Add and manage accounts

An S3Client account stores the settings you need to connect to Amazon S3 or an S3-compatible service: connection details, a credential source, regions, and supported features. You can save multiple accounts, including accounts for the same service that use different credentials or settings.

Adding an account in S3Client does not register an account with the provider or create any buckets. These accounts are local configurations. S3Client’s interface is in English, and this guide uses the exact labels shown in its menus, buttons, and fields.

Before you begin#

Have the following information ready:

• Credentials for the service, or a way to load them through an AWS profile or the AWS default credential chain.
• The region, S3 endpoint, and connection settings supplied by the service. A provider preset may already include these settings.
• The names of the buckets you need to access, if your credentials do not allow you to list the service’s buckets.

Your credentials must authorize the actions you want to perform. The connection test tries to list buckets or objects in a configured bucket. On Amazon S3, these requests require s3:ListAllMyBuckets or s3:ListBucket on the bucket being tested, respectively. See the AWS API references for ListBuckets and ListObjectsV2.

A provider preset supplies initial connection settings and account capabilities. It does not provide credentials or grant permissions. Capabilities describe the features supported by the service; permissions determine which actions your credentials authorize.

Open the account list#

In the main window, choose File > Accounts…. The Accounts dialog lists saved accounts in name order under Name, Comment, and Status. Status reads Enabled, Disabled, or Credentials required.

New…, Edit…, More, and Delete… are to the right of the list. Select an account to edit or delete it, or open More for Duplicate…, Save as provider preset…, and Enable or Disable. You can also double-click an account to edit it.

Above the list, Manage accounts contains Import accounts…, Export accounts…, Providers…, Credential protection…, and Reset accounts…. Click Close to leave the dialog; each action saves separately.

Add an account using a provider preset#

1. In Accounts, click New….
2. In the New account dialog, select a preset under Provider. The built-in presets are Amazon S3 and S3-compatible storage. Any installed custom presets also appear in this list.
3. Click OK to open the Account dialog.
4. On the Account tab, enter an Account name and an optional Comment. Review the settings described below.
5. On the Credentials tab, choose a credential source and provide the required details.
6. Check the connection on the Regions tab using the procedure below. For S3-compatible storage, replace the initial localhost endpoint with your service’s endpoint. Return to Account to select the Default region.
7. On the Capabilities tab, adjust capabilities and policies to match the service if the preset does not fit your configuration.
8. If you need an explicit bucket list, add the names on the Buckets tab as described below.
9. Click Test connection to check access, then OK to save the account. Testing is recommended, but the test does not have to succeed before you can save.
10. If S3Client asks you to set up or unlock protection for stored credentials, complete that step so the account can be saved. See Protect stored credentials.
11. Check that the new account appears in Accounts, then click Close. If enabled, the account appears in the main window’s S3 browser.

To install or manage a preset before creating an account, open Manage accounts > Providers… in Accounts. See Manage provider presets to install or manage custom presets.

Clicking Cancel in Account discards the new account or any changes you have made to an existing account.

Account settings#

The selected preset supplies the initial connection settings and copy domain. Both built-in presets use HTTPS on port 443. Custom presets may use different values.

Before assigning the same copy domain to multiple accounts, make sure they really share a server-side namespace. An incorrect value can cause a copy to read a different object with the same name in another namespace. For details on transfers, see Copy between S3 accounts.

When bucket tagging uses S3 Control, Account ID is required to read and edit tags. You can save the account without it, but these operations remain unavailable until the configuration is complete. For region, endpoint, and S3 Control settings, see Configure regions and S3 connections.

Other account tabs#

Check the region and endpoint#

The generic S3-compatible storage preset starts with a region named Default region, the signing region us-east-1, and the endpoint localhost. Update these values to match your service. The region’s display name is just a local label.

1. In Account, open the Regions tab.
2. Select the region you want to change. For the generic preset, select Default region.
3. Click Edit, or double-click the region, to open Edit region.
4. In Endpoint, enter the endpoint’s hostname, such as s3.example.com. Do not include https://, a port, or a path. Set the port and TLS option on the Account tab.
5. In Region, enter the signing region specified by the service.
6. Check that Signature version and Access style match the service’s requirements, then click OK.
7. Return to the Account tab and select the region under Default region.

To add more regions or configure advanced settings, see Configure regions and S3 connections.

Use an explicit bucket list#

When the Buckets list contains any names, S3Client displays those buckets instead of discovering buckets automatically. Adding a name does not create a bucket or grant access to it. Removing a name from this list does not delete the bucket from the service. The list supports up to 10,000 names; exceeding this limit prevents the account from being saved.

1. In Account, open the Buckets tab.
2. Click Add….
3. Enter the exact name of an existing bucket in Bucket name, then click OK. Each name must be unique in the list; duplicate names prevent the account from being saved.
4. Repeat for each bucket you want to display.
5. To correct a name, select it and click Edit…, or double-click it. To remove a name from the list, select it and click Remove.
6. Click OK in Account to save the list with the account.

To restore automatic discovery, remove all names from the Buckets tab and save the account. Your identity must have permission to list buckets for discovery to work.

Test the connection#

The Test connection button at the bottom of Account uses the settings currently entered in the dialog, including unsaved changes. It loads credentials and sends a read request:

• If the Buckets tab is empty, it requests the bucket list using ListBuckets.
• If you have entered bucket names, it requests at most one item from the first bucket in the alphabetically sorted list. It uses ListObjectsV2 when that capability is enabled, or ListObjects otherwise.

The test does not check every bucket or verify permissions to upload, delete, or modify objects. A successful test does not validate all the capabilities and policies configured for the account. It does not create, change, or delete any objects.

1. In Account, finish entering the account name, credentials, and default region.
2. Click Test connection.
3. Wait for the result beside the button, then click Details… to open Connection test. This dialog shows the full result and the credential expiration time when known. Technical error details are also available there. Hovering over the result also displays its explanation.
4. Correct any settings as needed and run the test again.
5. Click OK to save the settings you want to keep. Running the test does not save them.

While a test is running, click Cancel test to request cancellation. Changing credentials, regions, the default region, port, TLS, capabilities, or the list on the Buckets tab invalidates the result and requests cancellation of any test in progress. Run the test again with the new settings.

Edit an account#

Switching from Stored credentials to another source removes the account’s stored Secret Access Key and Session Token when you save. S3Client asks you to confirm this change. Have the new source ready before confirming.

1. In the main window, choose File > Accounts….
2. Select the account and click Edit…, or double-click it.
3. If its stored credentials are locked with a master password, unlock them when prompted.
4. Change the settings on the relevant tabs.
5. If you changed the connection or credentials, use Test connection to check access with the new settings.
6. Click OK to save, or Cancel to discard your changes.
7. Check the name, comment, and enabled status in Accounts, then click Close to return to the updated S3 browser.

If OK or Test connection is unavailable, check that the account name is not empty, Account ID is either empty or exactly 12 digits, a default region is selected, and the credential source is filled in. Stored credentials require both keys and, if Use temporary credentials is checked, a session token. An AWS profile requires a profile name. On the Credentials tab, a message identifies the first missing required field and clears once all required fields for the selected source are filled in. Also check that the ACL policy under Capabilities is valid. Other configuration errors may be reported during validation; the account is not saved if validation fails.

Duplicate an account#

Duplicating creates a separate account with the same settings, including its local bucket settings. The new account is always disabled so you can review it before use.

1. In Accounts, select the source account and click More > Duplicate….
2. When asked Copy the account’s stored credentials?, choose Yes to include credentials stored by S3Client, No to leave them out, or Cancel to stop. No is the default choice.
3. Enter a name in Name:. S3Client suggests the source account’s name followed by copy. Click OK.
4. If you chose Yes and the source uses stored credentials, unlock their protection when prompted.
5. Select the new account and click Edit… to review its settings and supply any missing credentials.
6. Save with OK, then choose More > Enable in Accounts when the account is ready.

For Stored credentials, choosing No removes the entire credential configuration from the duplicate. Fill it in before enabling the account. For AWS profile and AWS default credential chain, the reference to the source is retained even when you choose No; no external secrets are copied into S3Client.

Enable or disable an account#

Disabling removes an account from the S3 browser while keeping its settings and credentials. It does not revoke keys or permissions on the service.

1. In Accounts, select the account.
2. Open More, then choose Disable if it is enabled, or Enable if it is disabled.
3. Unlock stored credentials if prompted.
4. Check that the account’s icon changes, then click Close to update the S3 browser.

You can also change Account disabled on the Account tab and save with OK.

If Enable is unavailable because stored credentials are incomplete, open Edit… > Credentials, fill in the credentials, and save. If the vault is locked, unlock it; if credentials are missing, enter them.

Delete an account#

Deleting permanently removes the local account configuration and any credentials S3Client stores for it. It does not delete the provider account, buckets, or objects, or revoke access keys on the service. If you need a reusable backup, export the account with the required data before deleting it.

1. In Accounts, select the account and click Delete….
2. In Delete account, check the account name in the confirmation message.
3. Click Yes to delete it, or No to keep it.
4. Check that the account no longer appears in the list, then click Close.

Reset all accounts#

Reset accounts… permanently removes every account and all credentials stored by S3Client on this computer. It also resets local credential protection. Provider presets remain installed. External AWS profiles, provider accounts, buckets, and objects are not deleted.

Resetting also deletes local JSON backups of the account store. Files you exported manually to other locations are kept.

Before proceeding, export any accounts and secrets you want to keep, if you can still access them. Resetting cannot recover secrets protected by a lost master password. See Protect stored credentials for that situation.

1. Open File > Accounts….
2. Click Manage accounts > Reset accounts….
3. In Reset accounts, read the consequences and click Reset to confirm, or Cancel to stop.
4. Check that the Accounts list is empty. You can then recreate or import your accounts.

When saved accounts are unavailable#

The message Stored account data is unavailable. in Accounts means S3Client cannot read the local account data. Actions on accounts are disabled, and technical details explain the cause. Providers… remains available for managing presets. An empty list in this state does not mean your accounts have been deleted.

When Stored account data unavailable appears, cloud accounts are unavailable; local browsing remains usable. If Manage accounts > Reset accounts… is enabled, you can recreate local account storage with the consequences described above. Cancel is the default confirmation choice. A format newer than S3Client supports blocks this action: use a version that can read it. Resetting is also unavailable when the format cannot be verified, including when the file is too large. If the file has changed since the error, resetting is refused to protect the new data.

If editing or deleting an account fails, the Account storage error message states that no account data was changed. Read the technical details before trying again. If an account cannot be opened, Account unavailable indicates that S3Client could not load it and did not modify it.

Account reset warning means the accounts were removed, but backup cleanup or provider association cleanup is incomplete. Check that the list is empty; this warning does not mean the reset failed. Account reset error, however, means the accounts could not be reset.

Other actions in Accounts#

• Manage accounts > Import accounts… reads a local file, while Manage accounts > Export accounts… opens account export. See Import and export accounts for data selection, secret protection, and import conflicts.
• Manage accounts > Providers… opens the preset list. More > Save as provider preset… saves a local preset from the selected account. See Manage provider presets to import and export preset files.
• Manage accounts > Credential protection… opens protection settings for stored credentials. See Protect stored credentials.