# Set up S3 credentials for Object Storage Azion **Object Storage** offers compatibility with the S3 protocol through credentials. When you create a credential for any bucket that you own, you'll get an access key and a secret key to set up permissions for operations. Access to your bucket through the S3 protocol will be verified using the credential. The S3 protocol allows you to access buckets and objects using an Object Storage URL. This configuration facilitates file operations through command line interface (CLI) tools, such as [s3cmd](https://s3tools.org/s3cmd), database services, or functions. --- ## Create a credential via API 1. Run the following `POST` request in your terminal, replacing `[TOKEN VALUE]` with your [personal token](/en/documentation/products/guides/personal-tokens/): ```bash curl --request POST \ --url https://api.azion.com/v4/workspace/storage/credentials \ --header 'Accept: application/json' \ --header 'Authorization: Token [TOKEN VALUE]' \ --header 'Content-Type: application/json' \ --data '{ "name": "full-access", "capabilities": [ "listAllBucketNames", "listBuckets", "listFiles", "readFiles", "writeFiles", "deleteFiles" ] }' ``` | Key | Description | | --- | --- | | `name` | Defines a string value as the name of the credential | | `capabilities` | Accepts a list of capabilities to allow the execution of operations | | `bucket` | Optional. Restricts the use of the credential to the specified bucket only | | `expiration_date` | Sets the time for the credential to expire. The datetime format must be in UTC ISO 8601 standard: `YYYY-MM-DDT00:00:00Z` | 2. You should receive a response similar to this: ```json { "state": "executed", "data": { "name": "full-access", "access_key": "", "secret_key": "", // this value can no longer be accessed in future requests "capabilities": [ "listAllBucketNames", "listBuckets", "listFiles", "readFiles", "writeFiles", "deleteFiles" ], "bucket": null, "expiration_date": null, "last_editor": "editor@email.com", "last_modified": "2025-11-05T19:55:31.542240Z" } } ``` :::note The bucket field is optional. If it is not provided and the credential has the capabilities listAllBucketNames and listBuckets, it can be used to access all buckets in the account. However, if the bucket field is specified, access will be restricted to the indicated bucket. ::: 3. Copy the values of the `access_key` and `secret_key` to set up access through the S3 protocol. --- ## Configure access to the bucket through s3cmd [s3cmd](https://s3tools.org/s3cmd) is a command line interface (CLI) tool for managing S3 and other cloud storage services. It can be used to manage objects on **Object Storage** and other S3-compatible storage services. To use s3cmd to manage your Object Storage bucket, follow these steps: 1. Download and install s3cmd package through the [official website](https://s3tools.org/download). 2. Make sure `s3cmd` is added to your system's PATH. 3. Run `s3cmd --configure` and enter the access key and secret key. 4. Enter the default region for the Object Storage region: `us-east-005`. 5. Enter the endpoint URL for Object Storage: `s3.us-east-005.azionstorage.net`. 6. Use the default DNS template: `%(bucket).s3.us-east-005.azionstorage.net`. 7. Inform an encryption password and a path to GPG program if needed. :::note Gnu Privacy Guard (GPG) is a free and open-source encryption software that provides an additional layer cryptographic privacy and authentication for S3 protocol communication. See [the GnuPG documentation](https://www.gnupg.org/index.html) for more information. ::: 8. Activate the HTTPS protocol by typing `true`. 9. Inform HTTP proxy servers if needed. 10. Press `y` to test access. If your access and secret keys are correct, you should get the following success message: ```bash Please wait, attempting to list all buckets... Success. Your access key and secret key worked fine :-) ``` You can save your settings into an `.s3cfg` file if needed and modify them again using `s3cmd --configure`. Run the command `s3cmd --help` to see all available commands. --- ## s3cmd commands to manage objects on Object Storage Once you've configured access to the bucket through s3cmd, you can execute operations to manage your objects on Object Storage using the available commands. | Scope | Description | |---|---| | `s3cmd ls` | List all your buckets | | `s3cmd mb s3://my-new-bucket-name` | Create a new bucket. Bucket names must be unique and best practices for naming buckets include specifying what types of objects are stored and the type of permissions for the objects | | `s3cmd ls s3://my-new-bucket-name` | List the contents of the bucket | | `s3cmd put file.xml s3://my-new-bucket-name/file.xml` | Upload a file into the bucket | | `​​s3cmd get s3://my-new-bucket-name/file.xml file-2.xml` | Retrieve the file back and verify that it hasn't been corrupted | | `s3cmd del s3://my-new-bucket-name/addrbook.xml s3://my-new-bucket-name/storage.jpg` | Delete the object | | `s3cmd rb s3://logix.cz-test` | Remove the bucket. Only empty buckets can be removed | :::note If any files were deleted within the last 24 hours from the specified bucket, attempting to delete the entire bucket would be blocked. It's recommended to wait for at least 24 hours after deleting files before attempting to delete the entire bucket. ::: For more details on S3 protocol and s3cmd commands, check the [official documentation](https://s3tools.org/s3cmd). You can also visit the [Object Storage reference](/en/documentation/products/store/object-storage/).