Access keys
How the access key and secret work: shown once at creation, scoped to your buckets, regenerated on demand, and how to store them safely.
How access works
Every request to object storage is signed with an access key and a
secret key, the standard S3 credential pair. You get them when you create a
bucket, and they authenticate S3 SDKs, the aws CLI, rclone, and mc.
The properties that matter:
- The secret is shown exactly once. The full secret appears only in the creation dialog (and again right after you regenerate it). We do not store it in a form we can show you later. Lost it? Regenerate a new one.
- Scoped to one bucket. Each key pair is minted for a single bucket and
reaches only that bucket. Pointing it at any other bucket — yours or another
tenant's — returns
403 AccessDenied. A leaked key never exposes more than the one bucket it belongs to. - Private by default. There are no public or anonymous buckets: without a valid key, there is no access at all.
Regenerating a key
Regenerate the credentials from the bucket's page in the dashboard when a key leaks, when you rotate secrets on a schedule, or when you simply lost the secret.
Regenerating is instant and breaks the old secret
The moment you regenerate, the previous secret stops working: any app
still using it starts getting 403 AccessDenied. Update your running apps
with the new secret right after you regenerate.
Keep keys secret
An access key and secret let anyone read from and write to your buckets, billed to your balance. Treat them like a password.
Never commit a key
Do not paste keys into chat tools, client-side code, or a GitHub repository, and never bake them into a Docker image. Load them from environment variables or your platform's secret store. If a key leaks (or you suspect it did), regenerate it in the dashboard immediately.
To wire a credential into a deployed app the right way, over environment variables, follow Connect an app to object storage. For the errors you will see when a key is wrong, revoked, or aimed at the wrong bucket, see limits and errors.
Block volumes (coming soon)
Preview the planned persistent-disk product and its attachment model. Block-volume creation and billing are disabled today.
Billing and usage
Prepaid per GB-month pricing on booked capacity, free egress, included request operations, hourly metering from your balance, and what happens at zero.