What is an access key?

An access key is the pair of values that lets software use your cloud storage without your password: an access key ID, which identifies it, and a secret access key, which proves it. It can do only what its permissions allow, so a key for one bucket can't touch anything else.

How to treat it

• Limit it. Give each key only what it needs, on one bucket. Never use an account's admin or root keys.
• Keep the secret private. Providers usually show it only once.
• Replace it if it leaks. Create a new key, then delete the old one.

Why not use your main account?

If a site is ever compromised, a limited key limits the damage. An attacker who gets a key for one bucket can reach only that bucket's files. An admin key could reach your whole account.

How Offloft handles this

Offloft encrypts saved keys in your own database and sends them nowhere except to sign requests to your storage. Each setup guide shows how to create a key for one bucket. To keep keys out of the database, define them in wp-config.php. See security.