Authentication

All API requests to Fil One must be authenticated using AWS Signature Version 4 (SigV4). This is the same authentication method used by AWS S3, so any S3-compatible SDK or tool handles it automatically.

API keys

Each API key consists of two parts:

Component	Description	Example format
Access Key ID	Identifies your account. Included in request headers.	FHXXXXXXXXXXXXXXXX
Secret Access Key	Signs your requests. Never sent over the wire.	wJalrXUtnFEMI/K7MDENG/...

Your secret key is displayed once at creation time. Store it securely. If you lose it, you will need to create a new key pair.

Creating an API key

App

1. Go to API Keys in the left menu.
2. Click Create Key.
3. Give the key a descriptive name (e.g., production-backend, local-dev).
4. Copy both the Access Key ID and Secret Access Key immediately.

You can create multiple API keys per account. Each key can be scoped to specific buckets and permissions (Read, Write, List, Delete), and you can set an expiration date. See API Keys for details on configuring key permissions.

Revoking an API key

Go to API Keys in the left menu, find the key, and click Delete. The key is revoked immediately. Any in-flight requests signed with that key will fail.

Configuring your client

AWS CLI

aws configure

When prompted:

AWS Access Key ID: YOUR_ACCESS_KEY
AWS Secret Access Key: YOUR_SECRET_KEY
Default region name: eu-west-1
Default output format: json

Then pass --endpoint-url https://eu-west-1.s3.fil.one on every command, or set it as a profile default:

# ~/.aws/config
[profile filone]
endpoint_url = https://eu-west-1.s3.fil.one
region = eu-west-1

# ~/.aws/credentials
[filone]
aws_access_key_id = YOUR_ACCESS_KEY
aws_secret_access_key = YOUR_SECRET_KEY

Then use --profile filone on your commands.

Python (boto3)

import boto3

s3 = boto3.client(
    "s3",
    endpoint_url="https://eu-west-1.s3.fil.one",
    aws_access_key_id="YOUR_ACCESS_KEY",
    aws_secret_access_key="YOUR_SECRET_KEY",
    region_name="eu-west-1",
)

For production use, load credentials from environment variables or AWS credential files rather than hardcoding them:

import boto3
import os

s3 = boto3.client(
    "s3",
    endpoint_url="https://eu-west-1.s3.fil.one",
    aws_access_key_id=os.environ["FIL_ACCESS_KEY"],
    aws_secret_access_key=os.environ["FIL_SECRET_KEY"],
)

JavaScript (AWS SDK v3)

import { S3Client } from "@aws-sdk/client-s3";

const client = new S3Client({
  endpoint: "https://eu-west-1.s3.fil.one",
  region: "eu-west-1",
  credentials: {
    accessKeyId: process.env.FIL_ACCESS_KEY,
    secretAccessKey: process.env.FIL_SECRET_KEY,
  },
});

Go

package main

import (
    "context"
    "os"

    "github.com/aws/aws-sdk-go-v2/aws"
    "github.com/aws/aws-sdk-go-v2/credentials"
    "github.com/aws/aws-sdk-go-v2/service/s3"
)

func newClient() *s3.Client {
    return s3.New(s3.Options{
        BaseEndpoint: aws.String("https://eu-west-1.s3.fil.one"),
        Region:       "eu-west-1",
        Credentials: credentials.NewStaticCredentialsProvider(
            os.Getenv("FIL_ACCESS_KEY"),
            os.Getenv("FIL_SECRET_KEY"),
            "",
        ),
    })
}

Security best practices

• Do not hardcode credentials in source code. Use environment variables, a secrets manager, or credential files.
• Create separate keys for different environments (development, staging, production).
• Rotate keys periodically. Delete old keys after deploying new ones.
• Revoke keys immediately if you suspect they have been compromised.