API keys & S3 clients

Creating a key

/tools/cloud-storage → API Keys → Create key.

• Name — for your reference
• Buckets — pick which buckets the key can access (or all)
• Permissions — read, write, delete (combine as needed)

We show the Access Key ID + Secret Access Key once. Save them. We can't show the secret again — only revoke + reissue.

Endpoint

Use this as your S3 endpoint URL:

https://<your-account-id>.storage.suzko.net

Account ID shown on the storage dashboard.

AWS CLI

# One-time setup
aws configure --profile suzko
# Access key: <your key>
# Secret: <your secret>
# Region: auto
# Output format: json

# Use it
aws s3 ls s3://yourbucket/ \
  --endpoint-url https://<account-id>.storage.suzko.net \
  --profile suzko

aws s3 cp ./localfile.txt s3://yourbucket/ \
  --endpoint-url https://<account-id>.storage.suzko.net \
  --profile suzko

rclone

[suzko]
type = s3
provider = Other
access_key_id = <your key>
secret_access_key = <your secret>
endpoint = https://<account-id>.storage.suzko.net
region = auto

Then:

rclone copy ./mybackup suzko:yourbucket
rclone ls suzko:yourbucket

SDK examples

Node.js (@aws-sdk/client-s3):

import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";

const s3 = new S3Client({
  region: "auto",
  endpoint: "https://<account-id>.storage.suzko.net",
  credentials: {
    accessKeyId: process.env.SUZKO_ACCESS_KEY,
    secretAccessKey: process.env.SUZKO_SECRET_KEY,
  },
});

await s3.send(new PutObjectCommand({
  Bucket: "yourbucket",
  Key: "hello.txt",
  Body: "Hello world",
}));

Python (boto3):

import boto3

s3 = boto3.client(
    "s3",
    region_name="auto",
    endpoint_url="https://<account-id>.storage.suzko.net",
    aws_access_key_id="...",
    aws_secret_access_key="...",
)

s3.put_object(Bucket="yourbucket", Key="hello.txt", Body=b"Hello")

Rotating keys

API Keys → click the key → Rotate generates new credentials, the old ones stop working immediately. Update your code/CI before clicking rotate.

Best practices

• One key per app/service. Don't share a master key.
• Scope to the buckets the app actually needs.
• Never check keys into git. Use env vars.
• Rotate quarterly. Faster if a leak is suspected.