S3 Access Keys
S3 access keys let you authenticate with Oyster's
S3-compatible API using standard AWS Signature
Version 4. Each access key consists of an access key ID (20 characters,
prefixed with OYAK) and a secret access key (40 hex characters).
You can have up to 3 active access keys per account.
How to manage access keys
The Admin API provisions access keys. An app operator uses admin-key authentication to create, list, and revoke keys for accounts they manage.
| Operation | Endpoint | Description |
|---|---|---|
| Create | POST /api/v1/accounts/{account_id}/access-keys | Create a new key pair |
| List | GET /api/v1/accounts/{account_id}/access-keys | List all keys for an account |
| Revoke | DELETE /api/v1/accounts/{account_id}/access-keys/{access_key_id} | Revoke a key |
What is the access key format?
| Field | Format | Description |
|---|---|---|
access_key_id | 20 characters, OYAK prefix | Identifies the key in S3 requests |
secret_access_key | 40 hex characters | Signs S3 requests, shown only once at creation |
Each account can have at most 3 active access keys. Revoked keys do not count toward this limit.
Use an access key with the AWS CLI
The AWS CLI and SDKs handle SigV4 signing automatically, so you provide only your access key ID and secret. To use the AWS CLI, create a profile that stores your key pair and points endpoint_url at your Oyster deployment:
$ aws configure set aws_access_key_id "OYAK1234567890ABCDEF" --profile oyster
$ aws configure set aws_secret_access_key "abcdef1234567890..." --profile oyster
$ aws configure set region "us-east-1" --profile oyster
$ aws configure set endpoint_url "$OYSTER_URL" --profile oyster
The example shortens the secret access key. Replace it with your full 40-character hex secret. Set OYSTER_URL to the URL of your Oyster deployment.
Then pass the profile to standard S3 commands:
$ aws --profile oyster s3api create-bucket --bucket my-s3-bucket
For SDK setup, see S3 setup.