> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/~/revisions/AMiYziCllTKB2y2lmONY/storage-and-backup/s3-object-storage/concepts/key-management.md).
# Key Management
IONOS S3 Object Storage authenticates users by using a pair of keys — **Access Key** and **Secret Key**.
An Object Storage key must be generated manually using [Generate a Key](/cloud/~/revisions/AMiYziCllTKB2y2lmONY/storage-and-backup/s3-object-storage/get-started/generate-key.md) or [Object Storage Management API](https://api.ionos.com/docs/s3-management/v1/). Only upon generating the first key, the **Canonical User ID** is displayed in the [S3 Credentials](#s3-credentials) and **Users & Groups** > **Users** > **Object Storage Keys** > **S3** section.
You will need the keys to work with Object Storage through supported applications or develop your own using [API](https://docs.ionos.com/support/general-information/glossary-of-terms#api). Using the **Key management**, you can view and share your [S3 Credentials](#s3-credentials) and manage [Access keys](#access-keys).
## S3 Credentials
There are two forms of user identification: **Contract User ID** and **Canonical User ID**. Depending on the [Bucket Types](/cloud/~/revisions/AMiYziCllTKB2y2lmONY/storage-and-backup/s3-object-storage/concepts/bucket-types.md) to get access to, use the appropriate user ID as follows:
* Share your **Contract User ID** with other S3 users to get access to the contract-owned buckets and objects.
* Share your **Canonical User ID** with other S3 users to get access to the user-owned buckets and objects. This is the ID assigned to a user by the IONOS S3 Object Storage.
For more information, see [Retrieve User ID](/cloud/~/revisions/AMiYziCllTKB2y2lmONY/storage-and-backup/s3-object-storage/how-tos/retrieve-user-id.md#retrieve-user-id).
## Access keys
Logging on to IONOS S3 Object Storage requires an access key as part of the authentication process. Your S3 credentials consist of an **Access Key** and a **Secret Key**. The DCD automatically uses these credentials to set up Object Storage. Hence, deactivating an access key restricts your access through the web interface. These credentials are also required to set up access to IONOS S3 Object Storage using [S3 Tools](/cloud/~/revisions/AMiYziCllTKB2y2lmONY/storage-and-backup/s3-object-storage/s3-tools.md).
{% hint style="info" %}
**Note:**
— Starting May 30, 2024, a new S3 endpoint `eu-central-3` is added in Berlin, Germany to support contract-owned bucket types.
— All the newly generated keys from April 25, 2024, are valid for both the [Bucket Types](/cloud/~/revisions/AMiYziCllTKB2y2lmONY/storage-and-backup/s3-object-storage/concepts/bucket-types.md) by default and are usable at all the [S3 Endpoints](/cloud/~/revisions/AMiYziCllTKB2y2lmONY/storage-and-backup/s3-object-storage/s3-endpoints.md).
— The keys generated before April 25, 2024, will only have access to the user-owned buckets and be usable only in the S3 endpoints that support user-owned buckets. For more information, see [Service availability](/cloud/~/revisions/AMiYziCllTKB2y2lmONY/storage-and-backup/s3-object-storage/overview.md#service-availability).
{% endhint %}
In the **Access keys** list,
* Each key shows whether it is valid for all buckets (contract-owned buckets and user-owned buckets) or valid only for user-owned buckets.
* The `ADMIN KEY` refers to the key valid for all the buckets and provides the same access permissions as the contract owner or administrator.
**Access Key and Secret Key Length:** To prepare new functionalities of IONOS S3 Object Storage, effective April 25, 2024, the key character length is modified as follows:
* **Access Key:** The key length is increased from 20 to 92 characters.
* Previous format example: `23cbca2790edd9f62100`
* New format example: `EAAAAAFaSZEvg5hC2IoZ0EuXHRB4UNMpLkvzWdKvecNpEUF-YgAAAAEB41A3AAAAAAHnUDl-h_Lwot1NVP6F_MARJv_o`
* **Secret Key:** The key length is increased from 40 to 64 characters.
* Previous format example: `0Q1YOGKz3z6Nwv8KkkWiButqx4sVmSJW4bTGwbzO`
* New format example: `Opdxr7mG09tK4wX4s6J3nrl1Z4EJgYRui/rldkgiPmrI5bavWHuThswRqPwgbeLP`
{% hint style="info" %}
**Note:** The keys generated before April 25, 2024, continue to exist in the previous key length format and remain functional. However, these keys may not enable you to use the new functionalities in the Object Storage.
{% endhint %}
**Generate object storage keys:** A user can have multiple Object Storage keys, which can be given to other users or automated scripts. Users using such an additional Object Storage key to access the IONOS S3 Object Storage automatically inherit the credentials and access rights of the user.
This can be useful for allowing users automated (scripted) or temporary access to object storage. For more information, see [Generate a Key](/cloud/~/revisions/AMiYziCllTKB2y2lmONY/storage-and-backup/s3-object-storage/get-started/generate-key.md).
{% hint style="info" %}
**Note:** A maximum of five object storage keys per user is possible. You can create technical users to assign a different set of permissions and share access to the bucket with them. For more information, see [Retrieve the User ID of a new user](/cloud/~/revisions/AMiYziCllTKB2y2lmONY/storage-and-backup/s3-object-storage/how-tos/retrieve-user-id.md#retrieve-the-user-id-of-a-new-user).
{% endhint %}
**Activate or deactivate keys:** A key when generated is in an active state by default. You can change the key status between `active` and `inactive`. Deactivating an Object Storage key will block its access to the IONOS S3 Object Storage. You can reactivate the key and restore access to manage buckets and objects. For more information, see [Manage Keys](/cloud/~/revisions/AMiYziCllTKB2y2lmONY/storage-and-backup/s3-object-storage/how-tos/manage-keys.md).
**Delete:** If a key is no longer needed or if it should no longer be possible to gain access to the IONOS S3 Object Storage with this key, it can be deleted. This cannot be undone.
{% hint style="info" %}
**Note:**
— Deleting all the Object Storage keys does not affect the stored objects. However, the contract is charged for the data stored. You can create a new key and continue to work with Object Storage.
— You need to delete all the objects from the user-owned bucket before you delete a user or all of their Object Storage Keys from your account; otherwise, the contract continues to be charged for the stored data. In this case, contact [IONOS Cloud Support](https://docs.ionos.com/support/general-information/contact-information).
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.ionos.com/cloud/~/revisions/AMiYziCllTKB2y2lmONY/storage-and-backup/s3-object-storage/concepts/key-management.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.