So everything is done between the client app and AWS. Under the hood it is using the AWS SDK. We don't store any keys or any of your data on our servers. So, the user has to have access keys, and they can also have their session token. We also have it setup that it can read from your .aws/credentials file, so if you have a process that automatically updates that file, the session token is also automatically updated in the app.