Managing Bucket Permissions
Permissions control who can read and write the objects in a bucket. Set a default for the whole bucket, then override individual files when needed.
Permission modes
| Mode | Who can read | Use it for |
|---|---|---|
| Private | Only requests signed with an API key | Internal or sensitive files |
| Public Read | Anyone with the URL | Public assets served through a pull zone |
| Authenticated | Anyone with a valid tokenized link | Time-limited sharing |
Set bucket permissions
- Open the bucket and go to Settings → Permissions.
- Choose the default mode for the bucket.
- Click Save.
Override a single file
From the file manager, open a file's actions menu and choose Permissions to make one object public or private independently of the bucket default.
Access keys
- Each bucket has an access key and secret key used by S3 clients and signed links.
- Rotate the keys if they are ever exposed — this immediately invalidates the old keys and any outstanding signed links.
- Never embed a secret key in client-side code; use a signed link or a pull zone instead.