# Managing Crusoe Cloud Object Storage API Keys

# Managing Object Storage API Keys

:::info Credential and resource scoping
Object Storage API keys are user-scoped — only the user who created a key can view or manage it. You can use object storage API keys in all buckets in all projects within your organization. Buckets are project-scoped resources.
:::

## Creating an Object Storage API Key

**CLI:**

Use the `storage tokens create` command to generate a new Object Storage API key:

```sh
crusoe storage tokens create --alias my-training-key
```

Optional parameters:

- `--alias <alias>` — A human-readable name for the key.
- `--expires-at <date>` — Expiration date for the key in RFC3339 format (e.g., `2021-12-03T19:58:34Z`).

The command outputs an access key ID and a secret key. **Save the secret key immediately** — it cannot be retrieved again after creation.

Example output:

```
Access Key ID:  CKIAXXXXXXXXXXXXXXXX
Secret Key:     SKXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Alias:          my-training-key
Expires At:     2026-12-31T00:00:00Z
```
  **UI:**

1. From the [console](https://console.crusoecloud.com), click **Admin** in the bottom-left corner.
2. Select **Security** > **[Object Storage Keys](https://console.crusoecloud.com/security/object-storage-keys)** in the left nav.
3. Click **Create Object Storage Key**.
4. Enter an alias for the key and optionally set an expiration date.
5. Click **Create**.
6. Copy and securely store the access key and secret key. The secret key is shown only once.
  **Terraform:**

Creating a storage API key is required to authenticate with the S3-compatible API for Object Storage in Crusoe Cloud. The following is intended to help get you started in using Terraform to provision a storage API key.

Copy and paste the code below in a text-editor of your choice and name the file `main.tf`. The example below creates a storage API key:

```hcl
// Crusoe Provider
terraform {
  required_providers {
    crusoe = {
      source = "registry.terraform.io/crusoecloud/crusoe"
    }
  }
}

resource "crusoe_storage_s3_key" "my_key" {
  alias = "my-storage-key"
}

output "access_key_id" {
  value = crusoe_storage_s3_key.my_key.access_key_id
}

output "secret_access_key" {
  value     = crusoe_storage_s3_key.my_key.secret_access_key
  sensitive = true
}
```

`alias` is an optional argument that provides a human-readable name for the key.

`expire_at` is an optional argument that specifies an expiration date for the key in RFC 3339 format (e.g., `2025-12-31T23:59:59Z`).

:::warning
The `secret_access_key` is only available at creation time. Make sure to save the output of `terraform apply` as the secret cannot be retrieved later.
:::

After saving the code to a `main.tf` file, the following commands serve as the process to create a resource in Crusoe Cloud using Terraform:

`terraform init` - Initializes a working directory containing Terraform configuration files.

`terraform plan` - the output of this command will show the resources Terraform plans on creating.

`terraform apply` - this command will create the resources.

To view the secret access key after creation, run `terraform output secret_access_key`.

## Listing Object Storage API Keys

**CLI:**

```sh
crusoe storage tokens list
```
  **UI:**

1. From the [console](https://console.crusoecloud.com), click **Admin** in the bottom-left corner.
2. Select **Security** > **[Object Storage Keys](https://console.crusoecloud.com/security/object-storage-keys)** in the left nav.
3. All active keys are listed with their alias, access key ID, created date, and expiration date.
  **Terraform:**

To list existing storage API keys using Terraform, the following code snippet can be used to populate a Terraform data source using the Crusoe Terraform provider.

```hcl
# list storage API keys
data "crusoe_storage_s3_keys" "keys" {}

output "crusoe_storage_keys" {
  value = data.crusoe_storage_s3_keys.keys
}
```

## Deleting an Object Storage API Key

**CLI:**

```sh
crusoe storage tokens delete <access-key>
```

Replace `<access-key>` with the access key of the key you wish to delete. For example, if the access key is `CKIAXGFV74Z2FFURA9UA`, then the command would be

```sh
crusoe storage tokens delete CKIAXGFV74Z2FFURA9UA
```

The access key can also be obtained using the list [../list/_cli.mdx] command.
  **UI:**

1. From the [console](https://console.crusoecloud.com), click **Admin** in the bottom-left corner.
2. Select **Security** > **[Object Storage Keys](https://console.crusoecloud.com/security/object-storage-keys)** in the left nav.
3. Click the delete icon next to the Object Storage API key you wish to remove.
4. Confirm the deletion.
  **Terraform:**

A storage API key can be deleted by using the `terraform destroy` command provided by the Terraform CLI tool.

:::danger Warning
Deleting an Object Storage API key immediately revokes access for any clients configured with that key.
:::