diff --git a/aruna/api/google b/aruna/api/google
index 4c3b682f..5649269b 160000
--- a/aruna/api/google
+++ b/aruna/api/google
@@ -1 +1 @@
-Subproject commit 4c3b682f501bb965d34c3d4fc3461edfccf962db
+Subproject commit 5649269b4e6d024f45287e1610fb479cf4e726a8
diff --git a/aruna/api/internal/v1/authorize.proto b/aruna/api/internal/v1/authorize.proto
index 6a2f4ad1..7a91daf7 100644
--- a/aruna/api/internal/v1/authorize.proto
+++ b/aruna/api/internal/v1/authorize.proto
@@ -10,6 +10,7 @@ service InternalAuthorizeService {
     option (google.api.api_visibility).restriction = "INTERNAL";
     rpc Authorize(AuthorizeRequest) returns (AuthorizeResponse) {}
     rpc GetSecret(GetSecretRequest) returns (GetSecretResponse) {}
+    rpc GetTokenFromSecret(GetTokenFromSecretRequest) returns (GetTokenFromSecretResponse) {}
 }
 
 message Authorization {
@@ -54,3 +55,13 @@ message GetSecretResponse {
     Authorization authorization = 1;
 }
 
+
+message GetTokenFromSecretRequest {
+    Authorization authorization = 1;
+}
+
+message GetTokenFromSecretResponse {
+    string token = 1;
+}
+
+
diff --git a/aruna/api/internal/v1/proxy.proto b/aruna/api/internal/v1/proxy.proto
index 735b7a7f..867d6968 100644
--- a/aruna/api/internal/v1/proxy.proto
+++ b/aruna/api/internal/v1/proxy.proto
@@ -133,9 +133,16 @@ message GetObjectLocationRequest {
   string endpoint_id = 4;
 }
 
+message CORSConfig {
+  repeated string allowed_methods = 1;
+  repeated string allowed_origins = 2;
+  repeated string allowed_headers = 3;
+}
+
 message GetObjectLocationResponse {
   aruna.api.storage.models.v1.Object object = 1;
   Location location = 2;
+  repeated CORSConfig cors_configurations = 3;
 }
 
 message GetCollectionByBucketRequest {