Browse articles

Object storage

# Creating, restricting, and revoking access keys

Create one S3 access key per application, restrict it to a single bucket, set an expiry, store the secret that is shown only once, and revoke keys at any time without affecting others.

3 min readUpdated: October 23, 2026[Baca dalam Bahasa Indonesia](/docs/access-key)

Access keys let applications, servers, and tools such as the AWS CLI access buckets over the S3 protocol. Create one key per application so each key can be restricted and revoked on its own.

## 1\. Create an access key

1.  Open **Access keys** in the sidebar (Storage group).
2.  Click **Create access key**.
3.  Enter a name, for example `ci-deploy` or `web-production`.
4.  Choose **Access**: **All buckets of this account** or **Only <bucket name>**.
5.  Choose **Expires**: **Never**, **1 day**, **7 days**, **30 days**, **90 days**, or **1 year**.
6.  Click **Create key**.

## 2\. Save the secret now

The **Access key created — save the secret now** dialog shows the access key and the secret key. The secret key is shown only once and is not stored on our servers. Copy it into a secrets manager or your application's environment variables, then click **I have saved it**. If the secret is lost, revoke the key and create a new one.

## 3\. Use it in an S3 client

Use the endpoint, region, and path-style addressing shown on the **Object storage** page:

```bash
export AWS_ACCESS_KEY_ID=<access key>
export AWS_SECRET_ACCESS_KEY=<secret key>
export AWS_DEFAULT_REGION=id-jkt-1

aws --endpoint-url https://storage.linuxteknosia.cloud s3 ls s3://media-example-co/
```

Complete examples for other tools are in the [AWS CLI](/docs/aws-cli), [rclone](/docs/rclone), [Laravel](/docs/laravel), and [Node.js](/docs/nodejs) guides.

## 4\. Revoke and rotate keys

1.  In the **Active keys** list, click **Revoke** on the key you want to stop.
2.  Confirm with **Yes, revoke**. The key is rejected immediately and moves to **Revoked keys**; other keys are not affected.

To rotate without downtime: create a new key, deploy it to the application, confirm the application works, and only then revoke the old key. The **Last used** column helps confirm that the old key is no longer in use.

Keys past their expiry are marked **expired** and can no longer be used; revoke them and replace them with a new key.

## 5\. Security practices

-   Restrict a key to one bucket when the application only needs one bucket.
-   Set an expiry on temporary keys, for example for a migration or a third party.
-   Never store secrets in a code repository.
-   Creating access keys is deliberately not available through MCP, so secrets never pass through an AI assistant.

The number of active keys per account is limited (shown as _active · n/max_).

## Troubleshooting

-   **Lost secret**: the secret cannot be shown again. Revoke the key and create a new one.
-   **AccessDenied**: the key is restricted to another bucket, revoked, or expired. Read [AccessDenied and SignatureDoesNotMatch](/help/access-denied).
-   **"batas N access key aktif tercapai"** (active key limit reached): revoke keys you no longer use.
-   **"layanan storage ditangguhkan"** (storage suspended): every key is rejected while storage is suspended. Read [Storage suspended](/help/storage-ditangguhkan).

## See also

-   [Creating a bucket](/docs/bucket)
-   [Bucket settings](/docs/pengaturan-bucket)

Still need help?

Open a support ticket from the dashboard and our team will reply as soon as possible.

[Help center](/en/help)[Open a ticket](/app/support/new)