> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vertracloud.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Get S3-Compatible Credentials for Blob Storage

> Returns S3-compatible credentials derived from the API key, for tools such as aws-cli, rclone and boto3. Limited to 10 calls per hour.

Returns S3-compatible credentials for tools such as aws-cli, rclone and boto3. The pair is derived from the API key that makes the call, so revoking that key cuts S3 access at once. With an API key that has only `blob:read`, the credentials are read-only (`access.write` is `false`). Treat `secret_access_key` as a password. This route requires an API key: a dashboard session is refused. Rotating the API key replaces the pair, so fetch the credentials again afterwards.

**Scope:** `blob:read`.

<ParamField query="workspace_id" type="string">
  The workspace ID, when the blob belongs to a workspace. The call acts on the blob of the workspace owner and needs the `blob:read` workspace permission (`blob:manage` on routes that change data). Leave it out to act on your own blob.
</ParamField>

### Example request

```bash theme={null}
curl "https://blob.vertracloud.app/v1/s3/credentials" \
  -H "Authorization: Bearer $VERTRA_API_KEY"
```

### Response

<ResponseField name="response" type="object">
  The S3 credentials for the account.

  <Expandable title="properties">
    <ResponseField name="access_key_id" type="string">Access key ID. Starts with `VCS3`.</ResponseField>
    <ResponseField name="secret_access_key" type="string">Secret key. Treat it as a password.</ResponseField>
    <ResponseField name="endpoint" type="string">S3 endpoint to set in your tool.</ResponseField>
    <ResponseField name="region" type="string">Always `auto`.</ResponseField>
    <ResponseField name="buckets" type="string[]">The two buckets: `public` and `private`.</ResponseField>
    <ResponseField name="access.read" type="boolean">Whether the credentials can read.</ResponseField>
    <ResponseField name="access.write" type="boolean">Whether the credentials can write. `false` with an API key that has only `blob:read`.</ResponseField>
  </Expandable>
</ResponseField>

<ResponseExample>
  ```json Response theme={null}
  {
    "response": {
      "access_key_id": "VCS3K7P2M9X4QA",
      "secret_access_key": "<secret>",
      "endpoint": "https://s3.vertracloud.dev",
      "region": "auto",
      "buckets": [
        "public",
        "private"
      ],
      "access": {
        "read": true,
        "write": true
      }
    }
  }
  ```
</ResponseExample>

### Error Responses

<ResponseField name="code" type="string">
  The error code indicating the reason for failure. Possible values:

  * `AUTH_TOKEN_MISSING` (`401`): No `Authorization` header was sent.
  * `API_KEY_INVALID` (`401`): The API key doesn't exist, was revoked, or its secret doesn't match.
  * `API_KEY_SCOPE_DENIED` (`403`): The key lacks the scope this route needs (`blob:read` or `blob:write`); `details.required` names it.
  * `WORKSPACE_PERMISSION_DENIED` (`403`): Only with `workspace_id`: you're not a member, or your role lacks the blob permission.
  * `WORKSPACE_NOT_FOUND` (`404`): Only with `workspace_id`: no workspace with that ID, or you're not a member.
  * `VALIDATION_ERROR` (`400`): The call wasn't made with an API key; `details.reason` is `api_key_required`.
  * `RATE_LIMIT_EXCEEDED` (`429`): More than 10 calls in one hour. `details.retry_after` gives the wait in seconds.
</ResponseField>

<ResponseExample>
  ```json Error Response (401) theme={null}
  {
    "code": "AUTH_TOKEN_MISSING"
  }
  ```

  ```json Error Response (403) theme={null}
  {
    "code": "API_KEY_SCOPE_DENIED"
  }
  ```

  ```json Error Response (404) theme={null}
  {
    "code": "WORKSPACE_NOT_FOUND"
  }
  ```

  ```json Error Response (429) theme={null}
  {
    "code": "RATE_LIMIT_EXCEEDED"
  }
  ```
</ResponseExample>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.