM role authentication. With access keys, AWS S3 detects the bucket region when you leave this blank.'
+              type: 'string'
+            roleArn:
+              description: 'The IAM role in your account that OpenRouter assumes. Its trust policy must allow sts:AssumeRole from arn:aws:iam::536697249728:role/openrouter-broadcast-exporter and require the external ID below, and its permissions must allow s3:PutObject on the bucket and prefix (plus kms:GenerateDataKey for SSE-KMS buckets).'
+              pattern: '^arn:aws(?:-[a-z]+)*:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$'
               type: 'string'
+              visibleWhen:
+                - field: 'provider'
+                  in:
+                    - 'aws'
+                - field: 'authMode'
+                  in:
+                    - 'iam_role'
             secretAccessKey:
               minLength: 1
               type: 'string'
+              visibleWhen:
+                - field: 'authMode'
+                  in:
+                    - 'access_keys'
+                    - ''
             sessionToken:
               type: 'string'
+              visibleWhen:
+                - field: 'authMode'
+                  in:
+                    - 'access_keys'
+                    - ''
           required:
             - 'bucketName'
-            - 'accessKeyId'
-            - 'secretAccessKey'
           type: 'object'
         created_at:
           description: 'ISO timestamp of when the destination was created.'