Access keys and permissions

S3 tools sign their requests with an access key: an access key ID that starts with DH and a secret access key. Access keys are separate from your DockHive API keys (dh_pat_...), which work with the DockHive REST API but not with S3 tools.

Create an access key

1. In the console, open Hive Buckets → Access keys and click Create access key.
2. Enter a Name, for example production-app.
3. Under Buckets, choose All buckets or Selected buckets and tick the buckets the key may use.
4. Choose a Permission (see below).
5. Click Create key. Copy the Access key ID and the Secret access key.

Caution

The secret access key is shown only once. Store it in your app’s environment variables or your CI’s secret store, never in your code. If you lose it, create a new key and revoke the old one.

You can also create keys with the REST API.

Permissions

Permission	In the console	What the key can do
read	Read only	Download objects and their versions (GET, HEAD), list objects, versions, multipart uploads and parts, and read ACLs, tags, retention, legal holds and bucket settings.
read-write	Read & write	Everything read can, plus upload (PUT, POST, copy, multipart), delete objects and versions, and set object tags, retention and legal holds.
admin	Admin	Everything read-write can, plus bucket and object ACLs (including uploads with x-amz-acl: public-read), CORS, lifecycle, Block Public Access, versioning, object lock settings, bucket policies, bucket tags, deleting buckets and bypassing governance retention.

Give each app the least it needs: a site that only serves files needs Read only; an app that stores user uploads needs Read & write. Keep Admin keys for setup scripts and infrastructure tools.

Bucket scope

• A key for All buckets works with every bucket you own, including ones you create later.
• A key for Selected buckets works only with those buckets, and ListBuckets shows only them.
• Creating a bucket over S3 (CreateBucket) needs an Admin key for All buckets. Creating buckets in the console is usually simpler.

Revoke a key

In Hive Buckets → Access keys, revoke the key. Requests signed with it stop working within a minute. The list shows when each key was last used, which helps you find keys nobody needs any more.

REST API

With a DockHive API key, manage buckets and access keys through the DockHive API under /api/v1/buckets/. Pass the bucket’s region with ?region=.

# List your buckets in eu
curl "https://api.dockhive.io/api/v1/buckets/buckets?region=eu" \
  -H "Authorization: Bearer $DOCKHIVE_API_KEY"

# Create a read-write access key for two buckets (the secret is returned only in this response)
curl -X POST "https://api.dockhive.io/api/v1/buckets/keys?region=eu" \
  -H "Authorization: Bearer $DOCKHIVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "production-app", "permission": "read-write", "buckets": ["my-app-uploads", "my-app-assets"]}'

Use "all_buckets": true instead of "buckets" for a key that works with every bucket.