Credentials
A credential lets your own application work with your buckets without going through the dashboard. It is a pair of values: an access key ID, which identifies it, and a secret access key, which proves it is you. Your application sends both with every request, as described in Use buckets from your application.
A credential belongs to your account, so it opens every bucket you own. It cannot be limited to one bucket.
Create a credential
- Open Buckets → Credentials.
- Select Create Credential.
- Enter a Name that tells you which application will use it, such as
production-api. - Choose the Access level: Read & write or Read only. See Access levels.
- Select Create credential.
Kuberns shows the Access key ID and the Secret access key.
This is the only time the secret is shown. Copy it now, or select Download CSV, and store it somewhere safe, such as your service's environment variables. Kuberns keeps only an irreversible fingerprint of the secret, so nobody can read it back later. If you lose it, create a new credential and delete the old one.
Access levels
Choose the smallest access that your application needs.
| Operation | Read only | Read & write |
|---|---|---|
| List your buckets and see a bucket's details | Yes | Yes |
| List files and folders | Yes | Yes |
| Download a file, and read its metadata | Yes | Yes |
| Read a file's visibility | Yes | Yes |
| Get a link to a file | Yes | Yes |
| Upload a file | No | Yes |
| Delete a file | No | Yes |
| Create a folder | No | Yes |
| Create or delete a bucket | No | Yes |
| Make a file public or private | No | Yes |
A read-only credential that tries to change something is refused with 403 and the message This credential is read-only. Nothing is changed.
The access level is fixed when the credential is created. To change it, create a new credential and delete the old one.
Your credentials
The Credentials page lists each one with its name, access key ID, access level, when it was last used, and when it was created. The secret is never shown again. Use the copy icon to copy an access key ID.
You can have up to 5 credentials. A name can be up to 60 characters.
Replace a credential
To rotate a credential without downtime:
- Create a new credential with the same access level.
- Put the new values into your application and deploy it.
- Check that the old credential's Last used time stops moving.
- Delete the old credential.
Delete a credential
Use the delete icon on the credential's row and confirm. Anything still using it stops working immediately, and this cannot be undone. Delete a credential as soon as you think its secret has leaked, then create a new one.
Keep it safe
- Keep it on your server. Put the values in environment variables and read them in your backend. Never put them in browser JavaScript, a mobile app, or a repository. Anything in a web page can be read by whoever opens it.
- Use read-only where you can. A service that only displays files does not need to be able to delete them.
- Use a separate credential for each application. You can then revoke one without affecting the others, and Last used tells you which are still in use.
- Do not share one credential between people. Create one per person or per system.