Authentication

All API requests to Fil One must be authenticated using AWS Signature Version 4 (SigV4). This is the same authentication method used by AWS S3, so any S3-compatible SDK or tool handles it automatically.

Looking for account sign-in?

This page is about signing API requests. For the account you log into the dashboard with, including two-factor authentication, passkeys, and recovery codes, see Account Security.

Keys and endpoints are region-specific

Every access key belongs to a single region, chosen when you create it, and it only authenticates requests to that region's endpoint. Examples below use eu-west-1, the default region — for us-east-1, use https://us-east-1.s3.fil.one and region us-east-1. If you store data in both regions you need a key for each.

API keys

Each API key consists of two parts:

Component	Description	Example format
Access Key ID	Identifies your account. Included in request headers.	FHXXXXXXXXXXXXXXXX
Secret Access Key	Signs your requests. Never sent over the wire.	EXAMPLEfakeSECRETkeyDoNotUse...

Your secret key is displayed once at creation time. Store it securely. If you lose it, you will need to create a new key pair.

Creating an API key

App

1. Go to API Keys in the left menu.
2. Click Create new key (this opens a dedicated page).
3. Give the key a descriptive name (e.g., production-backend, local-dev). Names are limited to 64 characters.
4. Choose the Region the key belongs to. This is required and cannot be changed later. A key only authenticates against its own region's endpoint — a key created in the wrong region fails with 403, which is the single most common first-run mistake.
5. Select at least one permission (Read, Write, List, Delete), and optionally restrict the key to specific buckets and set an expiration (Never, 30 days, or a custom date).
6. Copy both the Access Key ID and Secret Access Key immediately — the secret is shown only once.

You can create multiple API keys per account. See API Keys for details on configuring key permissions.

Revoking an API key

Go to API Keys in the left menu, find the key, open its ⋯ action menu, and choose Delete. Deletion is forwarded to the regional storage operator; the key stops working once that change propagates, so rotate any dependent credentials rather than assuming an exact cut-off instant.

Configuring your client

AWS CLI

Use AWS CLI v2 — v1 ignores endpoint_url in config files. Configure credentials into a named filone profile (not the default), so they land where --profile filone will read them:

aws configure --profile filone

When prompted, enter your Access Key ID, Secret Access Key, and eu-west-1 as the region. Then add the endpoint and path-style setting to the same profile:

# ~/.aws/config
[profile filone]
endpoint_url = https://eu-west-1.s3.fil.one
region = eu-west-1
s3 =
    addressing_style = path

Then use --profile filone on your commands. Path-style addressing is required — without it the CLI uses virtual-hosted URLs that fail against Fil One.

Python (boto3)

Load credentials from environment variables (recommended). Both region_name (SigV4 needs a signing region) and the path-style config are required:

import boto3
import os
from botocore.config import Config

s3 = boto3.client(
    "s3",
    endpoint_url="https://eu-west-1.s3.fil.one",
    aws_access_key_id=os.environ["FIL_ACCESS_KEY"],
    aws_secret_access_key=os.environ["FIL_SECRET_KEY"],
    region_name="eu-west-1",
    config=Config(s3={"addressing_style": "path"}),
)

For a quick local test only, you can pass credentials inline — never commit this to source control:

import boto3
from botocore.config import Config

s3 = boto3.client(
    "s3",
    endpoint_url="https://eu-west-1.s3.fil.one",
    aws_access_key_id="YOUR_ACCESS_KEY",
    aws_secret_access_key="YOUR_SECRET_KEY",
    region_name="eu-west-1",
    config=Config(s3={"addressing_style": "path"}),
)

JavaScript (AWS SDK v3)

import { S3Client } from "@aws-sdk/client-s3";

const client = new S3Client({
  endpoint: "https://eu-west-1.s3.fil.one",
  region: "eu-west-1",
  forcePathStyle: true,
  credentials: {
    accessKeyId: process.env.FIL_ACCESS_KEY,
    secretAccessKey: process.env.FIL_SECRET_KEY,
  },
});

Go

package main

import (
    "context"
    "os"

    "github.com/aws/aws-sdk-go-v2/aws"
    "github.com/aws/aws-sdk-go-v2/credentials"
    "github.com/aws/aws-sdk-go-v2/service/s3"
)

func newClient() *s3.Client {
    return s3.New(s3.Options{
        BaseEndpoint: aws.String("https://eu-west-1.s3.fil.one"),
        Region:       "eu-west-1",
        UsePathStyle: true,
        Credentials: credentials.NewStaticCredentialsProvider(
            os.Getenv("FIL_ACCESS_KEY"),
            os.Getenv("FIL_SECRET_KEY"),
            "",
        ),
    })
}

Security best practices

• Do not hardcode credentials in source code. Use environment variables, a secrets manager, or credential files.
• Create separate keys for different environments (development, staging, production).
• Rotate keys periodically. Delete old keys after deploying new ones.
• Revoke keys immediately if you suspect they have been compromised.