Create and revoke access keys

An access key is the pair of values an S3 client signs its requests with: an access key ID, such as AKIAEXAMPLE0000000000000, and a secret key. You create keys on the service's Access keys tab. Each key is read-only or read-write, and works on one bucket or on every bucket on your account.

• Sign in to the dashboard and open the service.
• The service must be active to create a key. You can revoke a key in any status.
• To limit a key to one bucket, create the bucket first (Create a bucket).

A key has one of two sets of permissions:

Read and write

Lists, downloads, uploads and deletes objects.

Read only

Lists and downloads objects. It cannot change anything.

No key can create or delete a bucket. Do that on the Buckets tab.

A key also has a scope:

All buckets on this account

The key works on every bucket whose name starts with your prefix, such as u7-. That covers the buckets of all your Object Storage services, including buckets you create later.

One bucket

The key works on that bucket only, and every other bucket refuses it. The list offers the buckets of the service you create the key on.

A key works at the endpoint of every region. Point the client at the endpoint of the region that holds the bucket.

While a service is suspended, its keys stop working. They work again when the service is active.

1. Open the service and select the Access keys tab.
2. Select Create key….
3. In Label, type a name that tells you where the key is used, such as ci deploy. A label has up to 64 characters: letters, digits, spaces, dots, hyphens and underscores, starting with a letter or a digit. Each label on a service is different.
4. Under Permissions, choose Read and write or Read only.
5. Under Scope, keep All buckets on this account or choose one bucket.
6. Select Create key.

The dialog now shows the new key, under Save the secret key now. This is the only time the dashboard or the API shows the secret key.

Access key ID and Secret key

The two values your client signs with. The secret key is hidden at first. Select the eye icon beside it to show it, or copy it without showing it.

Endpoint and Region

The endpoint and region code of the service's home region. For a key limited to a bucket in another region, use the endpoint of that bucket's region instead.

Scope and Permissions

What you chose, such as All buckets (u7-*) and Read and write.

To copy the values:

• Copy all copies every field, the secret key included, as lines of text.
• The copy button beside each field copies that value.
• The two code blocks hold ~/.aws/credentials and ~/.aws/config entries for a profile called coritan, ready to paste (Connect an S3 client).

Store the secret key in a password manager or in your deployment's secret store, then select I have saved it.

The Access keys card says how many keys the service has, newest first.

Key

The label, and the access key ID with a button to copy it.

Scope

All buckets, or the name of the one bucket the key works on.

Permissions

Read and write or Read only.

Created

The date you created the key.

Last used

We do not record when a key is used, so this column shows Never.

A key marked Inactive does not work. That happens while the service is suspended, and after you delete the one bucket the key was limited to. A key limited to a deleted bucket leaves the list 7 days after the bucket.

1. Open the key's menu and select Revoke key….
2. Select Revoke key to confirm.

A message confirms it, such as Access key "ci deploy" revoked. The key leaves the list at once, and storage refuses it within a couple of minutes. Presigned URLs that a client signed with the key stop working too. Presigned URLs from the API and the dashboard's own uploads and downloads do not use your keys, so revoking has no effect on them.

To replace a key without a break in service, create the new key, wait a couple of minutes, move your applications to it, and then revoke the old key. Once the old key is revoked, you can give its label to a new key.

A new key signs requests within a couple of minutes, for the buckets and permissions you chose. Connect an S3 client shows how to use it. A revoked key is refused everywhere within the same time.

A key labelled ci deploy already exists on this service

Choose another label, or revoke the key that has it first.

Labels use letters, digits, spaces, dots, hyphens and underscores

The label holds another character, or starts with a dot, hyphen or underscore. Change it.

A new key is refused with InvalidAccessKeyId

The key has not reached storage yet. Wait a couple of minutes and try again. If it is still refused, check that you copied the whole access key ID, then contact support.

A request is refused with AccessDenied

The key's scope or permissions do not cover the request. A read-only key cannot upload or delete, a key limited to one bucket cannot reach another, and no key can create or delete a bucket.

Create key… is missing

The service is not active. The tab says Keys can be created once the service is active., or Keys are turned off while the service is suspended.

You lost the secret key

We cannot show it again. Create a new key, move your applications to it, and revoke the old one.

• Connect an S3 client
• Create and delete buckets
• Object Storage limits
• Troubleshoot Object Storage

Each request takes the service ID. A service that is not Object Storage on your account answers 404 with Object storage service not found.

GET /api/v1/client/object-storage/{service_id}/keys lists the service's keys, newest first, without their secrets:

curl https://api.coritan.com/api/v1/client/object-storage/1207/keys \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "items": [
    {
      "id": 12,
      "access_key_id": "AKIAEXAMPLE0000000000000",
      "label": "ci deploy",
      "bucket_id": 31,
      "bucket_name": "u7-assets",
      "scope": "bucket",
      "mode": "read",
      "actions": ["Read", "List"],
      "is_active": true,
      "last_used_at": null,
      "created_at": "2026-09-26T10:05:00"
    }
  ],
  "total": 1
}

scope is bucket for a key limited to one bucket, named by bucket_id and bucket_name, and all for a key on every bucket, where both are null. mode is read or read_write. actions lists the S3 permissions behind the mode: Read and List for a read-only key, and Read, Write, List and Tagging for a read-write key. is_active is false while the key is turned off. last_used_at is always null.

POST /api/v1/client/object-storage/{service_id}/keys takes:

label

Required. 1–64 characters, as in the dashboard.

mode

read or read_write. The default is read_write.

bucket_id

Optional. The id of one of the service's buckets, to limit the key to it. Without it, the key works on every bucket on your account.

curl -X POST https://api.coritan.com/api/v1/client/object-storage/1207/keys \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"label": "ci deploy", "mode": "read", "bucket_id": 31}'

It answers 201 with the key in the shape above and four more fields:

{
  "id": 12,
  "access_key_id": "AKIAEXAMPLE0000000000000",
  "label": "ci deploy",
  "bucket_id": 31,
  "bucket_name": "u7-assets",
  "scope": "bucket",
  "mode": "read",
  "actions": ["Read", "List"],
  "is_active": true,
  "last_used_at": null,
  "created_at": "2026-09-26T10:05:00",
  "secret_key": "ExampleSecretKey000000000000000000000000000",
  "endpoint": "https://s3.fra.coritan.com:7337",
  "region": "fra",
  "activation_note": "The gateways are handed the new key within a couple of minutes; a request signed with it before then is refused."
}

secret_key appears in this response and never again. endpoint and region are the service's home region, whatever bucket the key is limited to. activation_note repeats that the key needs a couple of minutes before it works.

DELETE /api/v1/client/object-storage/{service_id}/keys/{key_id} revokes a key, in any status of the service. key_id is the key's id:

curl -X DELETE https://api.coritan.com/api/v1/client/object-storage/1207/keys/12 \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{"ok": true, "access_key_id": "AKIAEXAMPLE0000000000000"}

A key that is not on the service answers 404 with Access key not found.