Skip to main content
A bucket’s Settings tab holds its connection details and keys, and controls who can read it from where: public access, CORS rules and the CDN cache. It’s also where you delete the bucket. To open it, in the sidebar, click Object storage, click the bucket, then click Settings.

​
Sections

Without the permission, a button is disabled and its tooltip says why. See Users and roles.

​
Details

Every value has a copy icon. To use them, see Connect with the S3 API. To move the bucket into or out of a project, use the project’s Services tab: see Projects.

​
Access keys

Access key and Secret key are the credentials S3 clients sign requests with. They’re masked: click the eye icon to show a key, or the copy icon to copy it. Keep the secret key private, and roll the keys if it leaks.

​
Roll the access keys

Rolling the keys creates a new access key and secret key. The old ones keep working for a grace period you choose, so you can update your clients first.
1

Open the dialog

In Access keys, click Roll keys.
2

Choose how long the old keys keep working

In Expiration, pick the grace period. The default is 24 hours.
3

Roll the keys

Click Roll keys. The dialog changes to Your new keys, with the New access key and New secret key and the time the old keys stop working.
4

Update your clients

Copy the new keys into every application, tool and CLI profile that uses the bucket, and deploy the applications. See Update your clients after you roll the keys. Then click Done.
The Roll object storage keys dialog with Expiration set to 24 hoursThe Roll object storage keys dialog with Expiration set to 24 hours
Expiration options: Now, 1 hour, 2 hours, 4 hours, 8 hours, 24 hours, 48 hours, 72 hours and 7 days (168 hours). While the grace period runs, Access keys shows The old keys still work until a date and time, with the Old access key and Old secret key. Sevalla revokes the old keys within 10 minutes after that time.
With Now, the old keys stop working immediately, and every client that still uses them fails until you update it. Rolling again during a grace period also revokes the previous old keys at once: only one set of old keys is kept.
Database backup targets that use the bucket get the new keys automatically. See Backups.

​
Public access

Buckets are private: every request needs the keys. Public access gives the bucket a public domain, <bucket-name>.sevalla.storage, where anyone can read any object at https://<bucket-name>.sevalla.storage/<key>, through Cloudflare’s CDN. The public domain is read-only, and you can’t use a custom domain for a bucket.

​
Enable public access

1

Start

In Public access, click Enable public access.
2

Confirm

In the dialog, click Enable public access.
Status changes to Enabled, and Public domain shows the domain, such as media-assets-h3k9p.sevalla.storage, with a copy icon and a link that opens it. The domain also appears next to the bucket’s name at the top of its pages.
Public access enabled, with the bucket's public domain on sevalla.storagePublic access enabled, with the bucket's public domain on sevalla.storage
Public access makes every object in the bucket readable by anyone who has its URL. Keep private files in a separate bucket, or share them with presigned URLs.

​
Disable public access

In Public access, click Disable public access, then click Disable public access in the dialog. The public domain stops serving the bucket’s objects, so links to them stop working. The objects themselves and the S3 API aren’t affected. If you enable public access again, the bucket gets the same domain, because it’s made from the bucket name.

​
CORS policy

CORS rules tell browsers which other websites may use the bucket’s contents: for example, a page on https://shop.example.com that loads images from the public domain or uploads with a presigned URL. Without a rule, browsers block those requests. A bucket has no CORS rules when you create it, and each rule you create is added to the others. The table lists each rule’s Allowed origins, Allowed methods and Allowed headers.

​
Create a CORS rule

1

Open the sheet

In CORS policy, click Create rule.
2

Choose the methods

Under Allowed methods, select the HTTP methods to allow.
3

Add the origins

Under Allowed origins, enter each site’s origin, such as https://shop.example.com. Click Add allowed origin for more.
4

Add the headers

Under Allowed headers, enter the request headers browsers may send, such as Content-Type, or remove them all. Click Add allowed header for more.
5

Create the rule

Click Create CORS rule.
The rule appears in the table and applies to new browser requests.
The Create CORS rule sheet with GET and PUT selected and * as the allowed origin and headerThe Create CORS rule sheet with GET and PUT selected and * as the allowed origin and header
The defaults let any website read and upload. For production, list your own origins instead of *. Rules don’t set exposed response headers or a cache time for preflight requests.

​
Delete a CORS rule

Rules can’t be updated in the dashboard: to change one, delete it and create a new one. Click … at the end of the rule, click Delete, then click Delete rule. Browsers on the rule’s origins lose the access it gave them.

​
Purge the CDN cache

Cloudflare’s CDN caches objects served from the bucket’s public domain. After you replace or delete files, visitors can still get the cached copies. Purging removes every cached copy, so the next requests get the bucket’s current files. In CDN cache, click Purge cache. There’s no confirmation: the dashboard shows Cache purged. when it’s done. Purging only matters with public access on. Requests to the S3 endpoint and presigned URLs aren’t cached.

​
Delete a bucket

Deleting a bucket deletes every object in it, revokes its keys and removes the bucket.
1

Open the dialog

In Danger zone, click Delete object storage.
2

Confirm with the bucket name

Type the bucket name, such as product-images-x7k2m, then click Delete object storage.
The dashboard shows Object storage deletion scheduled. and returns to the Object storage list. Deletion runs in the background: the bucket shows Deleting until it’s gone, and nobody can open it in the meantime. If the bucket shows Deletion failed, open it and delete it again; if that fails too, contact support.
Deleting a bucket can’t be undone, and its files can’t be recovered. Download anything you need first.
A bucket that’s an external backup target of a database can’t be deleted. Remove it from the database’s backup targets first (Backups); otherwise deleting fails with Object storage "<id>" is used as a database backup target and cannot be deleted.

​
API and CLI

Through the API and CLI, rolling keys revokes the old keys immediately unless you pass a grace period (old_keys_ttl_hours, --old-keys-ttl-hours, 0 to 168).