mirror of
https://github.com/supabase/supabase.git
synced 2026-10-19 16:19:10 +03:00
8864e5633c
* docs: storage s3 protocol * fix: edits * docs(storage): added ownership,management,custom-roles docs * chore: fix prettier * docs: fix formatting & rephrase some bits * fix: edits * add error codes documentation * update docs * Adds blog post * Adds embeds * chore: update images * parquet video * Update thumb.png * some doc updates * Adds compat list * guide: cyberduck * doc updates * ga page data * blog updates * update image * Update 2024-04-18-s3-compatible-storage.mdx * Update supabase-contributions.png * blog update * moves cyberduck to integrations * updated multipart section blog * Update 2024-04-18-s3-compatible-storage.mdx * update blog * fix link * blog updates * update blog * docs update * update announcement banners * update * update build stage * update --------- Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> Co-authored-by: Kang Ming <kang.ming1996@gmail.com> Co-authored-by: Inian <inian1234@gmail.com> Co-authored-by: Copple <10214025+kiwicopple@users.noreply.github.com> Co-authored-by: Jonathan Summers-Muir <MildTomato@users.noreply.github.com> Co-authored-by: Francesco Sansalvadore <f.sansalvadore@gmail.com> Co-authored-by: Francesco Sansalvadore <francescosansalvadore@mac.wind3.hub>
97 lines
3.1 KiB
Plaintext
97 lines
3.1 KiB
Plaintext
---
|
|
id: 'storage-s3-authentication'
|
|
title: 'S3 Authentication'
|
|
description: 'Authentication'
|
|
subtitle: 'Learn about authenticating with Supabase Storage S3.'
|
|
sidebar_label: 'S3'
|
|
---
|
|
|
|
You have two options to authenticate with Supabase Storage S3:
|
|
|
|
- Using the generated S3 access keys from your [project settings](/dashboard/project/_/settings/storage) (Intended exclusively for server-side use)
|
|
- Using a Session Token, which will allow you to authenticate with a user JWT token and provide limited access via Row Level Security (RLS).
|
|
|
|
## S3 access keys
|
|
|
|
<Admonition type="danger" label="Keep these credentials secure">
|
|
|
|
S3 access keys provide full access to all S3 operations across all buckets and bypass RLS policies. These are meant to be used only on the server.
|
|
|
|
</Admonition>
|
|
|
|
To authenticate with S3, generate a pair of credentials (Access Key ID and Secret Access Key), copy the endpoint and region from the [project settings page](/dashboard/project/_/settings/storage).
|
|
|
|
This is all the information you need to connect to Supabase Storage using any S3-compatible service.
|
|
|
|
<img alt="Storage S3 Access keys" src="/docs/img/storage/s3-credentials.png" width="100%" />
|
|
|
|
<Tabs
|
|
scrollable
|
|
size="small"
|
|
type="underlined"
|
|
defaultActiveId="javascript"
|
|
queryGroup="language"
|
|
>
|
|
<TabPanel id="javascript" label="aws-sdk-js">
|
|
```js
|
|
import { S3Client } from '@aws-sdk/client-s3';
|
|
|
|
const client = new S3Client({
|
|
forcePathStyle: true,
|
|
region: 'project_region',
|
|
endpoint: 'https://project_ref.supabase.co/storage/v1/s3',
|
|
credentials: {
|
|
accessKeyId: 'your_access_key_id',
|
|
accessSecretKey: 'your_secret_access_key',
|
|
}
|
|
})
|
|
```
|
|
</TabPanel>
|
|
|
|
<TabPanel id="credentials" label="AWS Credentials">
|
|
```bash
|
|
# ~/.aws/credentials
|
|
|
|
[supabase]
|
|
aws_access_key_id = your_access_key_id
|
|
aws_secret_access_key = your_secret_access_key
|
|
endpoint_url = https://project_ref.supabase.co/storage/v1/s3
|
|
region = project_region
|
|
```
|
|
</TabPanel>
|
|
|
|
</Tabs>
|
|
|
|
## Session token
|
|
|
|
You can authenticate to Supabase S3 with a user JWT token to provide limited access via RLS to all S3 operations. This is useful when you want initialize the S3 client on the server scoped to a specific user, or use the S3 client directly from the client side.
|
|
|
|
All S3 operations performed with the Session Token are scoped to the authenticated user. RLS policies on the Storage Schema are respected.
|
|
|
|
To authenticate with S3 using a Session Token, use the following credentials:
|
|
|
|
- access_key_id: `project_ref`
|
|
- access_secret_key: `anonKey`
|
|
- session_token: `valid jwt token`
|
|
|
|
For example, using the `aws-sdk` library:
|
|
|
|
```javascript
|
|
import { S3Client } from '@aws-sdk/client-s3'
|
|
|
|
const {
|
|
data: { session },
|
|
} = await supabase.auth.getSession()
|
|
|
|
const client = new S3Client({
|
|
forcePathStyle: true,
|
|
region: 'project_region',
|
|
endpoint: 'https://project_ref.supabase.co/storage/v1/s3',
|
|
credentials: {
|
|
accessKeyId: 'project_ref',
|
|
accessSecretKey: 'anonKey',
|
|
sessionToken: session.access_token,
|
|
},
|
|
})
|
|
```
|