---
title: "Create S3 Access Key"
method: POST
path: "/api/storage/s3/access-keys"
tags: ["S3 Access Keys"]
---

# Create S3 Access Key

`POST /api/storage/s3/access-keys`

Mint a new S3 credential pair usable against the `/storage/v1/s3`
protocol gateway. The plaintext `secretAccessKey` in the response
is returned **exactly once** — it is encrypted at rest and can
never be retrieved again. If you lose it, revoke and re-create.

Limits:
- 50 keys per project (hard cap, enforced transactionally).
- Rate-limited to 20 management requests per 15 min per IP.

## Request body

- CreateS3AccessKeyRequest
  - `description` string — Optional label to help you identify the key later

## Response `201`

Access key created

- object
  - `data` S3AccessKeyWithSecret — An S3 access key record (without the plaintext secret).
    - `id` string, uuid, required — Internal UUID of the access key record
    - `accessKeyId` string, required — 20-character access key id with fixed `INSF` prefix
    - `description` string, nullable, required — User-supplied label (max 200 chars)
    - `createdAt` string, date-time, required
    - `lastUsedAt` string, date-time, nullable, required — Updated asynchronously after each successful SigV4 verification
    - `secretAccessKey` string, required — 40-character base64url secret. **Returned only once** in the create response — retrieve, store, and keep it secret.

## Other responses

- `400` — Validation error or 50-key cap reached
- `401` — Missing or invalid API key / admin token
- `429` — Rate limit exceeded (20 requests / 15 min / IP)

---

[API](https://skmtc.net/insforge/apis/insforge-authentication-api.md) · [All operations](https://skmtc.net/insforge/apis/insforge-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/insforge/insforge-authentication-api/revisions/a935bb49f932/schema)