Choose a credential source

The credential source determines how S3Client obtains the keys used to sign this account’s requests.

An account uses one source at a time. All three sources also work with S3-compatible endpoints, provided the service recognizes the credentials. The provider preset neither selects the source nor grants permissions.

Credentials authorize actions according to permissions on the service. A successful connection test does not prove that you can write, delete, or change object properties.

Open the settings#

Before switching sources, prepare the replacement credentials. Saving a change from Stored credentials to an AWS source removes that account’s stored secrets; S3Client asks for confirmation. This does not revoke the keys on the service or change the AWS files.

1. In the main window, choose File > Accounts….
2. Select the account and click Edit…, or double-click its row. For a new account, click New…, select a provider, and click OK.
3. If stored secrets are locked, enter the master password when prompted.
4. In Account, open the Credentials tab.

The procedures below change the open account. Click OK in Account to save them; Cancel discards the changes.

Enter permanent or temporary keys#

Obtain the keys from the service or your administrator. Access Key ID identifies an access key; it is not the twelve-digit account number entered under Account ID.

1. Under Credential source, select Stored credentials.
2. Enter Access Key ID.
3. Enter Secret Access Key.
4. For temporary credentials, check Use temporary credentials and enter the Session Token supplied with the two keys. Leave this option unchecked for permanent keys.
5. Click Test connection, review the result, then click OK to save.

Both keys are required. Checking Use temporary credentials enables Session Token and makes it required. When unchecked, the field is disabled and its contents are not saved. S3Client removes leading and trailing spaces from these fields. Secrets are masked while you enter them.

S3Client does not renew temporary credentials entered here. When their session expires, replace both keys and the token with a new valid set. The editor has no field for entering their expiration time.

Use an AWS profile#

The profile must be configured on the computer running S3Client. Profile names are read from the shared AWS config and credentials files, normally in %USERPROFILE%\.aws\ on Windows or ~/.aws/ on other systems. AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE can override those paths. See the AWS file locations.

1. In Credentials, select AWS profile.
2. Choose a name under Profile, or enter its exact name, such as default.
3. If you have just created or changed the profile, click Reload profiles. S3Client rereads both AWS files and uses their updated configuration the next time it loads credentials. This command does not start an SSO or Login session.
4. Prepare any external session the profile needs, as described below.
5. Click Test connection, then OK to save.

The configured profile was not found. It can still be saved. means the name does not appear in the files that were read. You can save this name when preparing a configuration for another computer. The profile must be available when S3Client uses it. AWS profiles could not be loaded: indicates a loading error; its details are also available in the tooltip.

The profile supplies credentials, not S3Client’s browsing endpoints. Set the S3 region and endpoint in the account connection settings.

Use the AWS chain#

In Credentials, select AWS default credential chain, use Test connection, and save with OK. No other fields are required on this tab.

S3Client checks these sources in order and uses the first one that supplies credentials:

1. The environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and, for temporary sessions, AWS_SESSION_TOKEN.
2. The shared profile selected by AWS_DEFAULT_PROFILE, otherwise AWS_PROFILE, otherwise default.
3. The web identity role, configured through settings such as AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE.
4. The profile’s SSO session cache.
5. The profile’s Login session cache.
6. Container credentials, including ECS, if a container credential endpoint is configured.
7. Otherwise, EC2 instance role credentials, unless AWS_EC2_METADATA_DISABLED=true.

Keys in the environment can therefore take precedence over the profile you expected. To select a specific profile, use AWS profile. Variables must be available to the S3Client process; restart the application after changing its launch environment.

Prepare an external session#

S3Client uses existing AWS caches and does not start an interactive sign-in flow. For an IAM Identity Center profile, initialize or renew the session in a terminal:

aws sso login --profile my-profile

For a Login profile, run aws login --profile my-profile, replacing my-profile with the name selected in S3Client. These commands require an AWS CLI installation that supports them. Follow the AWS CLI sign-in guide to prepare the profile and cache.

A role profile needs a valid credential source. A credential_process profile needs a process that can run in S3Client’s environment. The application does not provide an interactive MFA prompt for these sources. Credentials can be renewed automatically while their source or session cache allows it. If the session can no longer be renewed, sign in again using the external tool. After signing in, run Test connection again. If you use AWS profile, you can also click Reload profiles to reload its configuration before testing.

On Windows, S3Client limits credential_process execution to 30 seconds and terminates the process and its descendants if that limit is exceeded. This is not the overall connection test timeout.

On Windows, remote HTTPS requests made by AWS credential sources use S3Client’s network and proxy settings. Local metadata services are contacted directly, without a proxy; remote HTTP credential endpoints are rejected. External processes use their own network settings.

Test access and recognize expiration#

Test connection loads the selected source and sends an S3 read request using the current settings, including unsaved changes. Click Details… to open Connection test and read the details and expiration time when known. You can also hover over the result to read this information. The test does not save the account. Its scope and network errors are covered in Add and manage accounts.