> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squarecloud.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Blob S3 Credentials

> Get the S3 access key pair of your API key with GET /v1/s3/credentials, to use aws-cli, boto3, rclone and the AWS SDKs with Blob Storage.

<ParamField header="Authorization" type="string" placeholder="API Key" required>
  The API key for your account. You can find this in your [account settings](https://squarecloud.app/en/account/security).
</ParamField>

S3 Credentials returns the access key pair that S3 tools use to sign requests to the [S3 gateway](/en/blob-reference/s3-compatibility). The pair is **derived from the API key** that calls this route: calling again returns the same pair, and revoking, regenerating or expiring the key does the same to the pair. There is nothing else to rotate or revoke.

Call it with an API key that has `blob:read` or `blob:write`. The pair can read with `blob:read` and write with `blob:write`, as the `access` field shows.

<Warning>The `secret_access_key` gives the same access as the API key. Store it like the key itself.</Warning>

<Tip>The pair doesn't change while the API key doesn't change. Fetch it once and keep it in your secret manager or in an environment variable: don't call this route every time your application boots.</Tip>

### Rate limits

<Note>10 requests per hour per account (`RATE_LIMITED`, 429).</Note>

### Response

<ResponseField name="status" type="string">
  "success" if successful, "error" if not.
</ResponseField>

<ResponseField name="response" type="object">
  <Expandable title="Toggle object">
    <ResponseField name="access_key_id" type="string">
      The access key id (`SQ2_...`).
    </ResponseField>

    <ResponseField name="secret_access_key" type="string">
      The secret access key.
    </ResponseField>

    <ResponseField name="endpoint" type="string">
      `https://s3-blob.squarecloud.app`
    </ResponseField>

    <ResponseField name="region" type="string">
      `auto`
    </ResponseField>

    <ResponseField name="buckets" type="string[]">
      The buckets of your account: `public`, `private` and `legacy`.
    </ResponseField>

    <ResponseField name="access" type="object">
      `read` and `write`, each `true` or `false`, following the key's scopes.
    </ResponseField>

    <ResponseField name="expires_at" type="ISO 8601 | null">
      When the API key, and so the pair, expires. `null` when it doesn't.
    </ResponseField>
  </Expandable>
</ResponseField>

<RequestExample>
  ```bash cURL theme={null}
  curl --request GET \
    --url 'https://blob.squarecloud.app/v1/s3/credentials' \
    --header 'Authorization: YOUR_API_KEY'
  ```
</RequestExample>

<ResponseExample>
  ```json theme={null}
  {
    "status": "success",
    "response": {
      "access_key_id": "SQ2_3155597145698959364_k7Hq2mX9",
      "secret_access_key": "vR8nLq2Wz5Tc1Yb7Hs0Kd4Jf6Gm3Pa9Xe",
      "endpoint": "https://s3-blob.squarecloud.app",
      "region": "auto",
      "buckets": ["public", "private", "legacy"],
      "access": { "read": true, "write": true },
      "expires_at": null
    }
  }
  ```
</ResponseExample>

### Errors

| Code                 | HTTP | When                                                                            |
| -------------------- | ---- | ------------------------------------------------------------------------------- |
| `API_KEY_REQUIRED`   | 400  | Called with a dashboard session. Use an API key.                                |
| `LEGACY_API_KEY`     | 400  | The key uses an older format that can't sign S3 requests. Create a new API key. |
| `INVALID_CREDENTIAL` | 401  | The API key could not be verified.                                              |
| `MISSING_SCOPE`      | 403  | The key has neither `blob:read` nor `blob:write`.                               |
| `RATE_LIMITED`       | 429  | More than 10 requests in an hour.                                               |