Generate access keys

_{Updated May 8, 2026} An access key is an S3-style credential pair (access key ID + secret) that lets SDKs, the AWS CLI, and other S3 tools authenticate to your Raff Object Storage. Every key has a scope — either every bucket on the account, or specific buckets — and the choice you make at creation determines how the key behaves over its lifetime.

​

Before you start

• An Object Storage bucket (you can create the key first, but the typical flow is bucket-then-key).
• Decide which access type you need — see the side-by-side below.

​

1. Open the Create Access Key dialog

From Object Storage → Access Keys, click + Create Access Key. The Access Keys list shows every key on your account with its Scope (e.g. “1 bucket” or “0 buckets”) and creation date.

​

2. Name the key

Pick something descriptive — the dashboard placeholder is e.g. CI/CD Pipeline. Good names tell you where the key is used so you can rotate or revoke later:

• gh-actions-prod-deploy
• backup-cron-vm-finance
• marketing-site-uploads

Names don’t have to be unique across the account, but for revocation hygiene treat them as identifiers.

​

3. Pick the access type

The Access Type dropdown has two options. This choice is the most important part of access-key creation.

​

Full Access

​

Limited

When you pick Limited, the dialog asks you to select which bucket(s) the key should access. Raff then automatically generates a bucket policy specifically for this access key, granting it operations on the selected buckets only.

​

Choosing between them

​

4. Create and copy the secret

Click Create Access Key. You’ll get back two strings: Pair them with the Raff S3 endpoint when configuring an SDK — see Use the S3 SDK.

​

After creation

The new key appears in the Access Keys list. The Scope column tells you what the key can reach (Full / 1 bucket / N buckets); the Created column has the date. You can:

• Disable the key — temporarily block all requests it makes
• Delete the key — permanent revocation
• (Limited keys) Re-scope the key — add or remove buckets it can access; Raff updates the auto-managed policy
• Rotate — generate a new key, deploy it to your application, then delete the old one (zero-downtime if you run both briefly in parallel)

You cannot retrieve the secret after creation — to rotate or recover, create a new key.

​

Storing keys safely

• Treat keys like passwords — they’re full credentials to your data
• Don’t commit them to version control
• Use a secrets manager (1Password, Vault, AWS Secrets Manager, Doppler, etc.) or environment variables injected at runtime
• Rotate when a key leaks, when an employee leaves, or on a schedule
• Use Limited scope to reduce blast radius — if a Limited key leaks, only its buckets are exposed, not the whole account

​

Next steps