Blob S3 Credentials

GET

credentials

curl --request GET \
  --url 'https://blob.squarecloud.app/v1/s3/credentials' \
  --header 'Authorization: YOUR_API_KEY'

{
  "status": "success",
  "response": {
    "access_key_id": "SQ2_3155597145698959364_k7Hq2mX9",
    "secret_access_key": "vR8nLq2Wz5Tc1Yb7Hs0Kd4Jf6Gm3Pa9Xe",
    "endpoint": "https://s3-blob.squarecloud.app",
    "region": "auto",
    "buckets": ["public", "private", "legacy"],
    "access": { "read": true, "write": true },
    "expires_at": null
  }
}

string

required

The API key for your account. You can find this in your account settings.

S3 Credentials returns the access key pair that S3 tools use to sign requests to the S3 gateway. The pair is derived from the API key that calls this route: calling again returns the same pair, and revoking, regenerating or expiring the key does the same to the pair. There is nothing else to rotate or revoke. Call it with an API key that has blob:read or blob:write. The pair can read with blob:read and write with blob:write, as the access field shows.

The secret_access_key gives the same access as the API key. Store it like the key itself.

The pair doesn’t change while the API key doesn’t change. Fetch it once and keep it in your secret manager or in an environment variable: don’t call this route every time your application boots.

Rate limits

10 requests per hour per account (RATE_LIMITED, 429).

Response

string

“success” if successful, “error” if not.

object

Show Toggle object

string

The access key id (SQ2_...).

string

The secret access key.

string

https://s3-blob.squarecloud.app

string

auto

string[]

The buckets of your account: public, private and legacy.

object

read and write, each true or false, following the key’s scopes.

ISO 8601 | null

When the API key, and so the pair, expires. null when it doesn’t.

curl --request GET \
  --url 'https://blob.squarecloud.app/v1/s3/credentials' \
  --header 'Authorization: YOUR_API_KEY'

{
  "status": "success",
  "response": {
    "access_key_id": "SQ2_3155597145698959364_k7Hq2mX9",
    "secret_access_key": "vR8nLq2Wz5Tc1Yb7Hs0Kd4Jf6Gm3Pa9Xe",
    "endpoint": "https://s3-blob.squarecloud.app",
    "region": "auto",
    "buckets": ["public", "private", "legacy"],
    "access": { "read": true, "write": true },
    "expires_at": null
  }
}

Errors

Code	HTTP	When
`API_KEY_REQUIRED`	400	Called with a dashboard session. Use an API key.
`LEGACY_API_KEY`	400	The key uses an older format that can’t sign S3 requests. Create a new API key.
`INVALID_CREDENTIAL`	401	The API key could not be verified.
`MISSING_SCOPE`	403	The key has neither `blob:read` nor `blob:write`.
`RATE_LIMITED`	429	More than 10 requests in an hour.

curl --request GET \
  --url 'https://blob.squarecloud.app/v1/s3/credentials' \
  --header 'Authorization: YOUR_API_KEY'

{
  "status": "success",
  "response": {
    "access_key_id": "SQ2_3155597145698959364_k7Hq2mX9",
    "secret_access_key": "vR8nLq2Wz5Tc1Yb7Hs0Kd4Jf6Gm3Pa9Xe",
    "endpoint": "https://s3-blob.squarecloud.app",
    "region": "auto",
    "buckets": ["public", "private", "legacy"],
    "access": { "read": true, "write": true },
    "expires_at": null
  }
}

Getting Started

Objects

Chunked Uploads

Account

Share Links

S3

Rate limits

Response

Errors

​Rate limits

​Response

​Errors

Rate limits

Response

Errors