# What is an access key?

An access key is the pair of values that lets software use your cloud storage without your password: an access key ID, which identifies it, and a secret access key, which proves it. It can do only what its permissions allow, so a key for one bucket can't touch anything else.

## How to treat it

- **Limit it.** Give each key only what it needs, on one bucket. Never use an account's admin or root keys.
- **Keep the secret private.** Providers usually show it only once.
- **Replace it if it leaks.** Create a new key, then delete the old one.

## Why not use your main account?

If a site is ever compromised, a limited key limits the damage. An attacker who gets a key for one bucket can reach only that bucket's files. An admin key could reach your whole account.

## How Offloft handles this

Offloft encrypts saved keys in your own database and sends them nowhere except to sign requests to your storage. Each setup guide shows how to create a key for one bucket. To keep keys out of the database, define them in `wp-config.php`. See [security](/security).

Updated 2026-11-06.

Source: https://www.offloft.com/docs/glossary/access-key