S3 credentials

An S3 credential is an access key ID and a secret access key, scoped to one environment of one application. It is the only thing the S3-compatible API accepts, and it authenticates nothing else.

Creating a credential

In the console, open the environment, then File Storage, then S3 credentials, and select Create credential. Give it a description you will recognize later, such as CI uploads. The secret is displayed once, in the dialog that follows.

APP=0197b2f1-2f4a-7a0b-8a2d-222222222222

curl -sS -X POST \
  "https://api.gigadrive.network/applications/$APP/storage/s3-credentials" \
  -H "Authorization: Bearer $GIGADRIVE_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"environmentId":"0197b2f8-92a4-734f-9b90-999999999999","description":"CI uploads"}'

{
  "credential": {
    "id": "0197b301-4d21-7c8e-9a03-444444444444",
    "applicationId": "0197b2f1-2f4a-7a0b-8a2d-222222222222",
    "environmentId": "0197b2f8-92a4-734f-9b90-999999999999",
    "description": "CI uploads",
    "accessKeyId": "GAK7QM4ZTB2XVC5HJ3RN",
    "createdByUserId": null,
    "lastUsedAt": null,
    "revokedAt": null,
    "createdAt": "2026-08-13T09:30:00.000Z",
    "updatedAt": "2026-08-13T09:30:00.000Z"
  },
  "accessKeyId": "GAK7QM4ZTB2XVC5HJ3RN",
  "secretAccessKey": "..."
}

This route takes the environment as a UUID, not a slug, and needs the network:storage_s3_credentials:write scope. There is no SDK method and no CLI command for S3 credentials.

What a credential reaches

One key pair covers every bucket in its environment, with read, write and delete on all of them. There is no per-bucket or read-only variant. A request for a bucket in another environment, or in another application, fails with AccessDenied even though the signature is valid.

Access keys start with GA and are 20 characters long, which makes them easy to spot in a config file or a log.

Rotating

There is no rotate operation, and no way to change a credential in place. Rotation is three steps, and revoked keys do not count against the per-environment limit, so there is always room for the replacement.

1. Create the replacement

   Mint a second credential in the same environment and store the new secret.

2. Cut the clients over

   Update every consumer, then confirm the new key is being used. The credential list shows a Last used timestamp for each key, written at most once every 5 minutes.

3. Revoke the old one

   Revoking is immediate and cannot be undone.

An environment can hold 25 active credentials. The 26th returns HTTP 429 with This environment already has 25 of 25 S3 credentials. Revoke an unused credential before creating a new one.

Revoking

A revoked credential stops working on the next request. Credentials are looked up per request with no cache in front, so there is no window where a revoked key still works, and presigned URLs that were signed with it stop resolving at the same moment.

Revoked credentials stay in the list, marked as such, so you keep the audit trail of what existed.

Console re-authentication

Creating or revoking a credential from the console asks you to confirm your identity if you have not authenticated in the last 15 minutes. The API path uses your token's scopes instead and has no such prompt.